CCA Evidence Collection & Documentation Flashcards
6 cards from real CCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CCA Evidence Collection & Documentation flashcards as text
What does the CMMC Assessment Guide specify regarding the 'test' assessment method?
Answer: Tests involve exercising or operating controls to observe how they function and verify their effectiveness
Testing involves exercising controls — such as simulating events or performing functional checks — to observe whether they operate as intended and produce expected results.
How should a CCA assessor document a practice determination of 'Not Met'?
Answer: With specific evidence, the gap identified, and the practice objective that was not satisfied
'Not Met' findings must be documented with the specific evidence reviewed, the identified gap, and which practice objective was not satisfied to ensure transparency and defensibility.
What is the purpose of interviewing personnel during a CMMC assessment?
Answer: To gather information about security practice implementation that may not be fully captured in documentation
Interviews with knowledgeable personnel provide context, clarify how practices are actually implemented day-to-day, and can surface discrepancies between documented procedures and actual practice.
Which of the following is an example of objective evidence for assessing the practice of enforcing password complexity requirements?
Answer: A screenshot of Active Directory Group Policy settings showing complexity requirements enabled
A screenshot of Group Policy settings directly shows the technical enforcement of password complexity, providing objective evidence that the requirement is implemented at the system level.
How should assessors handle conflicting evidence during a CMMC assessment?
Answer: Document all conflicting evidence, gather additional evidence to resolve the conflict, and make a determination based on the weight of evidence
When evidence conflicts, assessors must document the conflict, seek additional evidence to clarify, and make a reasonable determination based on the totality of available evidence.
What is the significance of 'sampling' in CMMC evidence collection?
Answer: It allows assessors to only review a subset of systems to draw conclusions about the entire population
Sampling allows assessors to review a representative subset of systems, devices, or users to make reasonable inferences about the broader population without exhaustively testing every instance.