CCA Evaluation Methodology 2 — Questions and Answers
Question 1: During a CMMC assessment, when an assessor encounters a practice that is partially implemented, which scoring outcome is most appropriate under the CMMC Level 2 methodology?
- MET
- NOT MET (Correct answer)
- NOT APPLICABLE
- DEFERRED
Correct answer: NOT MET
CMMC Level 2 uses a binary MET/NOT MET scoring — partial implementation results in NOT MET since all objectives for a practice must be satisfied.
Question 2: Which document type serves as the primary vehicle for recording assessment findings and the evidence reviewed during a CMMC assessment?
- System Security Plan (SSP)
- Assessment Plan (AP)
- Assessment Results (AR) (Correct answer)
- Plan of Action and Milestones (POA&M)
Correct answer: Assessment Results (AR)
The Assessment Results (AR) document captures the findings, evidence reviewed, and MET/NOT MET determinations made during the assessment.
Question 3: A C3PAO assessor is reviewing a cloud service used by the OSC. Which factor is MOST critical when evaluating whether the cloud solution supports CMMC compliance?
- Whether the cloud vendor is publicly traded
- Whether the service has a FedRAMP authorization at the appropriate impact level (Correct answer)
- Whether the cloud vendor has ISO 27001 certification
- Whether the cloud service offers multi-factor authentication
Correct answer: Whether the service has a FedRAMP authorization at the appropriate impact level
FedRAMP authorization at the appropriate impact level is the key factor because CMMC requires CUI to be processed in environments meeting equivalent federal security standards.
Question 4: Under the CMMC evaluation methodology, what is the correct sequence of assessment phases?
- Plan → Execute → Report → Close
- Initiate → Plan → Execute → Report (Correct answer)
- Scope → Assess → Remediate → Certify
- Kickoff → Discovery → Testing → Certification
Correct answer: Initiate → Plan → Execute → Report
The CMMC assessment process follows four phases: Initiate, Plan, Execute, and Report, as defined in the CMMC Assessment Process (CAP).
Question 5: When an assessor is evaluating the 'identify' objective of a CMMC practice, what is the primary focus?
- Confirming that policies exist and are approved
- Determining whether the OSC can recognize and enumerate the relevant assets, systems, or actions (Correct answer)
- Verifying that technical controls are functioning correctly
- Checking whether personnel have completed required training
Correct answer: Determining whether the OSC can recognize and enumerate the relevant assets, systems, or actions
The 'identify' objective tests whether the organization can correctly recognize and enumerate what is required by the practice, such as identifying CUI or relevant system components.
Question 6: Which of the following best describes the role of the Lead Assessor in a CMMC assessment team?
- Conducting all technical testing personally
- Serving as the primary point of contact and being responsible for overall assessment quality and findings (Correct answer)
- Approving the final certification decision
- Managing the C3PAO's contract with the OSC
Correct answer: Serving as the primary point of contact and being responsible for overall assessment quality and findings
The Lead Assessor is accountable for overall assessment quality, coordination of team activities, and ensuring findings are accurate and defensible.
Question 7: An OSC claims a practice is NOT APPLICABLE because they do not use wireless technologies. How should the assessor respond?
- Accept the claim without further review
- Document the claim and move to the next practice
- Validate the claim by reviewing network diagrams, configurations, and interviewing personnel to confirm no wireless is present (Correct answer)
- Automatically mark the practice as MET since it cannot be violated
Correct answer: Validate the claim by reviewing network diagrams, configurations, and interviewing personnel to confirm no wireless is present
NOT APPLICABLE claims require the assessor to validate through evidence — such as network diagrams and interviews — that the condition truly does not exist in the OSC's environment.
CCA Evaluation Methodology 2
During a CMMC assessment, when an assessor encounters a practice that is partially implemented, which scoring outcome is most appropriate under the CMMC Level 2 methodology?