CCA Evaluation Methodology 4

Question 1

Under CMMC methodology, which condition allows an assessor to use sampling when evaluating a practice across multiple similar assets?

Accepted Answer

Sampling is permitted when assets are homogeneous, consistently configured, and managed identically

Answer

Assessors may use sampling when assets are demonstrably homogeneous — same configuration, management, and purpose — making a full review of every asset redundant.

Question 2

During the Execute phase, an assessor discovers a critical control gap not identified during scoping. What is the correct course of action?

Accepted Answer

Document the finding, notify the Lead Assessor, and assess it as part of the current engagement

Answer

Newly discovered findings must be documented and assessed; the Lead Assessor coordinates with the OSC to ensure all relevant scope items are evaluated.

Question 3

A CMMC assessor is reviewing access control practices. An employee states they share credentials with a colleague when that colleague is out of the office. How should this be scored?

Accepted Answer

NOT MET, because shared credentials violate individual accountability requirements

Answer

Credential sharing violates the individual accountability principle required by access control practices, making the relevant practice NOT MET regardless of technical configurations.

Question 4

What is the significance of a System Security Plan (SSP) in the context of a CMMC evaluation?

Accepted Answer

It is the OSC's primary artifact describing how each CMMC practice is implemented and provides the starting point for assessor review

Answer

The SSP is the OSC's foundational document describing control implementations, and assessors use it as the primary starting point to plan and focus their evidence review.

Question 5

Which of the following BEST describes 'objective evidence' as used in CMMC assessment methodology?

Accepted Answer

Factual information based on observation, measurement, test, or other means that can be verified and does not depend on personal opinion

Answer

Objective evidence is verifiable, factual information obtained through examination, testing, or observation — it does not rely on subjective assessor opinion or unverified OSC assertions.

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

(CCA) Certified Cybersecurity Maturity Model Certification Assessor Practice Test

CCA Evaluation Methodology 4