CMMC CMMC-CCP Updated Exam

Page: 9 / 12

Question 36

An Assessment Team is conducting a Level 2 Assessment at the request of an OSC. The team has begun to score practices based on the evidence provided. At a MINIMUM what is required of the Assessment Team to determine if a practice is scored as MET?

Options:

All three types of evidence are documented for every control.

Examine and accept evidence from one of the three evidence types.

Complete one of the following; examine two artifacts, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel.

Complete two of the following: examine one artifact, either observe a satisfactory demonstration of one control or receive one affirmation from the OSC personnel.

Question 37

Who makes the final determination of the assessment method used for each practice?

Options:

CCP

osc

Site Manager

Lead Assessor

Question 38

In late September. CA.L2-3.12.1: Periodically assess the security controls in organizational systems to determine if the controls are effective in their application is assessed. Procedure specifies that a security control assessment shall be conducted quarterly. The Lead Assessor is only provided the first quarter assessment report because the person conducting the second quarter's assessment is currently out of the office and will return to the office in two hours. Based on this information, the Lead Assessor should determine that the evidence is;

Options:

sufficient, and rate the audit finding as MET

insufficient, and rate the audit finding as NOT MET.

sufficient, and re-rate the audit finding after a quarter two assessment report is examined.

insufficient, and re-rate the audit finding after a quarter two assessment report is examined.

Question 39

An OSC has submitted evidence for an upcoming assessment. The assessor reviews the evidence and determines it is not adequate or sufficient to meet the CMMC practice. What can the assessor do?