CMMC-CCA Exam Question 16
You are the Lead Assessor conducting a CMMC assessment for an OSC. During the initial stages ofthe assessment, the OSC provided a comprehensive list of evidence sources, including various documents, policies, and procedures. However, as the assessment progresses, you notice that the OSC has started to rely more heavily on demonstrations and live system tests to showcase their compliance with certain CMMC practices. While these demonstrations and tests provide valuable insights, they deviate from the originally planned approach of primarily relying on documented evidence. This change in the evidence collection approach could potentially impact the assessment timeline and the overall assessment plan. As the Lead Assessor, what should you do in response to this change in the evidence collection approach?
CMMC-CCA Exam Question 17
A CMMC Assessment Team is evaluating an OSC's implementation of RA.L2-3.11.1 - Risk Assessments.
Upon examining the OSC's Risk Assessment policy, the team learns that the OSC has specified frequencies for assessing risks to organizational operations, assets, and personnel. The results and reviews of risk assessments indicated that assessments are conducted at these defined frequencies. For the OSC's risk assessment to be accurate, it must consider all of the following except which factor?
Upon examining the OSC's Risk Assessment policy, the team learns that the OSC has specified frequencies for assessing risks to organizational operations, assets, and personnel. The results and reviews of risk assessments indicated that assessments are conducted at these defined frequencies. For the OSC's risk assessment to be accurate, it must consider all of the following except which factor?
CMMC-CCA Exam Question 18
During the examination of evidence for access control procedures, you review an OSC's Access Control List (ACL). The ACL appears to include most user accounts, but you notice that it lacks entries for several newly hired employees. You also realize that some parts of the OSC's access control policy haven't been signed and endorsed by senior management. Additionally, you notice multiple attestations from employees who are not the proper system owners. How should you proceed when encountering an incomplete artifact, such as the missing personnel in the access control list?
CMMC-CCA Exam Question 19
Change is a part of any production process and must be meticulously managed. System Change Management is a CMMC requirement, and you have been called in to assess the implementation of CMMC requirements.
When examining the contractor's change management policy, you realize there is a defined change advisory board that has a review and approval mandate for any proposed changes. The change advisory board maintains a change request system where all the changes are submitted and documented for easy tracking and review. The contractor also has a defined rollback plan defining what to do in case the approved changes result in unexpected issues or vulnerabilities. What evidence artifacts can the contractor also cite as evidence to show their compliance with CM.L2-3.4.3 - System Change Management besides their change management policy?
When examining the contractor's change management policy, you realize there is a defined change advisory board that has a review and approval mandate for any proposed changes. The change advisory board maintains a change request system where all the changes are submitted and documented for easy tracking and review. The contractor also has a defined rollback plan defining what to do in case the approved changes result in unexpected issues or vulnerabilities. What evidence artifacts can the contractor also cite as evidence to show their compliance with CM.L2-3.4.3 - System Change Management besides their change management policy?
CMMC-CCA Exam Question 20
An OSC undergoing a CMMC Level 2 assessment has provided a detailed System Security Plan (SSP) and supporting evidence. During the assessment, you notice that the SSP references a practice as being fully implemented, but interviews with staff reveal that the practice is not consistently followed. How should the Lead Assessor proceed?