Evaluation Methodology Flashcards
7 cards from real CCA practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Evaluation Methodology flashcards as text
During a CMMC assessment, when an assessor encounters a practice that is partially implemented, which scoring outcome is most appropriate under the CMMC Level 2 methodology?
Answer: NOT MET
CMMC Level 2 uses a binary MET/NOT MET scoring — partial implementation results in NOT MET since all objectives for a practice must be satisfied.
Which document type serves as the primary vehicle for recording assessment findings and the evidence reviewed during a CMMC assessment?
Answer: Assessment Results (AR)
The Assessment Results (AR) document captures the findings, evidence reviewed, and MET/NOT MET determinations made during the assessment.
A C3PAO assessor is reviewing a cloud service used by the OSC. Which factor is MOST critical when evaluating whether the cloud solution supports CMMC compliance?
Answer: Whether the service has a FedRAMP authorization at the appropriate impact level
FedRAMP authorization at the appropriate impact level is the key factor because CMMC requires CUI to be processed in environments meeting equivalent federal security standards.
Under the CMMC evaluation methodology, what is the correct sequence of assessment phases?
Answer: Initiate → Plan → Execute → Report
The CMMC assessment process follows four phases: Initiate, Plan, Execute, and Report, as defined in the CMMC Assessment Process (CAP).
When an assessor is evaluating the 'identify' objective of a CMMC practice, what is the primary focus?
Answer: Determining whether the OSC can recognize and enumerate the relevant assets, systems, or actions
The 'identify' objective tests whether the organization can correctly recognize and enumerate what is required by the practice, such as identifying CUI or relevant system components.
Which of the following best describes the role of the Lead Assessor in a CMMC assessment team?
Answer: Serving as the primary point of contact and being responsible for overall assessment quality and findings
The Lead Assessor is accountable for overall assessment quality, coordination of team activities, and ensuring findings are accurate and defensible.
An OSC claims a practice is NOT APPLICABLE because they do not use wireless technologies. How should the assessor respond?
Answer: Validate the claim by reviewing network diagrams, configurations, and interviewing personnel to confirm no wireless is present
NOT APPLICABLE claims require the assessor to validate through evidence — such as network diagrams and interviews — that the condition truly does not exist in the OSC's environment.