Exam CMMC-CCP Topic 1 Question 50 Discussion

Understanding "Adequate Evidence" in the CMMC Assessment Process
In aCMMC assessment,adequate evidencerefers to the proof required to demonstrate that a specific cybersecurity practice has been implemented correctly. Evidence can come from:
Artifacts(e.g., security policies, system configurations, logs).
Interview responses(e.g., verbal confirmation from personnel about their responsibilities).
Demonstrations(e.g., showing how a security control is implemented in real time).
Testing(e.g., verifying technical security mechanisms such as multi-factor authentication).
Thegoalof evidence collection is to determinewhether a CMMC practice is met-not just whether the organization operates within the assessment scope.
Why is the Correct Answer "Determine if a given artifact, interview response, demonstration, or test meets the CMMC practice" (D)?
A). Verify, based on an assessment and organizational scope # Incorrect Theassessment scopedefineswhat is evaluated, but adequacy of evidence is based oncompliance with specific CMMC practices.
B). Verify, based on an assessment and organizational practice # Incorrect CMMC assessments focus on cybersecurity practices defined in the CMMC framework, not just general organizational practices.
C). Determine if a given artifact, interview response, demonstration, or test meets the CMMC scope # Incorrect Thescopedefines the assessment boundaries, but theassessment team's job is to confirm whether CMMC practices are satisfied.
D). Determine if a given artifact, interview response, demonstration, or test meets the CMMC practice # Correct TheCMMC assessment process focuses on ensuring that required practices are implemented, making this the correct answer.
CMMC 2.0 References Supporting this Answer:
CMMC Assessment Process (CAP) Document
Defines "adequate evidence" asproof that a CMMC practice has been correctly implemented.
CMMC 2.0 Assessment Criteria
Specifies that evidence must beevaluated against specific cybersecurity practices.
NIST SP 800-171A (Assessment Procedures for NIST SP 800-171)
Provides guidance on evaluating artifacts, interviews, demonstrations, and testing to confirm compliance with required practices.
Final Answer:
#D. Determine if a given artifact, interview response, demonstration, or test meets the CMMC practice.