Understanding the " Examine " Assessment Method in CMMC 2.0

CMMC 2.0 usesthree assessment methodsto evaluate security compliance:

Examine– Reviewing, inspecting, observing, studying, or analyzing assessment objects (e.g., policies, system documentation).

Interview– Speaking with personnel to verify knowledge and responsibilities.

Test– Performing technical validation to check system configurations.

Relevant CMMC 2.0 Reference:

TheCMMC Assessment Process (CAP)definesExamineas the method used toreview or analyze assessment objects, such as policies, procedures, configurations, and logs.

Why is the Correct Answer " Examine " (C)?

A. Test → Incorrect

" Test " involvesexecutinga function to validate its security (e.g., verifying access controls through a live system test).

B. Assess → Incorrect

" Assess " is a broad term; CMMC explicitly defines " Examine " as the method for reviewing documentation.

C. Examine → Correct

" Examine " is the official term forreviewing policies, procedures, configurations, or logs.

D. Interview → Incorrect

" Interview " involvesverbal discussions with personnel, not document analysis.

CMMC 2.0 References Supporting this Answer:

CMMC Assessment Process (CAP) Document

Defines " Examine " asanalyzing assessment objects (e.g., policies, procedures, logs, documentation).

NIST SP 800-171A

Specifies " Examine " as a method toreview security controls and configurations.