Controlled Unclassified Information (CUI)
Which of the following is NOT an example of CUI?
- Press release data
Explanation: Press release data is typically public information and not considered Controlled Unclassified Information (CUI). CUI involves sensitive but unclassified information that requires protection.
Which of the following is NOT a correct way to protect CUI?
- CUI may be stored on any password-protected system.
Explanation: CUI should be stored on systems that meet specific security requirements, not just any password-protected system. The protection measures should align with the sensitivity of the information.
Which designation marks information that does not have the potential to damage national security?
- Unclassified
Explanation: Unclassified designation is used for information that does not have the potential to damage national security. It is the lowest classification level.
Which of the following is true of Controlled Unclassified Information (CUI)?
- CUI must be handled using safeguarding or dissemination controls
Explanation: CUI must be handled in accordance with specific safeguarding or dissemination controls to ensure its protection. These controls are designed to prevent unauthorized access or disclosure.
Which of the following is a security practice for protecting Personally Identifiable Information (PII)?
- Only use Government-furnished or Government-approved equipment to process PII
Explanation: To protect Personally Identifiable Information (PII), it is essential to use only authorized and approved equipment to process such sensitive data. This helps maintain the security and integrity of the information.
Which of the following is true of Unclassified information?
- It could affect the safety of government personnel, missions, and systems.
Explanation: Unclassified information, while not classified, can still impact safety, especially concerning government personnel, missions, and systems. It may have sensitive implications.
Which of the following best describes a way to safely transmit Controlled Unclassified Information (CUI)?
- Debra ensures all recipients have the required clearance and an official need-to-know before sending CUI via encrypted e-mail.
Explanation: Safely transmitting CUI involves ensuring that recipients have the necessary clearance and a legitimate need-to-know. Using encrypted e-mail adds an additional layer of security to protect the information during transmission.
Physical Security
What is a good practice for physical security?
- Challenge people without proper badges.
Explanation: Challenging individuals without proper badges is a good practice for physical security. It helps ensure that only authorized personnel have access to secure areas.
At which Cyberspace Protection Condition (CPCON) is the priority focus on critical functions only?
- CPCON 1
Explanation: CPCON 1 indicates a very high DoD risk level with a priority focus on critical functions, emphasizing the importance of securing critical operations during elevated cyber threats.
Which Cyber Protection Condition (CPCON) is the priority focus on critical and essential functions only?
- CPCON 2
Explanation: CPCON 2 indicates a high DoD risk level with a priority focus on both critical and essential functions. It signifies increased cybersecurity measures to protect essential operations.
Within a secure area, you see an individual who you do not know and is not wearing a visible badge. What should you do?
- Ask the individual for identification
Explanation: In a secure area, individuals without visible badges should be asked for identification to verify their authorization. This is a fundamental practice for maintaining physical security.
Which of the following is a best practice for physical security?
- Report suspicious activity
Explanation: Reporting suspicious activity is a best practice for physical security. It helps identify potential threats or unauthorized behavior, contributing to the overall safety and security of the environment.
Which of the following best describes good physical security?
- Lionel stops an individual in his secure area who is not wearing a badge.
Explanation: Good physical security involves proactive measures, such as stopping individuals without proper identification in secure areas. This helps prevent unauthorized access.
Identity Management
Your DoD Common Access Card (CAC) has a Public Key Infrastructure (PKI) token approved for access to the NIPRNet. In which situation below are you permitted to use your PKI token?
- On a NIPRNet system while using it for a PKI-required task
Explanation: Using a PKI token on a NIPRNet system for a PKI-required task is a legitimate and authorized use of the token. It aligns with the card’s approved functionalities.
Which of the following is the best description of two-factor authentication?
- Something you possess, like a CAC, and something you know, like a PIN or password
Explanation: Two-factor authentication involves the combination of something you possess (such as a CAC) and something you know (like a PIN or password) to enhance security.
Which is NOT a sufficient way to protect your identity?
- Use a common password for all your system and application logons.
Explanation: Using a common password for all logons is not a sufficient way to protect your identity. It poses a significant security risk, as a compromised password could grant unauthorized access to multiple accounts.
What is the best way to protect your Common Access Card (CAC)?
- Maintain possession of it at all times.
Explanation: Maintaining possession of your Common Access Card (CAC) at all times is crucial for identity protection. Loss or unauthorized use of the CAC can lead to security breaches.
Which of the following is NOT a best practice to preserve the authenticity of your identity?
- Write your password down on a device that only you access (e.g., your smartphone)
Explanation: Writing down your password on a device that only you access is not a best practice. It introduces a security risk, as unauthorized access to the device could compromise the password.
Which of the following is an example of two-factor authentication?
- Your password and a code you receive via text message
Explanation: Combining a password with a code received via text message represents two-factor authentication. It adds an additional layer of security beyond just the password.
Which of the following is true of using a DoD Public Key Infrastructure (PKI) token?
- It should only be in a system while actively using it for a PKI-required task
Explanation: A DoD Public Key Infrastructure (PKI) token should only be inserted into a system when actively using it for a PKI-required task. This practice helps minimize the risk of unauthorized access.
Which of the following is true of the Common Access Card (CAC)?
- It contains certificates for identification, encryption, and digital signature
Explanation: The Common Access Card (CAC) contains certificates for identification, encryption, and digital signature, making it a multifunctional card for secure access and transactions.
Which of the following is an example of a strong password?
- eA1xy2!P
Explanation: A strong password typically includes a mix of uppercase and lowercase letters, numbers, and special characters. In this case, “eA1xy2!P” is an example of a strong password.
Which of the following is an example of two-factor authentication?
- A Common Access Card and Personal Identification Number
Explanation: Using a Common Access Card (CAC) in combination with a Personal Identification Number (PIN) constitutes two-factor authentication. It combines something you possess (CAC) with something you know (PIN).
Sensitive Compartmented Information (SCI)
What is Sensitive Compartmented Information (SCI)?
- A program that segregates various types of classified information into distinct compartments for added protection and dissemination or distribution control
Explanation: Sensitive Compartmented Information (SCI) is a program that involves segregating classified information into distinct compartments for enhanced protection and control over dissemination or distribution.
Which of the following best describes the compromise of Sensitive Compartmented Information (SCI)?
- A person who does not have the required clearance or access caveats comes into possession of SCI in any manner.
Explanation: The compromise of SCI occurs when an unauthorized person, lacking the required clearance or access caveats, comes into possession of SCI in any manner.
A compromise of Sensitive Compartmented Information (SCI) occurs when a person who does not have the required clearance or access caveats comes into possession of SCI _____.
- in any manner
Explanation: A compromise of SCI can occur in any manner when an individual without the necessary clearance or access caveats gains possession of SCI.
When should documents be marked within a Sensitive Compartmented Information Facility (SCIF)?
- All documents should be appropriately marked, regardless of format, sensitivity, or classification.
Explanation: Within a SCIF, all documents, regardless of format, sensitivity, or classification, should be appropriately marked. This ensures proper handling and control over classified information.
Which must be approved and signed by a cognizant Original Classification Authority (OCA)?
- Security Classification Guide (SCG)
Explanation: A Security Classification Guide (SCG) must be approved and signed by a cognizant Original Classification Authority (OCA). It provides guidance on the classification of information.
What must the dissemination of information regarding intelligence sources, methods, or activities follow?
- Directives issued by the Director of National Intelligence
Explanation: Dissemination of information regarding intelligence sources, methods, or activities must follow directives issued by the Director of National Intelligence to ensure proper handling and protection.
When is it appropriate to have your security badge visible?
- At all times when in the facility
Explanation: Having your security badge visible at all times when in the facility is appropriate for easy identification and compliance with security protocols.
What should the owner of this printed SCI do differently?
- Retrieve classified documents promptly from printers
Explanation: The owner of printed SCI should retrieve classified documents promptly from printers to prevent unauthorized access and ensure the security of sensitive information.
What should the participants in this conversation involving SCI do differently?
- Physically assess that everyone within listening distance is cleared and has a need-to-know for the information being discussed
Explanation: Participants in a conversation involving SCI should physically assess that everyone within listening distance is cleared and has a need-to-know for the information being discussed. This ensures proper handling of classified information.
When faxing Sensitive Compartmented Information (SCI), what actions should you take?
- Mark SCI documents appropriately and use an approved SCI fax machine
Explanation: When faxing SCI, it is essential to mark documents appropriately and use an approved SCI fax machine to maintain the security and integrity of the information.
What action should you take if you become aware that Sensitive Compartmented Information (SCI) has been compromised?
- Contact your security point of contact to report the incident
Explanation: If aware of a compromise of SCI, the immediate action should be to contact the security point of contact to report the incident and initiate appropriate response measures.
What guidance is available for marking Sensitive Compartmented Information (SCI)?
- Sensitive Compartmented Information Guides
Explanation: Guidance for marking SCI is provided by Sensitive Compartmented Information Guides, ensuring consistency and compliance with established security protocols.
Which of the following is true of transmitting Sensitive Compartmented Information (SCI)?
- You must never transmit SCI via fax machine
Explanation: Transmitting SCI via fax machine is not allowed. It is crucial to use secure and approved methods for transmitting SCI to prevent unauthorized access or compromise.
Which of the following is true of Sensitive Compartmented Information (SCI)?
- Access requires a formal need-to-know determination issued by the Director of National Intelligence
Explanation: Access to SCI requires a formal need-to-know determination issued by the Director of National Intelligence to ensure that individuals accessing the information have a legitimate and specific reason.
Which of the following is true of sharing information in a Sensitive Compartmented Information Facility (SCIF)?
- Individuals must avoid referencing derivatively classified reports classified higher than the recipient.
Explanation: In a SCIF, individuals must avoid referencing derivatively classified reports classified higher than the recipient to prevent unauthorized access to information beyond the individual’s clearance level.
Removable Media in a SCIF
What must users ensure when using removable media such as compact disk (CD)?
- It displays a label showing maximum classification, date of creation, point of contact, and Change Management (CM) Control Number.
Explanation: Users must ensure that removable media, such as a compact disk (CD), displays a label showing maximum classification, date of creation, point of contact, and Change Management (CM) Control Number. This labeling helps track and manage sensitive information.
What portable electronic devices (PEDs) are allowed in a Sensitive Compartmented Information Facility (SCIF)?
- Government-owned PEDs when expressly authorized by your agency
Explanation: Only government-owned portable electronic devices (PEDs) that are expressly authorized by the agency are allowed in a Sensitive Compartmented Information Facility (SCIF). This restriction is in place to maintain control and security.
What action should you take when using removable media in a Sensitive Compartmented Information Facility (SCIF)?
- Identify and disclose it with local Configuration/Change Management Control and Property Management authorities
Explanation: When using removable media in a SCIF, it is essential to identify and disclose it with local Configuration/Change Management Control and Property Management authorities. This ensures proper tracking and adherence to security protocols.