Cyber Awareness Challenge 2023 Flashcards
99 Questions
100 Views

Choose a study mode

Play Quiz
Study Flashcards
Spaced Repetition
Chat to lesson

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

What portable electronic devices (PEDs) are allowed in a Sensitive Compartmented Information Facility (SCIF)?

Government-owned PEDs when expressly authorized by your agency.

What action should you take when using removable media in a SCIF?

Identify and disclose it with local Configuration/Change Management Control and Property Management authorities.

What are some examples of malicious code?

  • Spreadsheet formulas
  • Trojan horses (correct)
  • Viruses (correct)
  • Worms (correct)

    • Which of the following is NOT a way that malicious code spreads?

    <p>Legitimate software updates</p> Signup and view all the answers

    After visiting a website on your Government device, a popup appears asking if you want to run an application. Is this safe?

    <p>False</p> Signup and view all the answers

    You should provide your credit card information if a website requires it during registration.

    <p>False</p> Signup and view all the answers

    How should you respond to the theft of your identity?

    <p>Report the crime to local law enforcement.</p> Signup and view all the answers

    You should only accept cookies from reputable, trusted websites.

    <p>True</p> Signup and view all the answers

    Which is a best practice that can prevent viruses and other malicious code from being downloaded when checking your e-mail?

    <p>Do not access website links, buttons, or graphics in e-mail.</p> Signup and view all the answers

    What is TRUE of a phishing attack?

    <p>Phishing can be an email with a hyperlink as bait.</p> Signup and view all the answers

    Which of the following is a way to protect against social engineering?

    <p>Follow instructions given only by verified personnel</p> Signup and view all the answers

    What is whaling?

    <p>A type of phishing targeted at senior officials.</p> Signup and view all the answers

    What action should you take with an email from a friend containing a compressed Uniform Resource Locator (URL)?

    <p>Investigate the link's actual destination using the preview feature.</p> Signup and view all the answers

    How can you protect yourself from internet hoaxes?

    <p>Use online sites to confirm or expose potential hoaxes.</p> Signup and view all the answers

    Which may be a security issue with compressed Uniform Resource Locators (URLs)?

    <p>They may be used to mask malicious intent.</p> Signup and view all the answers

    What is a best practice while traveling with mobile computing devices?

    <p>Maintain possession of your laptop and other government-furnished equipment (GFE) at all times.</p> Signup and view all the answers

    It may be compromised as soon as you exit the plane when traveling overseas with a mobile phone.

    <p>True</p> Signup and view all the answers

    What security risk does a public Wi-Fi connection pose?

    <p>It may expose the connected device to malware.</p> Signup and view all the answers

    When can you check personal email on your Government-furnished equipment (GFE)?

    <p>If allowed by organizational policy.</p> Signup and view all the answers

    What is a critical consideration on using cloud-based file sharing and storage applications on your Government-furnished equipment (GFE)?

    <p>Determine if the software or service is authorized.</p> Signup and view all the answers

    What should you do if asked about a classified security project?

    <p>Attempt to change the subject to something non-work related, but neither confirm nor deny the article's authenticity.</p> Signup and view all the answers

    Which of the following may help to prevent spillage?

    <p>Label files with classification markings.</p> Signup and view all the answers

    What best describes an unauthorized transfer of classified data to a lower classification level?

    <p>Spillage because classified data was moved to a lower classification level system without authorization.</p> Signup and view all the answers

    What should you do upon receiving an email with a classified attachment on an unclassified system?

    <p>Call your security point of contact immediately.</p> Signup and view all the answers

    What action should you take if a reporter asks about potentially classified information on the web?

    <p>Ask for information about the website, including the URL.</p> Signup and view all the answers

    What should you refer a reporter to if they ask about classified information?

    <p>Your organization's public affairs office.</p> Signup and view all the answers

    What is the correct action if you suspect spillage has occurred?

    <p>Immediately notify your security point of contact.</p> Signup and view all the answers

    Which of the following is a good practice to prevent spillage?

    <p>Be aware of classification markings.</p> Signup and view all the answers

    What should you do after finding classified information on the Internet?

    <p>Note any identifying information and the website's Uniform Resource Locator (URL).</p> Signup and view all the answers

    How can you protect classified data when it is not in use?

    <p>Store classified data appropriately in a GSA-approved vault/container.</p> Signup and view all the answers

    What is required for an individual to access classified data?

    <p>Appropriate clearance, a signed and approved non-disclosure agreement, and need-to-know.</p> Signup and view all the answers

    Which classification level is associated with serious damage to national security?

    <p>Secret.</p> Signup and view all the answers

    Which of the following is a good practice for protecting classified information?

    <p>Ensure proper labeling of all classified material.</p> Signup and view all the answers

    Classified material must be appropriately marked.

    <p>True</p> Signup and view all the answers

    What damage can unauthorized disclosure of Confidential information cause?

    <p>Damage to national security.</p> Signup and view all the answers

    You must have permission from your organization to telework.

    <p>True</p> Signup and view all the answers

    Which type of information could cause serious damage to national security if disclosed without authorization?

    <p>Secret.</p> Signup and view all the answers

    How should you protect a printed classified document when it is not in use?

    <p>Store it in a General Services Administration (GSA)-approved vault or container.</p> Signup and view all the answers

    What level of damage can unauthorized disclosure of Top Secret information cause?

    <p>Exceptionally grave damage.</p> Signup and view all the answers

    How many potential insider threat indicators are displayed by a colleague who vacations yearly, is a father, has poor work quality, but works well with his team?

    <p>~0 indicator.</p> Signup and view all the answers

    How many potential insider threat indicators does a coworker displaying persistent behavior to obtain classified information, being boisterous about debt, and complaining of anxiety demonstrate?

    <p>3 or more</p> Signup and view all the answers

    How many potential insider threat indicators are shown by a colleague who is charming, wins performance awards, but is occasionally aggressive about classified information?

    <p>1 indicator.</p> Signup and view all the answers

    What advantages do insiders have that allow them to cause damage more easily?

    <p>Insiders are given a level of trust and have authorized access to government information systems.</p> Signup and view all the answers

    What type of behavior should be reported as a potential insider threat?

    <p>Coworker making consistent statements indicative of hostility or anger toward the United States in its policies.</p> Signup and view all the answers

    Which activity should be reported as a potential security incident?

    <p>A coworker removes sensitive information without authorization.</p> Signup and view all the answers

    Which scenario might indicate a reportable insider threat?

    <p>A coworker uses a personal electronic device in a secure area where their use is prohibited.</p> Signup and view all the answers

    How many insider threat indicators are shown by a colleague with persistent efforts to obtain classified project information, vocal about credit card issues, and complaints of anxiety?

    <p>3 or more indicators.</p> Signup and view all the answers

    Which type of behavior should be reported as a potential insider threat?

    <p>Hostility or anger toward the United States and its policies.</p> Signup and view all the answers

    Which of the following is NOT considered a potential insider threat indicator?

    <p>Interest in learning a foreign language.</p> Signup and view all the answers

    What do insiders with authorized access to information pose?

    <p>A risk to national security.</p> Signup and view all the answers

    When is the safest time to post details of your vacation activities on social media?

    <p>After you have returned home following the vacation.</p> Signup and view all the answers

    How many potential insider threat indicators does a colleague show who abruptly becomes hostile after positive relationships and has unusual expenses?

    <p>3 or more indicators.</p> Signup and view all the answers

    What is an insider threat?

    <p>Someone who uses authorized access, wittingly or unwittingly, to harm national security through unauthorized disclosure.</p> Signup and view all the answers

    Which of the following is a potential insider threat indicator?

    <p>Unusual interest in classified information.</p> Signup and view all the answers

    Which of the following is a reportable insider threat activity?

    <p>Attempting to access sensitive information without need-to-know.</p> Signup and view all the answers

    What should Alex do differently to avoid temptation to betray his country?

    <p>Avoid talking about work outside of the workplace or with people without a need-to-know.</p> Signup and view all the answers

    How many insider threat indicators does Alex demonstrate?

    <p>Three or more.</p> Signup and view all the answers

    What should Alex's colleagues do if they notice suspicious behavior?

    <p>Report the suspicious behavior in accordance with their organization's insider threat policy.</p> Signup and view all the answers

    What function do Insider Threat Programs aim to fulfill?

    <p>Proactively identify potential threats and formulate holistic mitigation responses.</p> Signup and view all the answers

    What should you do if you receive a game application request with permission to access your friends, profile information, cookies, and sites visited?

    <p>Decline the request.</p> Signup and view all the answers

    Which of the following is a security risk when posted publicly on your social networking profile?

    <p>Your personal email address.</p> Signup and view all the answers

    Which of the following is a security best practice when using social networking sites?

    <p>Understand and use available privacy settings.</p> Signup and view all the answers

    When may you face consequences due to online misconduct?

    <p>If you participate in or condone it at any time.</p> Signup and view all the answers

    Which of the following is a security best practice when using social networking sites?

    <p>Use personal contact information when establishing your account.</p> Signup and view all the answers

    Which of the following is a security risk when posted publicly on your social networking profile?

    <p>Your mother's maiden name.</p> Signup and view all the answers

    What should you do if your cousin posts an incendiary article on social media?

    <p>Research the source of the article to evaluate its credibility and reliability.</p> Signup and view all the answers

    What best describes the sources that contribute to your online identity?

    <p>Data about you collected from all sites, apps, and devices can be aggregated to form a profile.</p> Signup and view all the answers

    What should you do if contacted by a foreign national seeking classified information?

    <p>Inform your security point of contact.</p> Signup and view all the answers

    Which piece of information is safest to include on your social media profile?

    <p>Photos of your pet.</p> Signup and view all the answers

    Which piece of information is safest to include on your social media profile?

    <p>Your favorite movie.</p> Signup and view all the answers

    Adversaries exploit social networking sites to disseminate fake news.

    <p>True</p> Signup and view all the answers

    How can you protect your organization on social networking sites?

    <p>Ensure no identifiable landmarks are visible in any photos taken in a work setting that you post.</p> Signup and view all the answers

    Which of the following is NOT an example of Controlled Unclassified Information (CUI)?

    <p>Press release data.</p> Signup and view all the answers

    Which of the following is NOT correct regarding the protection of CUI?

    <p>CUI can be stored on any password-protected system.</p> Signup and view all the answers

    Which describes a way to safely transmit Controlled Unclassified Information (CUI)?

    <p>Verify that the information is CUI, include a CUI marking in the subject header, and digitally sign the email.</p> Signup and view all the answers

    What is a best practice for protecting CUI?

    <p>Store it in a locked desk drawer after working hours.</p> Signup and view all the answers

    Which of the following is not Controlled Unclassified Information (CUI)?

    <p>Press release data.</p> Signup and view all the answers

    Unclassified information doesn't require markings or distribution controls.

    <p>True</p> Signup and view all the answers

    Which of the following includes Personally Identifiable Information (PII) and Protected Health Information (PHI)?

    <p>Not provided in the content.</p> Signup and view all the answers

    What is a good practice for physical security?

    <p>Challenge people without proper badges.</p> Signup and view all the answers

    At which Cyberspace Protection Condition (CPCON) is the priority focus on critical functions only?

    <p>CPCON 1.</p> Signup and view all the answers

    What should you do within a secure area when encountering someone without a visible badge?

    <p>Ask the individual for identification.</p> Signup and view all the answers

    When are you permitted to use your PKI token?

    <p>On a NIPRNet system while using it for a PKI-required task.</p> Signup and view all the answers

    What is the best description of two-factor authentication?

    <p>Something you possess, like a CAC, and something you know, like a PIN or password.</p> Signup and view all the answers

    Using a common password for all your system and application logons is sufficient for protecting your identity.

    <p>False</p> Signup and view all the answers

    What is the best way to protect your Common Access Card (CAC)?

    <p>Maintain possession of it at all times.</p> Signup and view all the answers

    Which is NOT a best practice to preserve the authenticity of your identity?

    <p>Write your password down on a device that only you access.</p> Signup and view all the answers

    Which of the following is an example of two-factor authentication?

    <p>Your password and a code you receive via text message.</p> Signup and view all the answers

    Which of the following is an example of a strong password?

    <p>eA1xy2!P</p> Signup and view all the answers

    What is Sensitive Compartmented Information (SCI)?

    <p>A program that segregates various types of classified information into distinct compartments for added protection.</p> Signup and view all the answers

    What best describes the compromise of Sensitive Compartmented Information (SCI)?

    <p>A person who does not have the required clearance comes into possession of SCI.</p> Signup and view all the answers

    When should documents be marked within a Sensitive Compartmented Information Facility (SCIF)?

    <p>All documents should be marked, regardless of classification.</p> Signup and view all the answers

    What must be approved and signed by a cognizant Original Classification Authority (OCA)?

    <p>Security Classification Guide (SCG).</p> Signup and view all the answers

    What must the dissemination of information regarding intelligence sources adhere to?

    <p>Directives issued by the Director of National Intelligence.</p> Signup and view all the answers

    When is it appropriate to have your security badge visible?

    <p>At all times when in the facility.</p> Signup and view all the answers

    What should you do with printed SCI documents promptly?

    <p>Retrieve classified documents promptly from printers.</p> Signup and view all the answers

    What should participants in a conversation involving SCI do differently?

    <p>Physically assess that everyone within listening distance is cleared and has a need-to-know.</p> Signup and view all the answers

    What actions should you take when faxing Sensitive Compartmented Information (SCI)?

    <p>Mark SCI documents appropriately and use an approved SCI fax machine.</p> Signup and view all the answers

    What must users ensure when using removable media such as compact disks (CDs)?

    <p>Not provided in the content.</p> Signup and view all the answers

    Study Notes

    Spillage

    • Spillage occurs when classified data is inadvertently disclosed or accessed by unauthorized individuals or systems.
    • To pivot a discussion about a classified project, neither confirm nor deny its authenticity; redirect to unrelated topics.
    • Prevent spillage by labeling files and media with appropriate classification markings.
    • Unauthorized transfer of classified data to unclassified systems, such as drafting a briefing with Secret details, constitutes spillage.
    • Upon receiving a classified email attachment on an unclassified system, immediately contact your security point of contact.
    • To handle inquiries about classified information from reporters, gather website details like URLs and refer them to the public affairs office.
    • Report any suspicion of spillage to the security point of contact without delay.
    • Familiarity with classification markings and handling instructions can help prevent spillage.

    Classified Data

    • Proper care for classified data involves storing it securely in GSA-approved containers when not in use.
    • Access to classified data requires clearance, a signed non-disclosure agreement, and need-to-know status.
    • The classification level of 'Secret' indicates information that could cause serious damage to national security if disclosed.
    • Ensure proper labeling and handling of classified material, including marking all sensitive material appropriately.
    • Unauthorized disclosure of 'Confidential' information may cause damage to national security, while 'Top Secret' designated data could lead to exceptionally grave damage.
    • Telework involving classified information requires organizational permission, to mitigate risk.

    Insider Threat

    • Insider threats exploit authorized access to harm national security, arising from both intentional and unintentional actions.
    • Behaviors such as excessive inquiries about classified projects or displaying hostility toward U.S. policies should be reported as potential insider threats.
    • Indicators of an insider threat can include aggressive behavior on obtaining classified information or notable lifestyle changes.
    • Reportable activities encompass unauthorized removal of sensitive information and using prohibited electronic devices in secure areas.

    Social Networking

    • Post vacation details only after returning home to safeguard personal security.
    • Avoid revealing personal information, like your mother's maiden name or personal email, on social media, as it poses a security risk.
    • Vigilance about privacy settings is crucial while using social networking sites; utilize available features to limit exposure.
    • Research the credibility of incendiary articles shared on social media before engaging further.
    • Adversaries may exploit social platforms to disseminate misinformation, emphasizing the importance of cautious online behavior.
    • Ensure that no identifiable landmarks are visible in work-related photos shared online to protect organizational security.

    Controlled Unclassified Information (CUI)

    • Not all information is classified; Controlled Unclassified Information (CUI) should be handled with care but lacks strict classification protocols.
    • Proper transmission of CUI requires correct labeling and marking within correspondence.
    • Locking away CUI in a desk drawer after hours is a recommended best practice for its protection.

    Physical Security

    • Validating the identity of individuals in secure areas is a pivotal aspect of physical security; always challenge unknown personnel without proper identification.
    • Cyberspace Protection Condition (CPCON) 1 focuses solely on preserving critical functions and operations.

    Identity Management

    • Utilizing two-factor authentication enhances security by combining something you have with something you know, such as a CAC with a PIN.
    • Maintain possession of your Common Access Card (CAC) at all times to avoid identity theft.
    • A strong password, such as 'eA1xy2!P', enhances protection against unauthorized access.

    Sensitive Compartmented Information (SCI)

    • Sensitive Compartmented Information (SCI) requires strict control measures, including distinct compartmentalization and cybersecurity directives.
    • All documents in a Sensitive Compartmented Information Facility (SCIF) must be appropriately marked regardless of their classification.
    • Security badges should always be visible in secure areas, ensuring compliance and enhancing physical security measures.

    Removable Media in a SCIF

    • Removable media used in SCIFs must display proper labeling regarding classification, creation date, and point of contact to ensure compliance and security.

    Malicious Code

    • Examples of malicious code include viruses, Trojans, and worms, which can compromise systems.
    • Accepting unfamiliar pop-ups or applications, particularly from unsecured sites, poses significant risk and should be avoided.

    Website Use

    • For security, refrain from entering credit card information on websites that do not utilize the 'https' protocol.
    • If identity theft occurs, promptly report the incident to law enforcement to initiate recovery actions.

    Social Engineering

    • Best practices to prevent malicious code downloads include being cautious with email attachments and hyperlinks to enhance cybersecurity.### Social Engineering Concepts
    • Phishing attacks often involve emails containing hyperlinks designed to lure victims.
    • Protection against social engineering includes following instructions solely from verified personnel.
    • Whaling is a sophisticated phishing technique that targets high-ranking officials or senior personnel.
    • When receiving a friend's email with a compressed URL, it is important to investigate the link's actual destination using a preview feature before clicking.
    • To guard against internet hoaxes, utilize online resources to verify or challenge suspicious claims.
    • Compressed URLs can pose security risks as they may disguise malicious intent.

    Travel and Mobile Device Security

    • Always maintain physical possession of mobile computing devices and government-furnished equipment (GFE) when traveling.
    • A mobile phone may be compromised immediately upon exiting the aircraft during overseas travel.
    • Public Wi-Fi networks present security risks by exposing connected devices to potential malware threats.

    Government-Furnished Equipment (GFE) Usage

    • Checking personal emails on GFE is permissible only if aligned with organizational policy guidelines.
    • It's crucial to verify the authorization of any cloud-based file sharing or storage services before utilizing them on GFE.

    Studying That Suits You

    Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

    Quiz Team

    Description

    Test your knowledge on cybersecurity concepts with this set of flashcards from the Cyber Awareness Challenge 2023. Each card presents a term or scenario related to cyber awareness, focusing on the appropriate responses to sensitive information. Challenge yourself and stay informed about security best practices.

    More Like This

    Use Quizgecko on...
    Browser
    Open
    Browser
    Browser