Questions and Answers
What portable electronic devices (PEDs) are allowed in a Sensitive Compartmented Information Facility (SCIF)?
Government-owned PEDs when expressly authorized by your agency.
What action should you take when using removable media in a SCIF?
Identify and disclose it with local Configuration/Change Management Control and Property Management authorities.
What are some examples of malicious code?
Which of the following is NOT a way that malicious code spreads?
Signup and view all the answers
After visiting a website on your Government device, a popup appears asking if you want to run an application. Is this safe?
Signup and view all the answers
You should provide your credit card information if a website requires it during registration.
Signup and view all the answers
How should you respond to the theft of your identity?
Signup and view all the answers
You should only accept cookies from reputable, trusted websites.
Signup and view all the answers
Which is a best practice that can prevent viruses and other malicious code from being downloaded when checking your e-mail?
Signup and view all the answers
What is TRUE of a phishing attack?
Signup and view all the answers
Which of the following is a way to protect against social engineering?
Signup and view all the answers
What is whaling?
Signup and view all the answers
What action should you take with an email from a friend containing a compressed Uniform Resource Locator (URL)?
Signup and view all the answers
How can you protect yourself from internet hoaxes?
Signup and view all the answers
Which may be a security issue with compressed Uniform Resource Locators (URLs)?
Signup and view all the answers
What is a best practice while traveling with mobile computing devices?
Signup and view all the answers
It may be compromised as soon as you exit the plane when traveling overseas with a mobile phone.
Signup and view all the answers
What security risk does a public Wi-Fi connection pose?
Signup and view all the answers
When can you check personal email on your Government-furnished equipment (GFE)?
Signup and view all the answers
What is a critical consideration on using cloud-based file sharing and storage applications on your Government-furnished equipment (GFE)?
Signup and view all the answers
What should you do if asked about a classified security project?
Signup and view all the answers
Which of the following may help to prevent spillage?
Signup and view all the answers
What best describes an unauthorized transfer of classified data to a lower classification level?
Signup and view all the answers
What should you do upon receiving an email with a classified attachment on an unclassified system?
Signup and view all the answers
What action should you take if a reporter asks about potentially classified information on the web?
Signup and view all the answers
What should you refer a reporter to if they ask about classified information?
Signup and view all the answers
What is the correct action if you suspect spillage has occurred?
Signup and view all the answers
Which of the following is a good practice to prevent spillage?
Signup and view all the answers
What should you do after finding classified information on the Internet?
Signup and view all the answers
How can you protect classified data when it is not in use?
Signup and view all the answers
What is required for an individual to access classified data?
Signup and view all the answers
Which classification level is associated with serious damage to national security?
Signup and view all the answers
Which of the following is a good practice for protecting classified information?
Signup and view all the answers
Classified material must be appropriately marked.
Signup and view all the answers
What damage can unauthorized disclosure of Confidential information cause?
Signup and view all the answers
You must have permission from your organization to telework.
Signup and view all the answers
Which type of information could cause serious damage to national security if disclosed without authorization?
Signup and view all the answers
How should you protect a printed classified document when it is not in use?
Signup and view all the answers
What level of damage can unauthorized disclosure of Top Secret information cause?
Signup and view all the answers
How many potential insider threat indicators are displayed by a colleague who vacations yearly, is a father, has poor work quality, but works well with his team?
Signup and view all the answers
How many potential insider threat indicators does a coworker displaying persistent behavior to obtain classified information, being boisterous about debt, and complaining of anxiety demonstrate?
Signup and view all the answers
How many potential insider threat indicators are shown by a colleague who is charming, wins performance awards, but is occasionally aggressive about classified information?
Signup and view all the answers
What advantages do insiders have that allow them to cause damage more easily?
Signup and view all the answers
What type of behavior should be reported as a potential insider threat?
Signup and view all the answers
Which activity should be reported as a potential security incident?
Signup and view all the answers
Which scenario might indicate a reportable insider threat?
Signup and view all the answers
How many insider threat indicators are shown by a colleague with persistent efforts to obtain classified project information, vocal about credit card issues, and complaints of anxiety?
Signup and view all the answers
Which type of behavior should be reported as a potential insider threat?
Signup and view all the answers
Which of the following is NOT considered a potential insider threat indicator?
Signup and view all the answers
What do insiders with authorized access to information pose?
Signup and view all the answers
When is the safest time to post details of your vacation activities on social media?
Signup and view all the answers
How many potential insider threat indicators does a colleague show who abruptly becomes hostile after positive relationships and has unusual expenses?
Signup and view all the answers
What is an insider threat?
Signup and view all the answers
Which of the following is a potential insider threat indicator?
Signup and view all the answers
Which of the following is a reportable insider threat activity?
Signup and view all the answers
What should Alex do differently to avoid temptation to betray his country?
Signup and view all the answers
How many insider threat indicators does Alex demonstrate?
Signup and view all the answers
What should Alex's colleagues do if they notice suspicious behavior?
Signup and view all the answers
What function do Insider Threat Programs aim to fulfill?
Signup and view all the answers
What should you do if you receive a game application request with permission to access your friends, profile information, cookies, and sites visited?
Signup and view all the answers
Which of the following is a security risk when posted publicly on your social networking profile?
Signup and view all the answers
Which of the following is a security best practice when using social networking sites?
Signup and view all the answers
When may you face consequences due to online misconduct?
Signup and view all the answers
Which of the following is a security best practice when using social networking sites?
Signup and view all the answers
Which of the following is a security risk when posted publicly on your social networking profile?
Signup and view all the answers
What should you do if your cousin posts an incendiary article on social media?
Signup and view all the answers
What best describes the sources that contribute to your online identity?
Signup and view all the answers
What should you do if contacted by a foreign national seeking classified information?
Signup and view all the answers
Which piece of information is safest to include on your social media profile?
Signup and view all the answers
Which piece of information is safest to include on your social media profile?
Signup and view all the answers
Adversaries exploit social networking sites to disseminate fake news.
Signup and view all the answers
How can you protect your organization on social networking sites?
Signup and view all the answers
Which of the following is NOT an example of Controlled Unclassified Information (CUI)?
Signup and view all the answers
Which of the following is NOT correct regarding the protection of CUI?
Signup and view all the answers
Which describes a way to safely transmit Controlled Unclassified Information (CUI)?
Signup and view all the answers
What is a best practice for protecting CUI?
Signup and view all the answers
Which of the following is not Controlled Unclassified Information (CUI)?
Signup and view all the answers
Unclassified information doesn't require markings or distribution controls.
Signup and view all the answers
Which of the following includes Personally Identifiable Information (PII) and Protected Health Information (PHI)?
Signup and view all the answers
What is a good practice for physical security?
Signup and view all the answers
At which Cyberspace Protection Condition (CPCON) is the priority focus on critical functions only?
Signup and view all the answers
What should you do within a secure area when encountering someone without a visible badge?
Signup and view all the answers
When are you permitted to use your PKI token?
Signup and view all the answers
What is the best description of two-factor authentication?
Signup and view all the answers
Using a common password for all your system and application logons is sufficient for protecting your identity.
Signup and view all the answers
What is the best way to protect your Common Access Card (CAC)?
Signup and view all the answers
Which is NOT a best practice to preserve the authenticity of your identity?
Signup and view all the answers
Which of the following is an example of two-factor authentication?
Signup and view all the answers
Which of the following is an example of a strong password?
Signup and view all the answers
What is Sensitive Compartmented Information (SCI)?
Signup and view all the answers
What best describes the compromise of Sensitive Compartmented Information (SCI)?
Signup and view all the answers
When should documents be marked within a Sensitive Compartmented Information Facility (SCIF)?
Signup and view all the answers
What must be approved and signed by a cognizant Original Classification Authority (OCA)?
Signup and view all the answers
What must the dissemination of information regarding intelligence sources adhere to?
Signup and view all the answers
When is it appropriate to have your security badge visible?
Signup and view all the answers
What should you do with printed SCI documents promptly?
Signup and view all the answers
What should participants in a conversation involving SCI do differently?
Signup and view all the answers
What actions should you take when faxing Sensitive Compartmented Information (SCI)?
Signup and view all the answers
What must users ensure when using removable media such as compact disks (CDs)?
Signup and view all the answers
Study Notes
Spillage
- Spillage occurs when classified data is inadvertently disclosed or accessed by unauthorized individuals or systems.
- To pivot a discussion about a classified project, neither confirm nor deny its authenticity; redirect to unrelated topics.
- Prevent spillage by labeling files and media with appropriate classification markings.
- Unauthorized transfer of classified data to unclassified systems, such as drafting a briefing with Secret details, constitutes spillage.
- Upon receiving a classified email attachment on an unclassified system, immediately contact your security point of contact.
- To handle inquiries about classified information from reporters, gather website details like URLs and refer them to the public affairs office.
- Report any suspicion of spillage to the security point of contact without delay.
- Familiarity with classification markings and handling instructions can help prevent spillage.
Classified Data
- Proper care for classified data involves storing it securely in GSA-approved containers when not in use.
- Access to classified data requires clearance, a signed non-disclosure agreement, and need-to-know status.
- The classification level of 'Secret' indicates information that could cause serious damage to national security if disclosed.
- Ensure proper labeling and handling of classified material, including marking all sensitive material appropriately.
- Unauthorized disclosure of 'Confidential' information may cause damage to national security, while 'Top Secret' designated data could lead to exceptionally grave damage.
- Telework involving classified information requires organizational permission, to mitigate risk.
Insider Threat
- Insider threats exploit authorized access to harm national security, arising from both intentional and unintentional actions.
- Behaviors such as excessive inquiries about classified projects or displaying hostility toward U.S. policies should be reported as potential insider threats.
- Indicators of an insider threat can include aggressive behavior on obtaining classified information or notable lifestyle changes.
- Reportable activities encompass unauthorized removal of sensitive information and using prohibited electronic devices in secure areas.
Social Networking
- Post vacation details only after returning home to safeguard personal security.
- Avoid revealing personal information, like your mother's maiden name or personal email, on social media, as it poses a security risk.
- Vigilance about privacy settings is crucial while using social networking sites; utilize available features to limit exposure.
- Research the credibility of incendiary articles shared on social media before engaging further.
- Adversaries may exploit social platforms to disseminate misinformation, emphasizing the importance of cautious online behavior.
- Ensure that no identifiable landmarks are visible in work-related photos shared online to protect organizational security.
Controlled Unclassified Information (CUI)
- Not all information is classified; Controlled Unclassified Information (CUI) should be handled with care but lacks strict classification protocols.
- Proper transmission of CUI requires correct labeling and marking within correspondence.
- Locking away CUI in a desk drawer after hours is a recommended best practice for its protection.
Physical Security
- Validating the identity of individuals in secure areas is a pivotal aspect of physical security; always challenge unknown personnel without proper identification.
- Cyberspace Protection Condition (CPCON) 1 focuses solely on preserving critical functions and operations.
Identity Management
- Utilizing two-factor authentication enhances security by combining something you have with something you know, such as a CAC with a PIN.
- Maintain possession of your Common Access Card (CAC) at all times to avoid identity theft.
- A strong password, such as 'eA1xy2!P', enhances protection against unauthorized access.
Sensitive Compartmented Information (SCI)
- Sensitive Compartmented Information (SCI) requires strict control measures, including distinct compartmentalization and cybersecurity directives.
- All documents in a Sensitive Compartmented Information Facility (SCIF) must be appropriately marked regardless of their classification.
- Security badges should always be visible in secure areas, ensuring compliance and enhancing physical security measures.
Removable Media in a SCIF
- Removable media used in SCIFs must display proper labeling regarding classification, creation date, and point of contact to ensure compliance and security.
Malicious Code
- Examples of malicious code include viruses, Trojans, and worms, which can compromise systems.
- Accepting unfamiliar pop-ups or applications, particularly from unsecured sites, poses significant risk and should be avoided.
Website Use
- For security, refrain from entering credit card information on websites that do not utilize the 'https' protocol.
- If identity theft occurs, promptly report the incident to law enforcement to initiate recovery actions.
Social Engineering
- Best practices to prevent malicious code downloads include being cautious with email attachments and hyperlinks to enhance cybersecurity.### Social Engineering Concepts
- Phishing attacks often involve emails containing hyperlinks designed to lure victims.
- Protection against social engineering includes following instructions solely from verified personnel.
- Whaling is a sophisticated phishing technique that targets high-ranking officials or senior personnel.
- When receiving a friend's email with a compressed URL, it is important to investigate the link's actual destination using a preview feature before clicking.
- To guard against internet hoaxes, utilize online resources to verify or challenge suspicious claims.
- Compressed URLs can pose security risks as they may disguise malicious intent.
Travel and Mobile Device Security
- Always maintain physical possession of mobile computing devices and government-furnished equipment (GFE) when traveling.
- A mobile phone may be compromised immediately upon exiting the aircraft during overseas travel.
- Public Wi-Fi networks present security risks by exposing connected devices to potential malware threats.
Government-Furnished Equipment (GFE) Usage
- Checking personal emails on GFE is permissible only if aligned with organizational policy guidelines.
- It's crucial to verify the authorization of any cloud-based file sharing or storage services before utilizing them on GFE.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
Description
Test your knowledge on cybersecurity concepts with this set of flashcards from the Cyber Awareness Challenge 2023. Each card presents a term or scenario related to cyber awareness, focusing on the appropriate responses to sensitive information. Challenge yourself and stay informed about security best practices.