Cyber Awareness Challenge 2023 Flashcards

Podcast

Play an AI-generated podcast conversation about this lesson

Questions and Answers

How should you respond if your neighbor asks you to comment about a classified project?

Attempt to change the subject to something non-work related, but neither confirm nor deny the article's authenticity

Which of the following may help to prevent spillage?

Ignore classification markings.

Share unclassified information freely.

Discuss classified information openly.

Label all files with appropriate classification markings. (correct)

What is the best choice to describe unauthorized transfer of secret information to an unclassified system?

Spillage because classified data was moved to a lower classification level system without authorization.

What should you do when you receive an email with a classified attachment on an unclassified system?

Call your security point of contact immediately. Signup and view all the answers

What should you do if a reporter asks about potentially classified information on the web?

Ask for information about the website, including the URL. Signup and view all the answers

What should you do if you suspect spillage has occurred?

Immediately notify your security point of contact. Signup and view all the answers

Which of the following is a good practice to prevent spillage?

Be aware of classification markings and handling caveats. Signup and view all the answers

What should you do after finding classified information on the Internet?

Note any identifying information and the website's URL. Signup and view all the answers

You receive an inquiry from a reporter about government information not cleared for public release. How should you respond?

Refer the reporter to your organization's public affairs office. Signup and view all the answers

How can you protect classified data when it is not in use?

Store classified data appropriately in a GSA-approved vault/container. Signup and view all the answers

What is required for an individual to access classified data?

Appropriate clearance, a signed and approved non-disclosure agreement, and need-to-know. Signup and view all the answers

Which classification level is given to information that could reasonably be expected to cause serious damage to national security?

Secret Signup and view all the answers

Which of the following is a good practice to protect classified information?

Ensure proper labeling by appropriately marking all classified material. Signup and view all the answers

What level of damage can the unauthorized disclosure of information classified as Confidential reasonably be expected to cause?

Damage to national security. Signup and view all the answers

Which of the following is true about telework concerning classified data?

You must have your organization's permission to telework. Signup and view all the answers

Who designates whether information is classified and its classification level?

National Security Agency (NSA) Signup and view all the answers

Which of the following is true of Controlled Unclassified Information (CUI)?

CUI must be handled using safeguarding or dissemination controls. Signup and view all the answers

Which of the following is NOT considered a potential insider threat indicator?

Treated mental health issues. Signup and view all the answers

What function do Insider Threat Programs aim to fulfill?

Proactively identify potential threats and formulate holistic mitigation responses. Signup and view all the answers

Which scenario might indicate a reportable insider threat?

A coworker uses a personal electronic device in a secure area where their use is prohibited. Signup and view all the answers

What should you do if you receive a game application request that includes permissions to access personal information?

Decline the request. Signup and view all the answers

Which is a security best practice when using social networking sites?

Understanding and using the available privacy settings. Signup and view all the answers

When is the safest time to post details of vacation activities on your social networking profile?

After you have returned home following the vacation. Signup and view all the answers

At which Cyberspace Protection Condition (CPCON) is the priority focus on critical functions only?

CPCON 1 Signup and view all the answers

Which Cyber Protection Condition (CPCON) is the priority focus on critical and essential functions only?

CPCON 2 Signup and view all the answers

Within a secure area, what should you do if you see an individual who is not wearing a visible badge?

Ask the individual for identification Signup and view all the answers

Which of the following is a best practice for physical security?

Report suspicious activity Signup and view all the answers

Which of the following best describes good physical security? Select one.

Lionel stops an individual in his secure area who is not wearing a badge. Signup and view all the answers

In which situation are you permitted to use your PKI token?

On a NIPRNet system while using it for a PKI-required task Signup and view all the answers

What is the best description of two-factor authentication?

Something you possess, like a CAC, and something you know, like a PIN or password Signup and view all the answers

Which is NOT a sufficient way to protect your identity?

Use a common password for all your system and application logons. Signup and view all the answers

What is the best way to protect your Common Access Card (CAC)?

Maintain possession of it at all times. Signup and view all the answers

Which of the following is NOT a best practice to preserve the authenticity of your identity?

Write your password down on a device that only you access. Signup and view all the answers

Which of the following is an example of two-factor authentication?

Your password and a code you receive via text message Signup and view all the answers

Which of the following is true of using a DoD Public Key Infrastructure (PKI) token?

It should only be in a system while actively using it for a PKI-required task Signup and view all the answers

Which of the following is true of the Common Access Card (CAC)?

It contains certificates for identification, encryption, and digital signature Signup and view all the answers

Which of the following is an example of a strong password?

eA1xy2!P Signup and view all the answers

Which of the following is an example of a strong password? Select one.

%2ZN=Ugq Signup and view all the answers

Which of the following is an example of two-factor authentication? Select one.

A Common Access Card and Personal Identification Number Signup and view all the answers

What is Sensitive Compartmented Information (SCI)?

A program that segregates various types of classified information into distinct compartments for added protection and dissemination or distribution control Signup and view all the answers

Which of the following best describes the compromise of Sensitive Compartmented Information (SCI)?

A person who does not have the required clearance or access caveats comes into possession of SCI in any manner. Signup and view all the answers

A compromise of Sensitive Compartmented Information (SCI) occurs when a person who does not have the required clearance or access caveats comes into possession of SCI _____.

in any manner. Signup and view all the answers

When should documents be marked within a Sensitive Compartmented Information Facility (SCIF)?

All documents should be appropriately marked, regardless of format, sensitivity, or classification. Signup and view all the answers

Which must be approved and signed by a cognizant Original Classification Authority (OCA)?

Security Classification Guide (SCG) Signup and view all the answers

What must the dissemination of information regarding intelligence sources, methods, or activities follow?

Directives issued by the Director of National Intelligence Signup and view all the answers

When is it appropriate to have your security badge visible?

At all times when in the facility Signup and view all the answers

What should the owner of printed SCI do differently?

Retrieve classified documents promptly from printers Signup and view all the answers

What should participants in a conversation involving SCI do differently?

Physically assess that everyone within listening distance is cleared and has a need-to-know for the information being discussed. Signup and view all the answers

When faxing Sensitive Compartmented Information (SCI), what actions should you take?

Mark SCI documents appropriately and use an approved SCI fax machine Signup and view all the answers

What action should you take if you become aware that Sensitive Compartmented Information (SCI) has been compromised?

Evaluate the causes of the compromise Signup and view all the answers

Which of the following is true of transmitting Sensitive Compartmented Information (SCI)? Select one.

You must never transmit SCI via fax machine Signup and view all the answers

Which of the following is true of Sensitive Compartmented Information (SCI)? Select one.

Access requires a formal need-to-know determination issued by the Director of National Intelligence Signup and view all the answers

Which of the following is true of sharing information in a Sensitive Compartmented Information Facility (SCIF)? Select one.

Individuals must avoid referencing derivatively classified reports classified higher than the recipient. Signup and view all the answers

What must users ensure when using removable media such as compact disks (CD)?

It displays a label showing maximum classification, date of creation, point of contact, and Change Management Control Number. Signup and view all the answers

What portable electronic devices (PEDs) are allowed in a Sensitive Compartmented Information Facility (SCIF)?

Government-owned PEDs when expressly authorized by your agency Signup and view all the answers

What action should you take when using removable media in a Sensitive Compartmented Information Facility (SCIF)?

Identify and disclose it with local Configuration/Change Management Control and Property Management authorities Signup and view all the answers

Which of the following is NOT a potential consequence of using removable media unsafely in a Sensitive Compartmented Information Facility (SCIF)? Select one.

Damage to the removable media Signup and view all the answers

Study Notes

Spillage

Spillage occurs when classified data is unintentionally transferred or disclosed to a lower classification system without authorization.
Change the subject if asked about classified projects; neither confirm nor deny the information's authenticity.
To prevent spillage, label files and removable media with appropriate classification markings.
If you receive a classified attachment on an unclassified system, contact your security point of contact immediately.
Report any suspected spillage to your security point of contact right away.
Practices to prevent spillage include being aware of classification markings and handling caveats.

Classified Data

Classified data must be stored in GSA-approved vaults or containers when not in use.
Accessing classified information requires appropriate clearance, a signed non-disclosure agreement, and a need-to-know basis.
The classification level "Secret" indicates information could cause serious damage to national security if disclosed.
Classified materials must be properly labeled and marked for protection.
Unauthorized disclosure of "Confidential" information could cause damage to national security, while "Top Secret" may cause exceptionally grave damage.

Insider Threat

Insider threats leverage their trust and authorized access to sensitive information for malicious purposes.
Potential indicators of insider threats include unusual interest in classified information, hostility towards U.S. policies, or obtaining classified information unauthorizedly.
Behaviors such as persistent questioning about classified projects and removed sensitive information without permission are red flags.
Insider Threat Programs aim to identify potential threats and develop comprehensive responses.

Post vacation details only after returning home to avoid unwanted attention.
Be cautious about granting permissions to game applications that access personal information.
Security risks include exposing personal details like your birthday or mother's maiden name publicly.
Best practices involve understanding privacy settings and validating friend requests.

Controlled Unclassified Information (CUI)

CUI must be handled with safeguarding and dissemination controls to protect sensitive information.
CUI is not considered classified, and storing it requires adhering to organizational protocols.
Unauthorized storage of CUI on unapproved systems is against best practices.
Protect Personally Identifiable Information (PII) by using government-approved equipment.

Physical Security

Physically challenge individuals without appropriate badges within secure areas to maintain security integrity.
Report suspicious activities to ensure rapid response to potential threats.
Understand Cyberspace Protection Conditions (CPCON), which prioritize critical functions during heightened alert levels.

Identity Management

Use two-factor authentication, which combines possession (e.g., a CAC) and knowledge (e.g., PIN) for robust security.
Avoid common passwords across various accounts to diminish the risk of identity theft.### Identity Management
Common Access Card (CAC) should be maintained at all times for protection.
Writing down passwords on easily accessible devices, like smartphones, is not a best practice for maintaining identity authenticity.
Two-factor authentication includes combining a password with a received code, enhancing security measures.
DoD Public Key Infrastructure (PKI) tokens should only be used within systems for specific PKI-required tasks.
The CAC includes certificates for identification, encryption, and digital signature, playing a crucial role in identity management.
A strong password example is eA1xy2!P, showcasing complexity and security.
Among various password examples, %2ZN=Ugq is the strongest due to its mix of characters and symbols.
A valid example of two-factor authentication is a Common Access Card (CAC) and Personal Identification Number (PIN), providing an added layer of security.

Sensitive Compartmented Information (SCI)

Sensitive Compartmented Information (SCI) segregates classified information into compartments for better protection and distribution control.
A compromise occurs when unauthorized individuals gain access to SCI in any manner, breaching security protocols.
All documents in a Sensitive Compartmented Information Facility (SCIF) must be appropriately marked, except for unclassified documents.
Security Classification Guides (SCG) must be approved and signed by a recognized Original Classification Authority (OCA).
The dissemination of intelligence sources and methods must adhere to directives from the Director of National Intelligence.
Security badges must be visible at all times within SCIF facilities for identification purposes.
Printed classified documents should be retrieved promptly to prevent unauthorized access.
When discussing SCI, ensure all participants are cleared and have a need-to-know.
Faxing SCI requires proper marking and the use of an approved SCI fax machine to maintain security integrity.
If SCI is compromised, take actions such as evaluating the breach causes and reporting to security contacts.

Removable Media in a SCIF

Users of removable media like CDs must ensure they are labeled with maximum classification, creation date, point of contact, and Change Management Control Number.
Only government-owned Portable Electronic Devices (PEDs) expressly authorized by an agency are permitted in SCIFs.
When using removable media inside SCIFs, it must be identified and disclosed to local authorities for Configuration/Change Management Control.
Potential consequences of unsafe usage of removable media in SCIFs include loss of mission, loss of life, and compromise of sensitive information, while damage to the media itself is not a serious consequence.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

Test your knowledge of cybersecurity concepts with the Cyber Awareness Challenge 2023 flashcards. Each card presents a unique term or scenario that reflects important security principles and responses. Perfect for military personnel and anyone interested in cybersecurity awareness.