Cyber Awareness Knowledge Check 2024

Questions and Answers

What action should you take first upon receiving an email from OPM requesting personal information?

Delete the email.

Enter your personal information immediately.

Look for a digital signature on the email. (correct)

Call OPM for verification.

How should you respond to a call from someone at the help desk who needs assistance?

Ask the caller, 'What's your full name and phone number?'

Which of the following is a way to protect against social engineering?

Ignore suspicious requests.

Trust anyone who calls you.

Give out personal information freely.

Follow instructions given only by verified personnel. (correct)

What should you do if a man you do not know asks to use your Government-issued phone?

Decline to lend the man your phone. Signup and view all the answers

What action is appropriate after finding classified information on the internet?

Note any identifying information and the website's Resource Locator (URL). Signup and view all the answers

How should you respond to a reporter's inquiry about potentially classified information on the Internet?

Refer the reporter to your organization's public affairs office. Signup and view all the answers

Which of the following best describes the sources that contribute to your online identity?

Data about you collected from all sites, apps, and devices that you use can be aggregated to form a profile of you. Signup and view all the answers

Which of the following information is a security risk when posted publicly on your social networking profile?

Your political affiliation. Signup and view all the answers

What is a best practice for physical security?

Use your own facility access badge or key code. Signup and view all the answers

In which situation are you permitted to use your PKI token?

On a NIPRNet system while using it for a PKI-required task. Signup and view all the answers

What actions should you take when faxing Sensitive Compartmented Information (SCI)?

Mark SCI documents appropriately and use an approved SCI fax machine. Signup and view all the answers

How many potential insider threat indicators does a person who is married with two children, vacations at the beach every year, is pleasant to work with, but sometimes has poor work quality display?

0 indicators Signup and view all the answers

What is the best response if you find classified government data on the internet?

Note any identifying information, such as the website's URL, and report the situation to your security POC. Signup and view all the answers

After reading an online story about a new security project being developed on the military installation where you work, your neighbor asks you to comment about the article. You know this project is classified. What should be your response?

Attempt to change the subject to something non-work related, but neither confirm nor deny the article's authenticity. Signup and view all the answers

What is a proper response if spillage occurs?

Immediately notify your security POC. Signup and view all the answers

What should you do if a reporter asks you about potentially classified information on the web?

Ask for information about the website, including the URL. Signup and view all the answers

A user writes down details from a report stored on a classified system marked as Secret and uses those details to draft an unclassified briefing on an unclassified system without authorization. What is the best choice to describe what has occurred?

Spillage because classified data was moved to a lower classification level system without authorization. Signup and view all the answers

How many potential insider threat indicators does a coworker who often makes others uneasy by being persistent in trying to obtain information about classified projects to which he has no access, is boisterous about his wife putting them in credit card debt, and often complains about anxiety and exhaustion display?

3 or more indicators Signup and view all the answers

Which of the following can an unauthorized disclosure of information classified as Confidential reasonably be expected to cause?

Damage to national security Signup and view all the answers

Which classification level is given to information that could reasonably be expected to cause serious damage to national security?

Secret Signup and view all the answers

When classified data is not in use, how can you protect it?

Store classified data appropriately in a GSA-approved vault/container when not in use. Signup and view all the answers

Which is a good practice to protect classified information?

Ensure proper labeling by appropriately marking all classified material. Signup and view all the answers

Which of the following is a good practice to aid in preventing spillage?

Be aware of classification markings and all handling caveats. Signup and view all the answers

What is required for an individual to access classified data?

Appropriate clearance; signed and approved non-disclosure agreement; and need-to-know. Signup and view all the answers

What type of activity or behavior should be reported as a potential insider threat?

Coworker making consistent statements indicative of hostility or anger toward the United States and its policies. Signup and view all the answers

Which of the following practices reduces the chance of becoming a target by adversaries seeking insider information?

Communicate only in specifically designated public meeting environments. Signup and view all the answers

Which scenario might indicate a reportable insider threat security incident?

A coworker is observed using a personal electronic device in an area where their use is prohibited. Signup and view all the answers

Why might 'insiders' be able to cause damage to their organizations more easily than others?

Insiders are given a level of trust and have authorized access to Government information systems. Signup and view all the answers

Which of the following is a best practice to protect information about you and your organization on social networking sites and applications?

Use only personal contact information when establishing personal social networking accounts, never use Government contact information. Signup and view all the answers

What should you do if an individual asks you to let her follow you into your controlled space, stating that she left her security badge at her desk?

Don't allow her access into secure areas and report suspicious activity. Signup and view all the answers

Which represents a security best practice when using social networking?

Understanding and using available privacy settings. Signup and view all the answers

Which is NOT sufficient to protect your identity?

Using a common password for all system and application logons. Signup and view all the answers

Under which circumstances may you be subject to criminal, disciplinary, and/or administrative action due to online misconduct?

Any time you participate in or condone misconduct, whether offline or online. Signup and view all the answers

As someone who works with classified information, what should you do if you are contacted by a foreign national seeking information on a research project?

Inform your security POC of all non-professional or non-routine contacts with foreign nations. Signup and view all the answers

Which of the following is true about unclassified data?

When unclassified data is aggregated, its classification level may rise. Signup and view all the answers

What are some potential insider threat indicators?

Difficult life circumstances such as substance abuse; divided loyalty or allegiance to the U.S.; or extreme, persistent interpersonal difficulties. Signup and view all the answers

What information posted publicly on your personal social networking profile represents a security risk?

Your place of birth Signup and view all the answers

What is an individual's Personally Identifiable Information (PII) or Protected Health Information (PHI) considered?

Sensitive information. Signup and view all the answers

Under what circumstances could unclassified information be considered a threat to national security?

If aggregated, the information could become classified. Signup and view all the answers

What type of unclassified material should always be marked with a special handling caveat?

For Official Use Only (FOUO) Signup and view all the answers

Which is true for protecting classified data?

Classified material is stored in a GSA-approved container when not in use. Signup and view all the answers

How many potential insider threat indicators does a person who is playful and charming, consistently wins performance awards, but is occasionally aggressive in trying to access sensitive information display?

1 Indicator Signup and view all the answers

Which of the following terms refers to harm inflicted on national security through authorized access to information or information systems?

Insider Threat Signup and view all the answers

What is the best example of Personally Identifiable Information (PII)?

Date and place of birth Signup and view all the answers

What is the best example of Protected Health Information (PHI)?

Your health insurance explanation of benefits (EOB) Signup and view all the answers

When is the best time to post details of your vacation activities on your social networking website?

When your vacation is over, and you have returned home. Signup and view all the answers

What does Personally Identifiable Information (PII) include?

Social Security Number; date and place of birth; mother's maiden name. Signup and view all the answers

What must you ensure if your work involves the use of different types of smart card security tokens?

Avoid a potential security violation by using the appropriate token for each system. Signup and view all the answers

What must you ensure before transmitting Personally Identifiable Information (PII) or Protected Health Information (PHI) via e-mail?

Transmissions must be between Government e-mail accounts and must be encrypted and digitally signed when possible. Signup and view all the answers

What must you do when e-mailing Personally Identifiable Information (PII) or Protected Health Information (PHI)?

Encrypt the e-mail and use your Government e-mail account. Signup and view all the answers

What is a good practice for physical security?

Challenge people without proper badges. Signup and view all the answers

Is it acceptable to take a short break while a coworker monitors your computer while logged on with your CAC?

False Signup and view all the answers

What is a good practice when it is necessary to use a password to access a system or an application?

Avoid using the same password between systems or applications. Signup and view all the answers

What is the best description of two-factor authentication?

Something you possess, like a CAC, and something you know, like a PIN or password. Signup and view all the answers

What certificates are contained on the DoD Public Key Infrastructure (PKI) implemented by the Common Access Card (CAC)/Personal Identity Verification (PIV) card?

Identification, encryption, and digital signature. Signup and view all the answers

What are the requirements to be granted access to SCI material?

The proper security clearance and indoctrination into the SCI program. Signup and view all the answers

What is a protection against internet hoaxes?

Use online sites to confirm or expose potential hoaxes. Signup and view all the answers

What organization issues the directives concerning the dissemination of information regarding intelligence sources, methods, or activities?

Department of Defense. Signup and view all the answers

Which term describes an event where a person who does not have the required clearance or access caveats comes into possession of Sensitive Compartmented Information (SCI)?

Compromise Signup and view all the answers

What describes a Sensitive Compartmented Information (SCI) program?

A program that segregates various types of classified information into distinct compartments for added protection and dissemination for distribution control. Signup and view all the answers

What describes how Sensitive Compartmented Information is marked?

Approved Security Classification Guide (SCG) Signup and view all the answers

What must users do when using removable media within a Sensitive Compartmented Information Facility (SCIF)?

Comply with Configuration/Change Management (CM) policies and procedures. Signup and view all the answers

Which is a risk associated with removable media?

Spillage of classified information. Signup and view all the answers

What is an indication that malicious code is running on your system?

File corruption Signup and view all the answers

What are some actions you can take to try to protect your identity?

Shred personal documents; never share passwords; and order a credit report annually. Signup and view all the answers

Which of the following is an appropriate use of Government e-mail?

Digitally signing e-mails that contain attachments or hyperlinks. Signup and view all the answers

What can malicious code do?

It can cause damage by corrupting files, erasing your hard drive, and/or allowing hackers access. Signup and view all the answers

Which is true of cookies?

A cookie is a text file a web server stores on your hard drive that may track your activities on the web. Signup and view all the answers

What is a common method used in social engineering?

Telephone surveys Signup and view all the answers

Which may be a security issue with compressed URLs?

There is no way to know where the link actually leads. Signup and view all the answers

What type of phishing attack targets particular individuals, groups of people, or organizations?

Spear phishing Signup and view all the answers

While on vacation, a coworker calls and asks you to access a site to review and approve a document that is hosted behind a DoD Public Key Infrastructure (PKI) protected webpage. You do not have your government-issued laptop. What action should you take?

Wait until you have access to your government-issued laptop. Signup and view all the answers

Under what circumstances is it acceptable to use your Government-furnished computer to check personal e-mail and do other non-work-related activities?

If allowed by organization policy. Signup and view all the answers

Which are examples of portable electronic devices (PEDs)?

All of the above Signup and view all the answers

What are some examples of removable media?

All of the above Signup and view all the answers

What is a valid response when identity theft occurs?

Report the crime to local law enforcement. Signup and view all the answers

What is a common indicator of a phishing attempt?

It includes a threat of dire circumstances. Signup and view all the answers

What is whaling?

A type of phishing targeted at high-level personnel such as senior officials. Signup and view all the answers

Upon connecting your Government-issued laptop to a public wireless connection, what should you immediately do?

Connect to the Government Virtual Private Network (VPN). Signup and view all the answers

Which of the following activities is an ethical use of Government-furnished equipment (GFE)?

Completing your expense report for your government travel. Signup and view all the answers

Which is a wireless technology that enables your electronic devices to establish communications and exchange information when placed next to each other called?

Near field communication (NFC) Signup and view all the answers

Which of the following helps protect data on your personal mobile devices?

Secure personal mobile devices to the same level as Government-issued systems. Signup and view all the answers

What is a possible indication of a malicious code attack in progress?

A pop-up window that flashes and warns that your computer is infected with a virus. Signup and view all the answers

What should you do if a commercial entity, such as a hotel reception desk, asks for Government identification so that they can make a photocopy?

Do not allow your Common Access Card (CAC) to be photocopied. Signup and view all the answers

When is conducting a private money-making venture using your Government-furnished computer permitted?

It is never permitted. Signup and view all the answers

What is a good practice to protect data on your home wireless systems?

Ensure that the wireless security features are properly configured. Signup and view all the answers

Which must be approved and signed by a cognizant Original Classification Authority (OCA)?

Security Classification Guide (SCG) Signup and view all the answers

What portable electronic devices (PEDs) are allowed in a Secure Compartmented Information Facility (SCIF)?

Government-owned PEDs, if expressly authorized by your agency. Signup and view all the answers

What is a way to prevent the download of viruses and other malicious code when checking your e-mail?

View e-mail in plain text and don't view e-mail in Preview Pane. Signup and view all the answers

What is a best practice to protect data on your mobile computing device?

Lock your device screen when not in use and require a password to reactivate. Signup and view all the answers

Which of the following is NOT an example of sensitive information?

Press release data Signup and view all the answers

Under what circumstances is it permitted to share an unclassified draft document with a non-DoD professional discussion group?

As long as the document is cleared for public release, you may share it outside of DoD. Signup and view all the answers

Which of the following is true of protecting classified data?

True Signup and view all the answers

What advantages do 'insider threats' have over others that allow them to cause damage to their organizations more easily?

Insiders are given a level of trust and have authorized access to Government information systems. Signup and view all the answers

Which of the following should be reported as a potential security threat?

A coworker removes sensitive information without authorization. Signup and view all the answers

Which of the following does Cyberspace Protection Conditions (CPCON) establish during significant cyberspace events?

Protection priorities. Signup and view all the answers

What is the best way to protect your Common Access Card (CAC)?

Maintain possession of it at all times. Signup and view all the answers

When should documents be marked within a Sensitive Compartmented Information Facility (SCIF)?

False Signup and view all the answers

Which of the following is a best practice for handling cookies?

If possible, set your browser preferences to prompt you each time a website wants to store a cookie. Signup and view all the answers

Study Notes

Insider Threats

Individuals in difficult life circumstances, such as substance abuse or divided loyalty, can display potential insider threat indicators.
A coworker exhibiting persistent attempts to access classified information, financial difficulties, and signs of stress typically displays multiple threat indicators.

Handling Classified Information

If classified information is found online, note the website’s URL and report to security personnel.
Classified data must be stored securely when not in use, preferably in GSA-approved containers.

Responses to Information Requests

If asked about classified projects, do not confirm or deny the information; change the subject to something non-work-related.
When approached by a reporter about classified information, refer them to your organization’s public affairs office.

Security Protocols

Immediately notify the security point of contact (POC) if spillage of classified information occurs.
Maintain possession and secure storage of the Common Access Card (CAC) at all times.

Classification Levels

Information that may cause serious damage to national security is classified as "Secret."
Unauthorized disclosure of "Confidential" information could still damage national security.

Email and Digital Security

When emailing Personally Identifiable Information (PII) or Protected Health Information (PHI), use encryption and government email accounts.
Be cautious of phishing attempts that threaten dire consequences; legitimate emails should have digital signatures.

Physical and Cybersecurity Best Practices

Always challenge individuals without proper identification in secure areas.
Use privacy settings on social networking sites and avoid sharing sensitive personal information.

Handling Removable Media

Removable media pose risks such as spillage and should comply with strict regulations when used in sensitive environments.
Report any unauthorized access or attempts to remove sensitive information by coworkers.

Post vacation details only after returning home to avoid compromising security.
Be aware that cookies can track online activity; adjust browser settings to maintain control over cookies.

Security Breaches and Misconduct

Notify authorities if identity theft occurs and report any suspected misconduct or security threats observed.
Recognize that engaging with foreign individuals seeking sensitive information requires reporting to security personnel.

Additional Security Measures

Enforce the usage of unique passwords for different systems to avoid security breaches.
Always encrypt sensitive emails and use secure methods to share documents, especially outside the Department of Defense (DoD).

Conclusion

Adhering to established protocols and being vigilant about information security can significantly reduce risks associated with insider threats and cybersecurity incidents.
Continuous education on best practices in cybersecurity helps protect personal and classified information alike.

Studying That Suits You

Use AI to generate personalized quizzes and flashcards to suit your learning preferences.

Description

Test your understanding of insider threat indicators and the appropriate actions when encountering classified data online. This quiz features flashcards designed to enhance your cyber awareness skills. Perfect for anyone needing to refresh their knowledge in cybersecurity.