Quiz
SFPC 4
Fragen in diesem Quiz (200)
1ISCM strategy at this level is focused on ensuring that all system-level security controls are implemented correctly, operate as intended, produce the desired outcome with respect to meeting the security requirements for the system, and continue to be effective over time.
- ATier 1
- BTier 2
- CTier 3
2Which of the following are security-focused configuration management (SecCM) roles in risk management?
- AEnsuring that adjustments to the system configuration do not adversely affect the security of the information system
- BEstablishing configuration baselines and tracking, controlling, and managing aspects of business development
- CEnsuring that adjustments to the system configuration do not adversely affect the organizations operations
- DEstablishing a firm schedule for security patch updates every six months
3This security Configuration Management (CM) control includes physical and logical access controls and prevents the installation of software and firmware unless verified with an approved certificate.
- AConfiguration Change Control
- BAccess Restrictions for Change
- CConfiguration Settings
- DLeast Functionality
- ESoftware Usage Restrictions
- FUser-Installed Software
4This security Configuration Management (CM) control ensures that software use complies with contract agreements and copyright laws, tracks usage, and is not used for unauthorized distribution, display, performance, or reproduction.
- AConfiguration Change Control
- BAccess Restrictions for Change
- CConfiguration Settings
- DLeast Functionality
- ESoftware Usage Restrictions
- FUser-Installed Software
5This security Configuration Management (CM) control involves the systematic proposal, justification, implementation, testing, review, and disposition of changes to the systems, including system upgrades and modifications.
- AConfiguration Change Control
- BAccess Restrictions for Change
- CConfigurations Settings
- DLeast Functionality
- ESoftware Usage Restrictions
- FUser-Installed Software
6This security Configuration Management (CM) control applies to the parameters that can be changed in hardware, software, or firmware components that affect the security posture and/or funtionality of the system, including registry settings, account/directory permission setting, and settings for functions, ports and protocols.
- AConfiguration Change Control
- BAccess Restrictions for Change
- CConfiguration Settings
- DLeast Functionality
- ESoftware Usage Restrictions
- FUser-Installed Software
7Which of the following describes the role of the National Industrial Security Program (NISP) in continuous monitoring?
- AThe NISP ensures that requirements for continuous monitoring are undertaken by the government before any classified work may begin
- BThe NISP ensures the partnership between the federal government and private industry places the burden of risk on the subcontractors.
- CThe NISP ensures that restrictions on continuous monitoring activities are in place before any classified work may begin.
- DThe NISP ensures that monitoring requirements, restrictions, and safeguards that industry must follow are in place before any classified work may begin.
8Which of the following describes the relationship between configuration management controls and continuous monitoring?
- AThe configuration management process ensures that patches are applied on systems once a year as a continuous monitoring activity.
- BImplementing information system changes almost always results in some adjustment to the system configuration that requires continuous monitoring of security controls.
- CThe configuration management process ensures that a schedule for continuous monitoring is in place for anticipated future interconnected systems.
9Which of the following is a role of risk management in continuous monitoring?
- ARisk management in continuous monitoring ensures that information security solutions are broad-based, consensus-driven, and address the ongoing needs of and risks to the government and industry.
- BCybersecurity requirements are managed through the risk management framework while continuous monitoring activities address password changes and Help Desk tasks.
- CRisk management facilitates an organization-wide vision for security but does not impact continuous monitoring daily and weekly activities.
10Select ALL the correct responses. Which of the following describe continuous monitoring capabilities for detecting threats and mitigating vulnerabilities?
- AConducting frequent audits
- BNot relying on firewalls to protect against all attacks
- CDisseminating a fillable form to information system owners to log suspicious activity
- DReporting intrusion attempts
11Which of the following describes how the Information System Continuous Monitoring (ISCM) strategy supports the Tier 2 MISSION/BUSINESS PROCESSES approach to risk management?
- ATier 2 ISCM strategies focus on ensuring that all system-level security controls
are implemented correctly, operate as intended, produce the desired outcome with respect to meeting the security requirements for the system, and continue to be effective over time. - BTier 2 ISCM strategies focus on the controls that address the establishment and management of the organization’s information security program, including establishing the minimum frequency with which each security control or metric is to be assessed or monitored.
- CTier 2 ISCM strategies focus on high-level information security governance policy as it relates to risk to the organization as a whole, to its core missions, and to its business functions.
- ATier 2 ISCM strategies focus on ensuring that all system-level security controls
12Which of the following is an example of how counterintelligence and cybersecurity personnel support continuous monitoring?
- ACounterintelligence and cybersecurity personnel test automated tools and make recommendations to industry and DoD organizations.
- BThrough aggregation and analysis of Suspicious Network Activity via cyber intrusion, viruses, malware, backdoor attacks, acquisition of user names and passwords, and similar targeting, the DSS CI Directorate produces and disseminates reports on trends in cyberattacks and espionage.
13Which of the following describes how audit logs support continuous monitoring?
- ASecurity auditing is a fundamental activity in continuous monitoring in order to schedule automatic security maintenance.
- BSecurity auditing is a fundamental activity in continuous monitoring in order to ensure access restriction controls are in place on an information system.
- CSecurity auditing is a fundamental activity in continuous monitoring in order to determine what activities occurred and which user or process was responsible for them on an information system.
14Which of the following identifies how the Risk Management Framework (RMF) supports risk management?
- AThe RMF process provides a flexible approach with decision-making at Tier 3.
- BThe RMF process ensures that business process decisions can override user information system concerns.
- CThe RMF process emphasizes continuous monitoring and timely correction of deficiencies.
15Select ALL the correct responses. Which of the following are key information provided in a security audit trail analysis?
- ABudgeting and cost controls not operating as intended
- BUnsuccessful accesses to security-relevant objects and directories
- CSuccessful and unsuccessful logons/logoffs
- DDenial of access for excessive logon attempts
16Which of the following fundamental concepts does continuous monitoring support that means DoD information technology is managed to minimize shared risk by ensuring the security posture of one system is not undermined by vulnerabilities of interconnected systems?
- AKeep up-to-date inventories
- BInteroperability and operational reciprocity
- CForce users to use encryption
17Which of the following ensures that a process is in place for authorized users to report all cybersecurity-related events and potential threats and vulnerabilities and initiates protective or corrective measures when a cybersecurity incident or vulnerability is discovered?
- AProgram Manager/System Manager
- BInformation System Owner
- CInformation System Security Officer
- DUser Representative
18Which of the following are the initial steps for finding the Security Event Log on a computer running Windows 7?
- ASelect Control Panel from the Windows Start menu and then select the Security Event Log
- BSelect Control Panel from the Windows Start menu and then select Windows Log
- CSelect Control Panel from the Windows Start menu and then select the Administrative Tools link
- DSelect Control Panel from the Windows Start menu and then select the System and Security link
19During which of the following Risk Management Framework steps does continuous monitoring take place?
- AStep 1, categorize the system
- BStep 4, assess the controls
- CStep 5, authorize the information system
- DStep 6, monitor the security controls
20Which of the following describes the role of counterintelligence and cybersecurity in identifying threats to DoD information systems?
- ACounterintelligence and cybersecurity personnel ensure the contractor’s Information System Security Manager checks for unusual activity on a classified system at least once during the contract period of performance.
- BCounterintelligence and cybersecurity personnel share and report unauthorized accesses attempts, denial of service attacks, exfiltrated data, and other threats/vulnerabilities.
- CCounterintelligence and cybersecurity personnel ensure the contractor’s Information System Security Officer checks for unusual activity on a classified system at least once during the contract period of performance.
21Given the information system continuous monitoring (ISCM) process, in which step is security-related information required for metrics, assessments, and reporting collected and, where possible, the collection, analysis, and reporting of data is automated?
- AStep 1: Define an ISCM strategy
- BStep 2: Establish an ISCM program
- CStep 3: Implement an ISCM program
- DStep 4: Analyze data and report findings
- EStep 5: Respond to findings
- FStep 6: Review and update the monitoring program
22Which of the following configuration management controls supporting continuous monitoring activities focuses on configuring the IS to provide only essential capabilities to limit risk and to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling?
- ABaseline Configuration
- BLeast Functionality
- CSoftware Usage Restrictions
- DInformation System Component Inventory
23Select ALL the correct responses. Which of the following are requirements for audits as outlined in the National Industrial Security Program Operating Manual (NISPOM)?
- AAudit trail contents must be protected against unauthorized access, modification, or deletion.
- BAudit trail analysis and reporting of security events must be performed annually.
- CAudit trail contents should be made accessible to the information system user upon written request.
- DAudit trail analysis and reporting of security events must be performed at least weekly.
24Which of the following describes the how the patch management process integrates with security-focused configuration management (SecCM)?
- AThe patch management process integrates with SecCM once a year when system maintenance is performed.
- BThe patch management process integrates with SecCM on a regular basis when restrictions must be lifted so that all system users can download software updates.
- CThe patch management process integrates with SecCM when performing a Security Impact Analysis to determine whether unanticipated effects from a patch resulted in a change to existing security controls.
25The patch management process integrates with SecCM when performing a Security Impact Analysis to determine whether unanticipated effects from a patch resulted in a change to existing security controls.
- APhase 1: Planning
- BPhase 2: Identifying and Implementing Configurations
- CPhase 3: Controlling Configuration Changes
- DPhase 4: Monitoring
26Select ALL the correct responses. Which of the following are sources of information system change that security-focused configuration management (SecCM) addresses to mitigate risk?
- ANew, enhanced, corrected, or updated hardware and software capabilities
- BChanging business functions
- CHelp Desk tickets
- DPatches for correcting software flaws and other errors to existing components
- ENew security threats
27Which of the following requires that individual’s actions on an information system be auditable?
- ANational Industrial Security Program Operating Manual (NISPOM), Chapter 1.
- BNational Industrial Security Program Operating Manual (NISPOM), Chapter 3.
- CNational Industrial Security Program Operating Manual (NISPOM), Chapter 5.
- DNational Industrial Security Program Operating Manual (NISPOM), Chapter 8.
28At what tier of the Risk Management Framework does continuous monitoring take place?
- ATier 1 - the Organization level
- BTier 2 - the Mission/Business Process level
- CTier 3 - the Information System level
29Select ALL the correct responses. Which of the following describe how audit logs support continuous monitoring?
- AAudit logs are essential in continuous monitoring because they record system activity, application processes, and user activity.
- BAudit logs are essential in continuous monitoring because they will automatically defragment an information system to increase its speed and response time to user input.
- CAudit logs are essential in continuous monitoring because they can be used to detect security violations, performance problems, and flaws in applications.
30Which of the following configuration management controls supporting continuous monitoring activities focuses on physical and logical access controls, workflow automation, media libraries, abstract layers, and change windows and supports auditing of the enforcement actions?
- ALeast Functionality
- BUser-Installed Software
- CBaseline Configuration
- DAccess Restrictions for Change
31Which of the following describes how the Information System Continuous Monitoring (ISCM) strategy supports the Tier 1 ORGANIZATION approach to risk management?
- ATier 1 ISCM strategies focus on assessing and monitoring hybrid and common controls implemented at the system level.
- BTier 1 ISCM strategies focus on how the organization plans to assess, respond to, and monitor risk as well as the oversight required to ensure that the risk management strategy is effective.
- CTier 1 ISCM strategies focus on how ensuring that all system-level security controls (technical, operational, and management controls) are implemented correctly and operate as intended.
32Select ALL the correct responses. Which of the following are requirements for audits as outlined in the National Industrial Security Program Operating Manual (NISPOM)?
- AAudit trail contents must be protected against unauthorized access, modification, or deletion.
- BAudit trail contents should be made accessible to the information system user upon written request.
- CAudit records must address individual accountability with unique identification and periodic testing of the security posture by the ISSO or ISSM.
33Which of the following identifies how the Risk Management Framework (RMF) supports risk management?
- AThe RMF process provides a flexible approach to decision-making at Tier 3.
- BThe RMF process ensures traceability and transparency across all levels of the organization.
- CThe RMF process ensures that business process decisions can override user information system concerns.
34Which of the following is a risk management role in continuous monitoring (CM)?
- ADetermining whether a contractor should be allowed to monitor and assess their classified network activity.
- BDetermining whether a contractor audit trail is a necessary indicator cyber defense
- CAddressing risks from an information system and platform information technology system perspective to ensure a process for analyzing threats and vulnerabilities is in place, defining the impact, and identifying countermeasures.
35Which of the following Event Viewer Logs provides an audit of a user’s log-on events and are classified as successful or failed attempts?
- ASecurity event log
- BSetup event log
- CSystem event log
- DForwarded event log
36Which of the following describes the how the patch management process integrates with security-focused configuration management (SecCM)?
- AThe patch management process integrates with SecCM on a regular basis when restrictions must be lifted so that all system users can download software updates.
- BThe patch management process integrates with SecCM once a year when system maintenance is performed.
- CThe patch management process integrates with SecCM when updating the baseline configuration to the current patch level and then testing and approving patches as part of the configuration change control process.
37Which of the following describes the relationship between configuration management controls and continuous monitoring?
- AA well-defined configuration management process that integrates continuous monitoring ensures a firm schedule for security patch updates once a year.
- BA well-defined configuration management process that integrates continuous monitoring ensures the system baseline will not change.
- CA well-defined configuration management process that integrates continuous monitoring ensures that the required adjustments to the system configuration do not adversely affect the security of the information system.
38Which of the following describes continuous monitoring capabilities for detecting threats and mitigating vulnerabilities?
- AInvestigation of the reasoning behind access restrictions at all levels of the organization.
- BInvestigation into events of unauthorized downloads or uploads of sensitive data; unexplained storage of encrypted data; and unauthorized use of removable media or other transfer devices.
- CInvestigation into physical security breaches at the facility.
39Which of the following describes continuous monitoring supports interoperability, operational resilience, and operational reciprocity?
- AContinuous monitoring capabilities can detect transmission of information to foreign IP addresses but cannot determine whether classification markings have been removed.
- BContinuous monitoring capabilities enable security professionals to make quick adjustments to access restriction controls.
- CContinuous monitoring capabilities and tools ensure cybersecurity products operate in a net-centric manner to enhance the exchange of data and shared security policies.
40Which of the following would not be considered a possible indicator of recruitment?
- AOffer of financial assistance by a foreign national or stranger
- BUnreported or frequent foreign travel
- CTermination notice to go work for a competing company
- DContact with an individual who is suspected of being associated with foreign intelligence
41An unwitting insider is best described as:
- Aa person who works overtime
- Ba person with access to information who unknowingly reveals more than they should to persons without a need to know
- Ca person with access to multiple Special Access Programs
- Da person who discusses their job with co-workers within the Sensitive Compartmented Information Facility (SCIF)
42An insider threat could pose a threat to:
- ANational security
- BYour job
- CYour company’s proprietary and research information
- DAll of the above
43Failure to report suspicious behaviors or possible insider threat indicators could result in punitive or disciplinary actions.
- ARichtig
- BFalsch
44Exploitable weaknesses considered by a Foreign Intelligence Service when considering a source for recruitment may include:
- ADrugs or alcohol
- BGambling
- CAdultery
- DFinancial problems
- EAll of the above
45Known or suspected espionage should always be reported to the FBI.
- ARichtig
- BFalsch
46Removing classification markings from a document is not necessarily considered a possible insider threat indicator and should not be reported to the security office unless there are other suspicious behaviors displayed.
- ARichtig
- BFalsch
47If a coworker seeks additional information outside the scope of his or her responsibility, this is always a sign that the individual is an insider threat.
- ARichtig
- BFalsch
48Elicitation is an effective means of information collection by an insider. When done well, elicitation can seem like simple small talk.
- ARichtig
- BFalsch
49A coworker, who may be of Middle Eastern descent and often speaks in Farsi from his work telephone, is considered suspicious behavior and should always be reported to the security officer.
- ARichtig
- BFalsch
50Collection methods of operation frequently used by Foreign Intelligence Entities to collect information from DoD on the critical technology being produced within the cleared defense contractor facilities we support include:
- AUnsolicited requests for information
- BSolicitation and marketing of services
- CCyber Attacks
- DInternational conventions, seminars, and exhibits
- EAll of the above
51Select ALL the correct responses. Which of the following are examples of a “Security Anomaly” and should be reported?
- AForeign officials claim they already knew about a program after the program was made public
- BForeign officials reveal details they should not have known
- CAn adversary conducts activities with precision that indicates prior knowledge
- DMedia reports on current operations in the Middle East
52To be an “Insider Threat” a person MUST knowingly cause malicious damage to their organization.
- ARichtig
- BFalsch
53Personnel who fail to report CI Activities of concern as outlined in Enclosure 4 of DoD Directive 5240.06 are subject to appropriate disciplinary action under regulations.
- ARichtig
- BFalsch
54The following actions can potentially reduce or compromise your network security and place in jeopardy the lives of our men and women:
- AHacking
- BInputting falsified corrupted data
- CPhishing
- DIntroducing malicious code such as a virus, logic, or Trojan horse
- EAll of the above
55Cyber Vulnerabilities to DoD Systems may include:
- AIllegal downloads
- BViruses
- CWeak passwords
- DDisgruntled or Co-opted employee
- EAll of the above
56Select ALL the correct responses. To minimize the ability of an Insider Threat to go undetected, you and your coworkers must:
- AReport all security infractions, violations, or suspicious activity to your supervisor and the Office of Security
- BNever log onto your computer network outside of normal working hours
- CFollow all security rules and regulations
- DNever gossip about any of your coworkers
- EShow up to work on time every day
57DoD personnel who suspect a coworker of possible espionage should:
- ACall the FBI Hot Line
- BReport directly to your CI or Security Office
- CStart recording their conversations to gather evidence
- DDiscuss situation with others to get second opinion
58An adversary uses technical countermeasures to block a previously undisclosed or classified U.S. intercept technology. This is an example of:
- AAn unidentified press release
- BA lucky guess
- CA paid source
- DA Security Anomaly
59Offers or Invitations for cultural exchanges, individual-to-individual exchanges, or ambassador programs are indicators of this collection method:
- ASolicitation and Marketing of Services
- BInternational conventions, seminars, and exhibits
- CElicitation
- DVisits to Department of Defense (DoD) or contractor facilities
60This is used to collect documentation regarding FOCI, KMP Lists, SF-328 and other facility documents to the DSS.
- AIndustrial Security Facilities Database (ISFD)
- BElectronic Facility Clearance (e-FCL) System
- CJoint Personnel Adjudication System (JPAS)
- DElectronic Questionnaires for Investigations Processing (e-QIP)
61This is used by DSS to document Industrial security actions regarding contractor facilities.
- AIndustrial Security Facilities Database (ISFD)
- BElectronic Facility Clearance (e-FCL) System
- CJoint Personnel Adjudicatoin System (JPAS)
- DElectronic Questionnaires for Investigations Processing (e-QIP)
62Facility M has a facility security clearance at the Confidential level. It has not performed work on an active classified contract in 12 months but expects to begin performance of work on a classified contract next month. What action needs to be taken regarding its facility security clearance?
- AIt should be downgraded
- BIt should be revoked
- CIt should be terminated
- DNo action is necessary
63In the case of a multiple facility organization, which facility should complete the SF-328?
- AThe branch facility
- BBoth the home office facility and the branch facility
- CThe home office facility
64Facility U has a facility security clearance at the Secret level. It has not performed work on an active classified contract in 12 months and does not expect to perform work on a classified contract in the near future. What action needs to be taken regarding its facility security clearance?
- AIt should be revoked
- BIt should be downgraded
- CIt should be administratively terminated
- DNo action is necessary
65As long as a contractor has a bona fide classified procurement need, it can make the request for its own facility security clearance.
- ARichtig
- BFalsch
66A business comprised of two separate and distinct companies that have formed a relationship where one company establishes or takes control of a smaller company is a _____.
- ALimited liability company
- BMultiple facility organization
- CParent-Subsidiary
- DPartnership
67Who evaluates information related to a prospective contractor facility?
- AGovernment Contracting Activity
- BIndustrial Security Representative
- CPSMO-I
68In addition to completing an SF-86, an individual being investigated for a personnel security clearance must also submit which form?
- ASF-312
- BExclusion resolution
- CFingerprint card
- DSF-328
69A DD Form 441-1 is required to be executed for _____.
- AA division or branch within a multiple facility organization
- BA partnership
- CA limited liability corporation
- DA cleared parent company
70Whose CAGE code should be provided in the sponsorship letter?
- AThe government contracting activity sponsoring the facility security clearance request
- BThere is no need to provide a CAGE code for any party in the sponsorship letter
- CThe cleared prime contractor sponsoring the facility security clearance request and the uncleared contractor being sponsored, if it has one
71A business that has one or more owners, usually known as members, which may be individuals or corporations, is a _____.
- ASole proprietorship
- BCorporation
- CLimited liability company
72If the sponsor is a cleared prime contractor, a copy of which document should be enclosed with the sponsorship letter?
- AKMP List
- BDD Form 441
- CDD Form 254
73In a parent-subsidiary relationship where both the parent and the subsidiary require a facility security clearance, but only the subsidiary is required to store classified information, who must execute DD Form 441?
- AOnly the subsidiary must execute DD Form 441.
- BOnly the parent must execute DD Form 441.
- CBoth the parent and the subsidiary must execute their own DD Form 441.
74Which of the following is a secure website designed to facilitate the processing of standard investigative forms used when conducting background investigations?
- AJPAS
- BISFD
- Ce-QIP
- De-FCL
75Failure to submit paperwork for security clearance investigations for key management personnel in a timely manner may result in the discontinuance of the facility security clearance request process.
- ARichtig
- BFalsch
76Why would an interim facility security clearance be granted instead of a final facility security clearance?
- ABecause final eligibility determinations for all key management personnel have not yet been completed
- BBecause all required documentation has not yet been completed
- CBecause all FOCI factors have not yet been favorably adjudicated
77When an uncleared parent with a cleared subsidiary does not require access to classified information, which of the following actions is required?
- AThe parent must obtain a facility security clearance at a level equal to the level at which the subsidiary is cleared.
- BThe parent will be formally excluded from all access to classified information.
- CNo action is required.
78The Facility Security Officer of a cleared contractor facility has recently retired. The new FSO is currently cleared but has no security experience. Does this need to be reported to the facility’s Industrial Security Representative as a change condition?
- ANo, because the new FSO is already cleared, a report is not required
- BNo, this does not need to be reported
- CYes, this is a reportable change
79Does being processed for a facility security clearance have a direct cost to the contractor?
- ANo, the sponsoring activity is responsible for all costs associated with the facility security clearance process.
- BNo, there is no direct cost to the contractor for being processed for a facility security clearance
- CYes, the contractor must pay the government for services rendered during the facility security clearance request process.
80A post office box is an acceptable address to include on the sponsorship letter for the uncleared contractor facility.
- ARichtig
- BFalsch
81A contractor with a cleared facility recently sold some of its shares of stock, but the sale did not result in a change in majority ownership stakes. Does this need to be reported to the facility’s Industrial Security Representative as a change condition?
- ANo, the sale of stocks is never a reportable change
- BNo, this does not need to be reported
- CYes, this is a reportable change
82The evaluation of which of these identifies key management personnel?
- ASponsorship Letter
- BBusiness structure
- CSF-328
- DDD Form 441
83To be eligible for consideration for a facility security clearance, a contractor must be physically located within the U.S. or its territories.
- ARichtig
- BFalsch
84Can a final facility security clearance be issued if all the key management personnel involved with the facility security clearance request process have not yet received final eligibility determinations for access to classified information?
- ANo. All the involved key management personnel must have final personnel security clearance determinations in order for the facility to be issued a final facility security clearance.
- BYes. A final facility security clearance may be issued as long as all the involved key management personnel have interim personnel security clearance determinations.
- CYes. Personnel security clearance determinations for key management personnel are not required in order to be issued a facility security clearance.
85_____ may terminate the DD Form 441 by written notice 30 days in advance of the requested termination.
- AThe contractor
- BThe government
- CEither the government or the contractor
86Once a contractor has met all the eligibility requirements, which of the following are key evaluation areas examined when determining whether to issue a facility security clearance?
- ASponsorship, bona fide classified procurement need, business structure
- BLegal entity organized under U.S. laws, company has reputation for integrity, FOCI factors sufficiently managed
- CSponsorship, DD Form 441, key management personnel
87Who works with a contractor facility to ensure that their security program meets NISP requirements?
- AContract Officer
- BFCB Security Specialist
- CIndustrial Security Representative
88Within a multiple facility organization, only the home office facility is required to have a CAGE code.
- ARichtig
- BFalsch
89Which of the following statements is true?
- AInvalidation of a facility security clearance does not prevent a contractor from receiving new contracts.
- BInvalidation of a facility security clearance is a final terminating action revoking all privileges associated with an active clearance.
- CInvalidation of a facility security clearance is an interim measure allowing a contractor to correct negative security circumstances.
90Of the following assessments, which are used to help complete the threat assessment summary? (Select all that apply)
- AHistory assessment
- BOperations assessment
- CIntent assessment
- DCollection capabilities assessment
91Poor tradecraft practices are an example of a/an ______ vulnerability.
- AInformation
- BOperational
- CEquipment
- DFacility
92Analyzing an asset in an unprotected state first and then analyzing the asset considering the current countermeasures is called ______ analysis.
- AVulnerability
- BRisk
- CThreat
- DRegressive
93When measuring an impact and assigning a value to an undesirable event, which one of the following SME interview questions will help guide you?
- AWhat undesirable events regarding a particular asset concern the asset owner?
- BCould significant damage to national security or loss/injury to human life occur as a result of this event?
- CWhat critical/valuable equipment is located at this site? Why is it critical or valuable?
- DWhere are the assets located?
94________________ is the least expensive countermeasure to implement?
- AManpower
- BEquipment
- CWritten Procedure
95The ability of each existing countermeasure to prevent or minimize a specific type of attack defines what vulnerability criteria?
- AQuantity
- BUndesirable event
- CEffectiveness
- DQuality
96One step in regressive analysis is reevaluating an asset’s vulnerabilities.
- ARichtig
- BFalsch
97The fifth and final step in the risk management process is to determine countermeasure options. Which of the following is the goal of this step?
- ATo identify potential countermeasures for reducing an asset’s vulnerabilities and overall risk to the asset
- BTo identify the value of assets and the degree of impact if they are damaged or lost
- CTo identify vulnerabilities
98The criteria used to determine the level of vulnerability include which of the following? (Select all that apply)
- ALast testing of the vulnerability
- BEffectiveness of countermeasures
- CQuantity
- DQuality
99After you’ve completed all other steps, what final chart would you use to summarize and record your information in order to get the total cost for all countermeasures?
- AIntent Assessment Chart
- BCollection Capability Assessment Chart
- CThreat Assessment Summary Chart
- DCountermeasure Analysis Chart
100When performing a countermeasures cost benefit analysis, which two of the following are good questions to ask?
- ATo what degree does the option delay, deter, detect, defend, or destroy?
- BIs the option available from several contractors?
- CHow does the asset value compare to proposed cost of protection?
- DWhat are the methods an adversary might use to destroy an asset?
101Criminal, terrorist, insider, and natural disasters are examples of categories of ______.
- AThreats
- BVulnerabilities
- CCountermeasures
- DAssets
102Persons , facilities, materials, information, and activities are categories of ______.
- Acountermeasures
- Bassets
- Cvulnerabilities
- Dthreats
103The smaller the risk area shared by assets, threats, and vulnerabilities, the higher the risk level.
- ARichtig
- BFalsch
104One way to describe asset value is:
- AWhat is the potential for an event to take place?
- BWhat is the capability of a specific threat?
- CWhat is the impact of an undesirable event?
- DWhat is the level of weakness at the site?
105Risk management is defined as the process of selecting and implementing ______ to achieve an acceptable level of risk at an acceptable cost.
- Acountermeasures
- Bprocedures
- Cassets
- Dpolicies
106When determining an adversary’s history, the fact that the adversary might attempt an attack at a foreseeable future event is irrelevant.
- ARichtig
- BFalsch
107The time to implement and oversee the countermeasure, the time to prepare for its implementation, and any time required for follow-up and evaluation have no impact when determining the cost of a countermeasure.
- ARichtig
- BFalsch
108Which of the following statements defines an adversary?
- AIntended plans that may pose a threat to an asset.
- BThe identification of an asset’s threats.
- CAny individual, group, organization, or government that conducts activities, or has the intention and capability to conduct activities detrimental to assets.
- DAny indication, circumstance, or event with the potential to cause the loss of, or damage to an asset.
109What is the risk rating of an asset with an impact of 10, a threat rating of .12 and a vulnerability rating of .40?
- A32
- B48
- C1
- D5
110When determining an adversary’s capability, which of the following collection methods includes resources such as newspapers, internet, magazines, and conventions, FOIA requests, seminars, and exhibits?
- AIMINT
- BHUMINT
- CSIGINT
- DOSINT
111You should use the intent, capability, and history charts to create the Threat Assessment Summary Chart.
- ARichtig
- BFalsch
112You are the one who decides what constitutes an acceptable level of risk for an organization’s assets.
- ARichtig
- BFalsch
113The formula R=I [T x V] is used for calculating a risk rating. What risk factors do R, I, T, and V represent?
- Areturn, impact, threat, vulnerability
- Brisk, impact, threat, vulnerability
- Creturn, importance, threat, vulnerability
- Drisk, importance, threat, vulnerability
114There are six steps in the analytical risk management process. True or false?
- ARichtig
- BFalsch
115When determining the cost associated with a loss, only monetary loss is considered in the risk management process. True or false?
- ARichtig
- BFalsch
116An asset can be defined as anything that ______. (Select all that apply)
- AHas a weakness
- BIs of value
- CRequires protection
117The five general areas open to potential asset vulnerabilities include: human, operational, information, facility, and equipment. True or false?
- ARichtig
- BFalsch
118Which of the following is NOT a good interview question for determining an adversary’s history?
- AHas the adversary attacked or exploited assets and personnel before?
- BDoes the adversary have the weapons or tools for exploiting or attacking an asset?
- CHas the adversary been suspected of attacking or exploiting assets?
- DMight some foreseeable event cause the adversary to attempt an attack in the future?
119Different perspectives to any terrorist event include which of the following?
(Select all that apply.)- AThe terrorist perspective that feels killing innocent people is morally justified to achieve objectives.
- BThe victim perspective that sees terrorist acts as criminal and immoral.
- CThe military perspective that feels that all terrorist events are evil and warrant retaliatory action.
- DThe general public perspective that either supports or opposes the terrorist causes.
120A state-supported terrorist group operates:
- AAs a recognized religion or radical offshoot
- BIndependently, but receives some support from governments
- CPrimarily by the support of a state or country
- DAutonomously, receiving no support from any governments
121Which of the following is considered a common characteristic of terrorist groups?
- AOperating overtly
- BBeing rurally based
- CBeing highly mobile
- DConsidering tactical success as mission success
122Training conducted in a clandestine fashion at the cell level by members of the terrorist group within the targeted country is considered ______________________.
- AExternal training
- BRevolutionary training
- CMilitaristic training
- DInternal training
123Internal training
- AHaving positive contact with the captor
- BAccepting the situation as not long-term since authorities will come to the rescue
- CSeeing the captor's human qualities
124A dirty bomb ______________________.
(Select all that apply.)- AUpon detonation will produce mass casualties but will not penetrate a building
- BIs used by terrorists to frighten people and make the land around the explosion unusable for a long period of time
- CCombines conventional explosives with radioactive materials
125To minimize the insider threat, practice:
- AAwareness, Prevention, and Deterrence
- BMitigation, Reaction, and Destruction
- CDetection, Protection, and Action
126Which of the following statement(s) are true?
- AA Vulnerability Assessment should focus only on WMD.
- BIt is an annual requirement to receive a Higher Headquarters Vulnerability Assessment.
- CThe Commander uses a Vulnerability Assessment to determine the susceptibility of assets to attack from threats.
- DAll of the above.
127During a Risk Assessment, which element(s) must be considered to make well-informed decisions?
- AVulnerability
- BAsset Criticality
- CThreat
- DAll of the above
128A typical AT program organization includes the following members:
(Select all that apply.)- ADTRA
- BThe ATO and the Installation Commander
- CAntiterrorism Executive Committee
- DThe Threat Working Group
129Security functions that must be performed for a physical security system to protect DoD assets include ______________________.
- AThreat delay
- BThreat detection
- CThreat response
- DAll of the above
130When placing vehicle barriers, consider __________________
- ALocation
- BAesthetics
- CSafety
131Which of the following are examples of temporary barriers?
(Select all that apply.)- ABerms
- BJersey barriers
- CRopes
132DoD AT Construction Standards:
(Select all that apply.)- ASpecify design criteria for incorporating threat-based AT requirements
- BProvide minimum construction requirements for new construction and major renovations
- CMandate Services and/or Agencies establish AT guidelines for new construction to counter terrorism threat capabilities
133An AT plan ______________________.
(Select all that apply.)- AIs written from the Service or Agency level down to the Installation level for permanent operations or locations
- BContains all of the specific measures that need to be taken in order to establish and maintain an AT program
- CIs incorporated in operation orders for temporary operations or exercises
134Which paragraph of the AT plan lists the specific tasks for each subordinate unit?
- AExecution
- BAnnexes
- CSituation
- DMission
135Which paragraph of the AT plan defines the requirements for supporting the AT Plan?
- AExecution
- BAnnexes
- CMission
- DAdministration and Logistics
136The ATO is ______________________.
(Select all that apply.)- AResponsible for making decisions regarding requirement funding
- BResponsible for continuously documenting funding requirements
- CThe expert within an organization for generating, prioritizing, and appropriately documenting AT requirements
137Which funding category does a resource fall in if it is important to the mission, but has a low vulnerability?
- ANeed to fund
- BShould fund
- CMust fund
138Which of the following are reasons a future captor may have for selecting potential victims?
- AThe amount of money the U.S. Government offers for hostages
- BThe victims' nationality
- CThe victims' value to their families
- DThe victims' financial resources
139Immediately upon capture, the victim must decide to resist the captor, escape the situation, or surrender and cooperate with the captor. Which of the following will influence the victim's decision?
- AThe victim's self-defense and survival skills
- BThe victim's personal wealth
- CThe number of captors
- DWhether or not the captors are armed
140A captor will exert control and dominance over a hostage by:
- AConfiscating a hostage's personal items, such as a watch or wallet
- BIsolating a hostage from any human contact
- CProviding a hostage with regular meals
- DTaking all of a hostage's life quality aids, such as glasses or hearing aids
141Which of the following are symptoms that a hostage may be experiencing Stockholm syndrome?
- AReceiving insufficient nourishment
- BPerceiving the captor as a victim of circumstance versus an aggressor
- CBeing belligerent towards the captor
- DIdentifying with the captor
142Which of the following may be reasons for a hostage situation ending with little to no harm to the hostage?
- AThe hostages become combative with the captors.
- BAuthorities may achieve a successful negotiation with the captors resulting in the release of the hostage.
- CHostages remain uncooperative with the captors.
143The anger and frustration hostage survivors experience may sometimes be directed toward the:
- ADoD
- BRescuers
- CThemselves
- DU.S. Government
144Training related to the Code of Conduct is conducted at different levels based on:
- AThe amount of sensitive information the Service member has.
- BA potential captor's assessment of the Service member's usefulness.
- CThe Service member's tenure in the military.
- DThe Service member's susceptibility to capture.
145Specific guidance for captured U.S. military personnel applies to situations in which they:
- AHave been released
- BAre on assignment
- CHave been captured
- DAll of the above
146What techniques should a victim use to try and avoid unnecessary violence during capture?
- AHide materials indicating affiliation with the U.S. Government for leverage.
- BResist panicking.
- CAnticipate the captor's efforts to create confusion.
- DCatch the captor off guard in hopes of escaping.
147There are several techniques hostages can use to help them survive a hostage situation. They should:
- AVary their voice levels so their captors do not hear them speaking.
- BMaintain a regular exercise routine.
- CRemain realistic about their situation and not make future plans for themselves.
- DRemain constantly alert for any sign of being rescued.
148If a hostage senses or realizes a rescue attempt is imminent, the hostage should:
- APrepare to escape the situation as soon as there is an opportunity to do so.
- BDrop to the floor.
- CRemain still until rescuers provide instructions.
- DMotion to rescuers so that they are easily identified.
149Techniques for helping a hostage survivor return to a daily routine include:
- ALimiting contact with the press.
- BRefraining from making public statements about the captor.
- CSpeaking openly about the rescue with reporters.
- DBeing accessible to the press to discuss being held hostage and rescued.
150Symptoms exhibited when suffering from the Stockholm Syndrome include:
- ARefusing to assist the captor
- BLosing touch with reality
- CHindering rescue efforts
- DSuffering from long-term emotional instability
151Which of the following statements illustrate the correct application of the DoD Code of Conduct?
- ADuring capture, Service members should resist their potential captors in an effort to break free.
- BAs a hostage, Service members should not, under any circumstances, support or encourage their captors.
- CService members on assignment in an area prone to terrorist activity shall follow the appropriate counter-terrorism measures.
- DAs a hostage, Service members should accept release regardless of the consequences of such action.
152If a terrorist group is labeled state-directed:
- AThe group is primarily supported by a country or state
- BThe group is usually an insurgent movement
- CActivities are conducted at the direction of the state
- DThe group may be an element of the state's security organization
153Terrorist groups labeled by their political affiliation:
- AAre considered to be political extremists
- BHave suicidal members
- CHave a charismatic leader who preaches a form of exclusivity
- DConsist of young members, generally between 19 and 35 years old
154Which of the following are considered common characteristics of terrorist groups?
- AHighly mobile
- BOperate covertly
- CUrban based
- DMilitarily stronger than their opposition
155Which of the following statements are true?
- ATo achieve a chaotic atmosphere, a terrorist group will disrupt lines of communication.
- BTerrorist groups will encourage foreign investments to boost and strengthen their country’s economy.
- CAttacks against a state government’s security forces are used to erode public confidence.
- DMajor acts or a successful terrorist campaign can attract additional support for the group’s cause.
156Which of the following terrorist group goals is generally accomplished through skyjacking and hostage taking?
- ASatisfying vengeance
- BTurning the tide in a Guerrilla War
- CCausing an overreaction
- DRelease of incarcerated comrades
157An intelligence cell of a terrorist group:
- ACollects target-specific information
- BIs comprised of people who conduct kidnappings
- CRecruits new members
- DProvides OPSEC
158When an operative travels abroad to a training camp, then returns home to put their training into practice, this is considered:
- AInternal training
- BExternal training
- CSurvival training
- DCommunications training
159Which of the following are considered common goals of terrorist groups?
- AObtaining money and equipment
- BRelease of imprisoned comrades
- CCreating a safe environment for their people
- DInfluencing government decisions, legislations, or elections
160The number, size, and the overall structure of the terrorist group cells depends on:
- AGoals of the terrorist group
- BThe security in the group's operating area
- CThe abilities of the group's communication network
- DMedia publicity of the group
161Training conducted in a clandestine fashion at the cell level by members is referred to as:
- AExternal training
- BInternal training
- CRevolutionary training
- DMilitaristic training
162Which of the following statement(s) pertaining to terrorist operations are true?
- ATerrorist operations are relatively easy to execute because they are relatively easy to command, control, and support.
- BTo ensure a sound operation, terrorists rehearse the operation in an environment mirroring the target location.
- CTerrorists select multiple targets as potential locations for the actual operation.
- DTerrorist operations are designed to impact only direct victims.
163Terrorists gather information on security measures and observable routines.
- APhase II: Intelligence Gathering and Surveillance
- BPhase IV: Pre-Attack Surveillance and Planning
- CPhase V: Attack Rehearsal
- DPhase VII: Escape
164Terrorists deploy into the target area.
- APhase I: Broad Target Selection
- BPhase IV: Pre-Attack Surveillance and Planning
- CPhase V: Attack Rehearsal
- DPhase VI: Actions on the Objectives
165Terrorists determine the weapon or attack method.
- APhase II: Intelligence Gathering and Surveillance
- BPhase III: Specific Target Selection
- CPhase IV: Pre-Attack Surveillance and Planning
- DPhase VI: Actions on the Objectives
166Terrorists collect information from media and internet research.
- APhase I: Broad Target Selection
- BPhase III: Specific Target Selection
- CPhase IV: Pre-Attack Surveillance and Planning
- DPhase VI: Actions on the Objectives
167Skyjacking
- AThe forceful seizure of an aircraft, its passengers, and cargo.
- BThe unlawful seizure and detainment of a person, where the person is usually held for ransom.
- CThe most common type of terrorist attack because of the relatively low risk of injury to the terrorist.
- DOne of the oldest terrorist tactics, it means murdering someone in a surprise attack, usually with small arms or bombs.
168Assassination
- AThe most common type of terrorist attack because of the relatively low risk of injury to the terrorist.
- BThe unlawful seizure and detainment of a person, where the person is usually held for ransom.
- CThe forceful seizure of an aircraft, its passengers, and cargo.
- DOne of the oldest terrorist tactics, it means murdering someone in a surprise attack, usually with small arms or bombs.
169Kidnapping
- AThe forceful seizure of an aircraft, its passengers, and cargo.
- BThe unlawful seizure and detainment of a person, where the person is usually held for ransom.
- CThe most common type of terrorist attack because of the relatively low risk of injury to the terrorist.
- DOne of the oldest terrorist tactics, it means murdering someone in a surprise attack, usually with small arms or bombs.
170Bombing
- AThe forceful seizure of an aircraft, its passengers, and cargo.
- BThe unlawful seizure and detainment of a person, where the person is usually held for ransom.
- CThe most common type of terrorist attack because of the relatively low risk of injury to the terrorist.
- DOne of the oldest terrorist tactics, it means murdering someone in a surprise attack, usually with small arms or bombs.
171Raid
- AThe forceful seizure of a surface vehicle, its passengers, and/or its cargo.
- BA surprise attack by a small armed force on a previously defined target.
- CThe seizure of a facility to include taking all persons inside hostage.
- DA sudden attack made from a concealed position on a previously defined target.
172Ambush
- AThe forceful seizure of a surface vehicle, its passengers, and/or its cargo.
- BA surprise attack by a small armed force on a previously defined target.
- CThe seizure of a facility to include taking all persons inside hostage.
- DA sudden attack made from a concealed position on a previously defined target.
173Hijacking
- AThe forceful seizure of a surface vehicle, its passengers, and/or its cargo.
- BA surprise attack by a small armed force on a previously defined target.
- CThe seizure of a facility to include taking all persons inside hostage.
- DA sudden attack made from a concealed position on a previously defined target.
174Hostage Barricade
- AThe forceful seizure of a surface vehicle, its passengers, and/or its cargo.
- BA surprise attack by a small armed force on a previously defined target.
- CThe seizure of a facility to include taking all persons inside hostage.
- DA sudden attack made from a concealed position on a previously defined target.
175The deliberate weakening of another entity through subversion, obstruction, disruption, and/or destruction.
- AEnvironmental Destruction
- BSeizure
- CSabotage
- DThreats/Hoaxes
176The destruction of oil fields or attacks on oil tankers.
- AEnvironmental Destruction
- BSeizure
- CSabotage
- DThreats/Hoaxes
177An active shooter is an individual actively engaged in killing or attempting to kill people in a confined and populated area.
- ARichtig
- BFalsch
178During an active shooter situation, you should:
- AHide
- BScream
- CEvacuate
- DTake Action
179When law enforcement arrives, you should:
- AImmediately raise hands and spread fingers
- BAsk for help
- CRemain calm, and follow officers’ instructions
- DPoint to where the active shooter is
180Which of the following are sources of insider security problems?
- AMaliciousness
- BDisdain of security practices
- CCarelessness in protecting DoD information
- DIgnorance of security policy and security practices
- EAll of the above
181“Insider threat” is that an insider will, by acts of commission or omission, intentionally or unintentionally, use their authorized access to do harm to the security of the U.S.
- ARichtig
- BFalsch
182The terrorist’s objectives are controlled and/or condoned by an established state.
- ASub-Revolutionary
- BEstablishment
- CRevolutionary
183The terrorist’s objectives are to overthrow the existing government, particularly in the area of operations.
- ASub-Revolutionary
- BEstablishment
- CRevolutionary
184The terrorist’s objectives are to influence an unwilling government or group into making political, social, or economic changes.
- ASub-Revolutionary
- BEstablishment
- CRevolutionary
185The terrorist threat level that indicates that anti-U.S. terrorists are present with limited operational activity.
- AHigh
- BSignificant
- CModerate
- DLow
186FPCON BRAVO will apply when:
- AA general global threat of possible terrorist activity exists
- BAn increased threat of terrorist activity exists
- CA terrorist attack has occurred
- DIntelligence indicates some form of terrorist activity is likely
187RAM is the random use of various protective measures in order to:
- ARehearse procedures
- BFrustrate terrorist planning
- CReplace FPCON
- DHeighten unit awareness
188Perspectives to any terrorist event are:
- AThe terrorist perspective that feels killing innocent people is morally justified to achieve objectives
- BThe victim perspective that sees terrorist acts as criminal and immoral
- CThe general public perspective that either supports or is against the terrorist causes
- DThe military perspective that feels that all terrorist events are evil and warrant retaliatory action
189Which of the following methodology factors did the DoD take into account?
- ATerrorist Targets
- BTerrorist History
- CTerrorist Capabilities
- DTerrorist Intentions
190A terrorist threat level is:
- AIdentified as High, Significant, Moderate, or Low
- BIdentified as NORMAL, ALPHA, BRAVO, CHARLIE, or DELTA
- CThe random use of various security measures normally employed at higher force protection conditions in order to rehearse procedures
- DAn intelligence community judgment about the likelihood of terrorist attacks on U.S. interests
191Force Protection Conditions (FPCONs) are:
- AAn intelligence community judgment about the likelihood of terrorist attacks on U.S. interests
- BIdentified as Normal, Alpha, Bravo, Charlie, or Delta
- CA system of protective measures used by DoD installations and organizations to guard against and deter terrorist attacks
192A terrorist threat level is ________________. (Select all that apply)
- AAn intelligence community judgment about the likelihood of terrorist attacks on US interests.
- BIdentified as NORMAL, ALPHA, BRAVO, CHARLIE, or DELTA.
- CIdentified as High, Significant, Moderate, or Low.
193Which of the following are consider common goals of terrorist groups?
- AReleasing imprisoned comrades
- BInfluencing government decisions, legislations, or elections
- CObtaining money and equipment
- DAll of the above
194The number, size, and overall structure of terrorist group cells depend upon ________________________.
- AThe goals of the terrorist group
- BThe security in the group’s operating area
- CThe number of members in the terrorist group
- DThe abilities of the group’s communication network
195Which of the following statements are true regarding terrorist operations? (Select all that apply.)
- ATerrorist operations are difficult to execute due to the large group of individuals to train and command.
- BTerrorists select multiple targets as potential locations for the actual operation.
- CTerrorist operations are always designed on the defensive.
- DTerrorist rehearse the operation in an environment mirroring the target location or in the target location itself.
196Why might a potential captor take a victim hostage? (Select all that apply.)
- AFor the publicity the situation would generate
- BBecause the victim drives and expensive car
- CBecause the victim is in the wrong place at the wrong time
- DBecause the victim may be a source of trouble otherwise
197If a hostage senses or realizes a rescue attempt is imminent, the hostage should:
- AMotion to rescuers so they are easily identified
- BPrepare to escape the situation as soon as there is an opportunity to do so
- CDrop to the floor and remain still until rescuers provide instructions
- DAll of the above
198Chemical agents are:
- ANerve agents, such as sarin, that interfere with the functioning of the nervous system
- BLikely to be used in large quantities by terrorist
- CSubstances that are created by plants and animals that are poisonous to humans
- DIdentifiable with the sudden onset of symptoms
199Which of the following statements are true? (Select all that apply.)
- AThere is no antidotal treatment for nerve agent poisoning.
- BA sudden onset of symptoms is a characteristic of chemical agents.
- CTerrorists will likely use small quantities of chemical agents in a highly populated area where the potential for exposure is the greatest.
200Which of the following are potential indicators of an insider threat?
- ACopying Files
- BUnusual work hours
- CTaking short trips
- DUnexplained affluence
- EAll of the above
Informationen
- Beschreibung
- Security
- Autor
- Arthur Casto
- Sprache
- English
- Aufrufe
- 11.410
- Schlagwörter
- Bewertung
- Noch keine Bewertungen Bewerte dieses Quiz