DOD Cyber Awareness 2023

Which of the following is an example of a strong password?

%2ZN=Ugq

Which of the following is a potential insider threat indicator?

1) Unusual interest in classified information. 2) Difficult life circumstances, such as death of spouse.

Based on the description that follows, how many potential insider threat indicators(s) are displayed? A colleague saves money for an overseas vacation every year, is a single father, and occasionally consumes alcohol.

2 indicators.

Which of the following is an example of two-factor authentication?

A Common Access Card and Personal Identification Number.

Which of the following personally-owned computer peripherals is permitted for use with Government-furnished equipment?

A headset with a microphone through a Universal Serial Bus (USB) port.

Which of the following is true of traveling overseas with a mobile phone?

A personally owned device approved under Bring Your Own Approved Device (BYOAD) policy must be unenrolled while out of the country.

Which of the following is true of Sensitive Compartmented Information (SCI)?

Access requires Top Secret clearance and indoctrination into the SCI program.

Which of the following statements is true?

Adversaries exploit social networking sites to disseminate fake news.

What is the response to an incident such as opening an uncontrolled DVD on a computer in a SCIF?

All of these.

When is it appropriate to have your security badge visible?

At all times when in the facility.

Which of the following is a reportable insider threat activity?

Attempting to access sensitive information without need-to-know.

In addition to avoiding the temptation of greed to betray his country, what should Alex do differently?

Avoid talking about work outside of the workplace or with people without a need-to-know.

What is the danger of using public Wi-Fi connections?

Both of these.

Which Cyber Protection Condition (CPCON) establishes a protection priority focus on critical functions only?

CPCON 1.

Which of the following is NOT a correct way to protect CUI?

CUI may be stored on any password-protected system.

Which of the following is true of Controlled Unclassified Information (CUI)?

CUI must be handled using safeguarding or dissemination controls.

Which of the following represents an ethical use of your Government-furnished equipment (GFE)?

Checking personal e-mail when allowed by your organization.

What is the basis for handling and storage of classified data?

Classification markings and handling caveats.

Which of the following does NOT constitute spillage?

Classified information that should be unclassified and is downgraded.

Which of the following is true of protecting classified data?

Classified material must be appropriately marked.

What must authorized personnel do before permitting another individual to enter a Sensitive Compartmented Information Facility (SCIF)?

Confirm the individual's need-to-know and access.

Which designation includes Personally Identifiable Information (PII) and Protected Health Information (PHI)?

Controlled Unclassified Information (CUI)

Which of the following is NOT a potential consequence of using removable media unsafely in a Sensitive Compartmented Information Facility (SCIF)?

Damage to the removable media.

Which of the following is true?

Digitally signed e-mails are more secure.

Which of the following is a good practice to protest classified information?

Don't assume open storage in a secure facility is authorized.

Which of the following should you NOT do if you find classified information on the internet?

Download the information.

How can you protect data on your mobile computing and portable electronic devices (PEDs)?

Enable automatic screen locking after a period of inactivity.

Which of the following must you do before using an unclassified laptop and peripherals in a collateral classified environment?

Ensure that any cameras, microphones, and Wi-Fi embedded in the laptop are physically disabled.

How can you protect your organization on social networking sites?

Ensure there are no identifiable landmarks visible in any photos taken in a work setting that you post.

What level of damage to national security can you reasonably expect Top secret information to cause if disclosed?

Exceptionally grave damage.

Which of the following is NOT a type of malicious code?

Executables.

Which of the following is an example of removable media?

External hard drive.

Which of the following may help to prevent spillage?

Follow procedures for transferring data to and from outside agency and non-government networks.

When may you be subject to criminal, disciplinary, and/or administrative action due to online harassment, bullying, stalking, hazing, discrimination, or retaliation?

If you participate in or condone it at any time.

Which of the following best describes the conditions under which mobile devices and applications can track your location?

It is often the default but can be prevented by disabling the location function.

What security risk does a public Wi-Fi connection pose?

It may prohibit the use of a virtual private network (VPN).

Which of the following demonstrates proper protection of mobile devices?

Linda encrypts all of the sensitive data on her government-issued mobile devices.

Which of the following best describes good physical security?

Lionel stops an individual in his secure area who is not wearing a badge.

Which of the following statements is true?

Many apps and smart devices collect and share your personal information and contribute to your online identity.

Which of the following is true about URLs?

May be used to mask malicious intent.

What should Sara do when using publicly available Internet, such as hotel Wi-Fi?

Only connect with Government VPN.

What portable electronic devices (PEDs) are permitted in a SCIF?

Only expressly authorized government-owned PEDs.

Which of the following is a security best practice for protecting Personally Identifiable Information (PII)?

Only use Government-approved equipment to process PII.

Who designates whether information is classified and its classification level?

Original classification authority.

Which of the following best describes a way to safely transmit Controlled Unclassified Information (CUI)?

Paul verifies that the information is CUI, includes a CUI marking in the subject header, and digitally signs an e-mail containing CUI.

Which piece of information is safest to include on your social media profile?

Photos of your pet.

What should the participants in this conversation involving SCI do differently?

Physically assess that everyone within listening distance is cleared and has a need-to-know for the information being discussed.

Which of the following is NOT an example of CUI?

Press release data.

A vendor conducting a pilot program with your organization contacts you for organizational data to use in a prototype. How should you respond?

Refer the vendor to the appropriate personnel.

What should Alex's colleagues do?

Report the suspicious behave in accordance with their organization's threat policy.

What should the owner of this printed SCI do differently?

Retrieve classified documents promptly from printers.

Which of the following actions can help tp protect your identity?

Shred personal documents.

What type of social engineering targets particular groups of people?

Spear phishing.

When classified data is not in use, how can you protect it?

Store classified data appropriately in a GSA-approved vault/container.

Which is a best practice for protecting Controlled Unclassified Information (CUI)?

Store it in a locked desk drawer after working hours.

What is the best way to protect your Common Access Card (CAC) or Personal Identity Verification (PIV) card?

Store it in a shielded sleeve.

Which of the following is true of Internet of Things (IoT) devices?

They can become an attack vector to other devices on your home network.

Which of the following is true of removable media and portable electronic devices (PEDs)?

They have similar features, and the same rules and protections apply to both.

When is it okay to charge a personal mobile device using government-furnished equipment (GFE)?

This is never okay.

How many insider threat indicators does Alex demonstrate?

Three or more.

Which is an appropriate use of government e-mail?

Use a digital signature when sending attachments or hyperlinks.

Which of the following is NOT an appropriate way to protect against inadvertent spillage?

Use the classified network for all work, including unclassified work.

How can you protect yourself on social networking sites?

Validate friend requests through another source through another source before confirming them.

How can you protect yourself from social engineering?

Verify the identity of all individuals.

Which of the following is true about telework?

You must have your organization's permission to telework.

Which of the following is true of the Common Access Card (CAC) or Personal Identity Verification (PIV) card?

You should remove and take your CAC/PIV card whenever you leave your workstation.

Which piece of information is safest to include on your social media profile?

Your favorite movie.

Which scenario might indicate a reportable insider threat?

a colleague removes sensitive information without seeking authorization in order to perform authorized telework.

A compromise of Sensitive Compartmented Information (SCI) occurs when a person who does not have the required clearance or access caveats comes into possession of SCI________.

in any manner.