FY 2026 Cyber Awareness Challenge Knowledge Check

Which of the following is a best practice to protect your identity?

Monitor your financial statements and credit reports.

How should you approach a compressed URL, such as Tiny URL?

Preview where the link leads before opening it.

Sara is a government employee with a high degree of expertise in her field. She receives an e-mail from a foreign national that is complimentary of Sara's expertise and seeks to make a connection with her to learn more about her work. What should Sara do?

Report the contact to her security POC

You receive an e-mail with a link to verify that your account is active. It says you must click the link within 2 days. Your IT department has not sent links like this in the past. The e-mail is not digitally signed. What action should you take?

Report the e-mail to your security POC or help desk

Which of the following is an allowed use of a government-furnished smartphone?

Responding to e-mails on your government e-mail account

In what level of system can you use a SIPRNet public key infrastructure (PKI) token?

SIPRNet

How can you protect your home computer?

Scan files for viruses.

You receive a suspicious e-mail that appears to have come from an organization that partners with your agency. Your co-workers have received a similar e-mail. What might this be?

Spear phishing

What risk is posed by Internet of Things (IoT) devices?

Their connectivity can be exploited as an attack vector to any other device on the same network.

What is a risk to Government systems posed by removable media?

Their data storage and ability to connect to systems can lead to unintended transfers of information, such as introduction of malicious code or spillage.

Paula is compiling statistics on healthcare provided to Service members over the last fiscal year. Some of her source data includes Protected Health Information (PHI). How can she properly process this data?

Use an encrypted device that requires a passcode or biometrics to unlock

What should you do with your badge within a Sensitive Compartmented Information Facility (SCIF)?

Wear it visibly and above the waist

Which of the following is an example of Protected Health Information (PHI)?

An individual's medical records maintained by a healthcare provider.

Which of the following is an example of a correct way to protect classified data?

Andrea verifies need-to-know and security eligibility before sharing classified information.

On a Government-owned mobile device, what should you do before installing an application?

Ensure that it is an approved and authorized application.

Trisha receives an e-mail with a sensational rumor about a celebrity's personal life. Which of the following actions should Trisha NOT take with the e-mail?

Forward it

Oscar is on official Government travel with a Government-issued laptop. While at the airport he uses the laptop to work on a report containing controlled unclassified information (CUI). For connectivity, he uses his personal phone as a mobile hotspot. Are there any security concerns?

Yes. He should be vigilant for "shoulder surfing," where others may be able to view the information on his screen.

Evelyn is a system administrator at her agency. As part of her duties, she occasionally uses a thumb drive to perform necessary system tasks, as outlined in her agency's procedures. The thumb drive is provided by the Government for this purpose. Is this an appropriate use of removable media?

Yes. Only use removable media when operationally necessary, Government-owned, and approved in accordance with policy

Walter shares a link to a news article about the Department of Defense on his social media. Along with the link, he states that he disagrees with the reporting in the article as a DoD employee. Does this pose a security concern?

Yes. Walter should avoid appearing to speak on behalf of the Government

While scrolling your social media feed, you are presented with a news article with an incendiary headline accompanied by a video. What should you consider before sharing this article?

You should consider the source and whether this information appears elsewhere.

Based on the description provided, how many insider threat indicators are present? Jean is a long-term government employee who recently transferred from one agency to another to take a supervisory role. As part of her transition, Jean requires a higher level of access to sensitive information.

2

Under which Cyberspace Protection Condition (CPCON) is the priority focuse limited to critical and essential functions?

CPCON 1

How can you identify the separation of Sensitive Compartmented Information (SCI) classified material from collateral classified material?

Markings that identify the compartment with which it is affiliated.

What is Controlled Unclassified Information (CUI)?

Information that belongs to a category established in the DoD CUI Registry

How do Insider Threat Programs defend against insider threats?

Intervening early to help individuals with issues