CFA Counterintelligence Awareness & Threat Recognition 2 — Questions and Answers
Question 1: What is 'tradecraft' in the context of intelligence and counterintelligence operations?
- The legal framework governing intelligence collection activities
- The skills, techniques, and procedures used by intelligence professionals in the field (Correct answer)
- The formal reporting structure within an intelligence organization
- The process of translating raw intelligence into finished analytical products
Correct answer: The skills, techniques, and procedures used by intelligence professionals in the field
Tradecraft encompasses the practical skills, operational techniques, and methodologies — such as surveillance, dead drops, and cover management — that intelligence officers use to conduct and protect their operations.
Question 2: Which of the following is a key indicator that a foreign intelligence service (FIS) may be actively targeting an organization or individual?
- Receiving unsolicited communications that probe for sensitive organizational details (Correct answer)
- Increased frequency of routine background investigations
- Assignment of additional security personnel to facilities
- Receiving invitations to official foreign government events
Correct answer: Receiving unsolicited communications that probe for sensitive organizational details
Unsolicited contacts — whether by email, phone, or in person — that probe for sensitive information about personnel, capabilities, or operations are a classic FIS targeting technique.
Question 3: In counterintelligence, what does a 'damage assessment' evaluate following a confirmed security compromise?
- The physical damage caused to facilities during a hostile surveillance operation
- The cost of repairing compromised technical collection systems
- The scope of classified information exposed and the potential harm to sources, methods, and operations (Correct answer)
- The number of personnel who failed their security polygraph examinations
Correct answer: The scope of classified information exposed and the potential harm to sources, methods, and operations
A damage assessment determines what classified information was exposed, who may have received it, and what the operational impact may be — including threats to sources, ongoing operations, and national security.
Question 4: What is the counterintelligence purpose of a 'honey trap' (also known as a 'honey pot') operation?
- Using financial incentives to recruit foreign intelligence officers as defectors
- Exploiting romantic or sexual relationships to compromise, recruit, or gather intelligence on a target (Correct answer)
- Creating a fake intelligence operation to draw out hostile CI investigators
- Establishing a cover business to launder operational funds
Correct answer: Exploiting romantic or sexual relationships to compromise, recruit, or gather intelligence on a target
A honey trap operation uses romantic or sexual relationships — real or manufactured — to create leverage over a target, elicit sensitive information, or compromise them for recruitment purposes.
Question 5: What is an 'access agent' in the context of counterintelligence operations?
- A cleared government employee who manages physical security access to classified facilities
- A foreign intelligence officer operating under official diplomatic cover
- An individual used to introduce an intelligence officer or recruit to a targeted individual without revealing true intent (Correct answer)
- A CI officer who gains access to foreign embassy receptions for collection purposes
Correct answer: An individual used to introduce an intelligence officer or recruit to a targeted individual without revealing true intent
An access agent provides an introduction or connection to a target of interest, enabling intelligence contact to be made under a benign pretext that conceals the true intelligence purpose of the relationship.
Question 6: Which approach is typically used by counterintelligence professionals to handle a discovered mole without immediately compromising the ongoing investigation?
- Immediately revoking the individual's security clearance and alerting all colleagues
- Feeding the mole controlled, false information while the investigation continues to identify the full scope of the network (Correct answer)
- Transferring the suspected mole to an unrelated department to monitor behavior
- Conducting a formal interview of the suspected mole to elicit a confession
Correct answer: Feeding the mole controlled, false information while the investigation continues to identify the full scope of the network
Controlled information feeding allows CI investigators to confirm the compromise, identify foreign handlers, assess the full damage, and potentially neutralize the threat while building a prosecutable case.
Question 7: What does 'compartmentalization' mean in intelligence security, and why is it a critical CI principle?
- Physically separating classified materials by document classification level in secure storage
- Dividing intelligence operations and information into separate restricted categories so a single compromise cannot expose the entire program (Correct answer)
- Organizing field agents into separate geographic regions to prevent overlap
- Assigning different cover identities to an agent for different operational environments
Correct answer: Dividing intelligence operations and information into separate restricted categories so a single compromise cannot expose the entire program
Compartmentalization limits the blast radius of any single compromise by ensuring that even insiders with high clearances only know about their specific compartment, preventing cascading exposure of unrelated programs.
CFA Counterintelligence Awareness & Threat Recognition 2
What is 'tradecraft' in the context of intelligence and counterintelligence operations?