CFA Personal Security & Situational Awareness 3 — Questions and Answers
Question 1: Which level of Cooper's Color Code represents a relaxed but alert state appropriate for everyday field operations?
- White
- Yellow (Correct answer)
- Orange
- Red
Correct answer: Yellow
Condition Yellow is a state of relaxed alertness where the individual is aware of their surroundings without fixating on a specific threat.
Question 2: A field agent discovers their hotel room has been searched while they were away. What should they do FIRST?
- Check whether anything is missing before notifying anyone
- Leave the room immediately and do not touch anything, then report the incident (Correct answer)
- Report the intrusion to the hotel management to request a new room
- Review personal notes and files to assess what may have been compromised
Correct answer: Leave the room immediately and do not touch anything, then report the incident
Leaving the room untouched preserves potential forensic evidence and prevents triggering any devices that may have been left behind, followed by immediate reporting.
Question 3: Social engineering attacks most commonly target field agents through:
- Physical force during transit
- Exploitation of trust, authority, or urgency to extract sensitive information (Correct answer)
- Direct hacking of government-issued devices
- Anonymous written correspondence
Correct answer: Exploitation of trust, authority, or urgency to extract sensitive information
Social engineering manipulates human psychology—using trust, authority, or urgency—to bypass security measures without technical means.
Question 4: What does 'TEDD' stand for in surveillance detection?
- Threat, Exposure, Distance, and Demeanor
- Time, Environment, Distance, and Demeanor (Correct answer)
- Tracking, Evasion, Detection, and Departure
- Terrain, Entry, Direction, and Departure
Correct answer: Time, Environment, Distance, and Demeanor
TEDD—Time, Environment, Distance, and Demeanor—is a framework used to identify whether someone may be conducting surveillance on an individual.
Question 5: An agent at an overseas post receives a phone call from someone claiming to be from their home agency's IT department requesting login credentials. The correct response is to:
- Provide the credentials since the caller identified as a known agency department
- Verify the caller's identity through official channels before providing any information (Correct answer)
- Hang up and change all passwords immediately as a precaution
- Ask the caller to submit the request in writing via official email
Correct answer: Verify the caller's identity through official channels before providing any information
Legitimate agency IT personnel never request credentials over the phone; verifying identity through official channels prevents vishing (voice phishing) attacks.
Question 6: Which technique helps a field agent confirm they are being followed during foot movement?
- Walking faster than usual to test if the suspected follower speeds up
- Using a surveillance detection route (SDR) with choke points to confirm surveillance (Correct answer)
- Doubling back immediately on the same street to confront the suspected follower
- Entering a crowded venue and waiting to see if the same individual appears
Correct answer: Using a surveillance detection route (SDR) with choke points to confirm surveillance
A surveillance detection route uses deliberate movements through specific choke points where it would be operationally difficult for surveillance to follow undetected without revealing themselves.
Question 7: Which of the following best describes the concept of 'minimal digital footprint' for field agents?
- Limiting the use of encrypted communication to avoid drawing attention
- Reducing the amount of personally identifiable information available in open sources (Correct answer)
- Avoiding all digital communication while on assignment
- Using only agency-issued devices and deleting all personal social media accounts
Correct answer: Reducing the amount of personally identifiable information available in open sources
A minimal digital footprint means limiting the amount of personally identifiable information available to adversaries through open-source intelligence gathering.
CFA Personal Security & Situational Awareness 3
Which level of Cooper's Color Code represents a relaxed but alert state appropriate for everyday field operations?