DOD Security Fundamentals Professional Certification (SFPC) — Questions and Answers

Question 1: Which quality is MOST important for professionals conducting incident investigation & analysis in Department of Defense Certified?

Speed and efficiency above all else
Personal relationships with those being assessed
Objectivity and attention to detail (Correct answer)
Experience in unrelated fields

Correct answer: Objectivity and attention to detail

Objectivity ensures unbiased results while attention to detail captures all relevant information for accurate assessment.

Question 2: In Department of Defense Certified, what is the PRIMARY purpose of conducting regular hazard identification & assessment assessments?

To reduce operational costs
To increase employee workload
To identify potential hazards before incidents occur (Correct answer)
To satisfy insurance requirements only

Correct answer: To identify potential hazards before incidents occur

Regular safety assessments are primarily conducted to proactively identify and mitigate potential hazards before they lead to incidents or injuries.

Question 3: Which factor is MOST important when evaluating the effectiveness of hazard identification & assessment measures in Department of Defense Certified?

Volume of safety documentation produced
Number of training sessions held
Total cost of safety equipment
Reduction in incident rates over time (Correct answer)

Correct answer: Reduction in incident rates over time

The most meaningful measure of safety effectiveness is whether actual incident rates decrease over time, as this reflects real-world outcomes.

Question 4: In the OPSEC five-step process, which step comes immediately after analyzing vulnerabilities?

Identify Critical Information
Analyze Threats
Apply Countermeasures
Assess Risk (Correct answer)

Correct answer: Assess Risk

After analyzing vulnerabilities, the OPSEC process requires assessing the risk by evaluating the likelihood and impact of adversary exploitation before selecting countermeasures.

Question 5: What is the purpose of containment during an incident response?

To increase system security.
To stop the attacker from accessing backup data.
To restore lost data.
To prevent the incident from spreading (Correct answer)

Correct answer: To prevent the incident from spreading

Containment is a critical phase in incident response aimed at limiting the scope and impact of a security incident. The goal is to stop the attack from spreading further within the network or to other systems. This might involve isolating infected machines, blocking malicious IP addresses, or temporarily shutting down compromised services to prevent wider damage.

Question 6: In Department of Defense Certified, what is the PRIMARY purpose of conducting regular environmental health & safety assessments?

To identify potential hazards before incidents occur (Correct answer)
To increase employee workload
To satisfy insurance requirements only
To reduce operational costs

Correct answer: To identify potential hazards before incidents occur

Regular safety assessments are primarily conducted to proactively identify and mitigate potential hazards before they lead to incidents or injuries.

Question 7: Which documentation is MOST critical when implementing hazard identification & assessment protocols in Department of Defense Certified?

Employee vacation schedules
Vendor contact lists
Marketing materials
Incident response plans and emergency procedures (Correct answer)

Correct answer: Incident response plans and emergency procedures

Incident response plans and emergency procedures are the most critical documentation for safety protocols, as they guide action during emergencies.

Question 8: What does TCP/IP stand for?

Total Communication Protocol/Information Protocol.
Transmission Control Protocol/Internet Protocol. (Correct answer)
Transmission Communication Process/Internet Procedure.
Technical Control Program/Information Process.

Correct answer: Transmission Control Protocol/Internet Protocol.

TCP/IP is the foundational suite of communication protocols used for the internet and most computer networks. TCP (Transmission Control Protocol) manages the reliable delivery of data, ensuring packets arrive in order and without errors. IP (Internet Protocol) handles the addressing and routing of data packets across different networks.

Question 9: When adapting training & awareness programs for diverse learners in Department of Defense Certified, what is MOST important?

Reducing content to the lowest common level
Focusing only on advanced learners
Offering multiple formats and accommodating different learning needs and styles (Correct answer)
Using a single standardized approach for all learners

Correct answer: Offering multiple formats and accommodating different learning needs and styles

Offering multiple formats and accommodating different needs ensures all learners can access and benefit from the educational content.

Question 10: What does the term 'Controlled Unclassified Information (CUI)' mean under the DoD CUI Program?

Any information stored on a government computer
Publicly releasable DoD information
Information classified at the Secret level
Information that requires safeguarding per law, regulation, or government policy but is not classified (Correct answer)

Correct answer: Information that requires safeguarding per law, regulation, or government policy but is not classified

CUI is government-created or -possessed unclassified information that requires safeguarding under law, regulation, or policy — it is distinct from classified information.

Question 11: What is the MOST effective way to stay current with developments in emergency preparedness & response for Department of Defense Certified?

Reading only internal communications
Participating in professional development, industry events, and peer collaboration (Correct answer)
Relying on experience gained early in career
Following a single expert opinions

Correct answer: Participating in professional development, industry events, and peer collaboration

A multi-faceted approach including formal development, industry events, and peer collaboration provides the broadest perspective on current developments.

Question 12: What is the primary purpose of a Defense Biometric Identification System (DBIDS) credential?

To grant base access and verify identity at installation entry control points (Correct answer)
To track personnel leave and attendance records
To assign network user accounts
To manage classified document printing privileges

Correct answer: To grant base access and verify identity at installation entry control points

DBIDS credentials are used at military installation entry control points to verify identity and authorize base access.

Question 13: Which of the following is an example of an OPSEC countermeasure?

Using personal email accounts to coordinate military operations
Publishing operational schedules on a public military website
Discussing unit movements in open social media posts
Changing routine patterns and schedules to prevent predictability (Correct answer)

Correct answer: Changing routine patterns and schedules to prevent predictability

Changing routine patterns is an OPSEC countermeasure that reduces predictability and denies adversaries the ability to detect indicators.

Question 14: Under DoD anti-terrorism standards, what is the term for the minimum required distance between a potential threat and a protected asset?

Exclusion zone
Standoff distance (Correct answer)
Security perimeter
Buffer zone

Correct answer: Standoff distance

Standoff distance is the minimum required separation between a potential explosive threat and a protected asset to reduce blast and fragmentation damage.

Question 15: In OPSEC, the term 'friendly force information requirements' (FFIR) refers to:

Data submitted to OPSEC officers after mission completion
Intelligence reports requested from allied nations
Communications protocols between coalition partners
Information the commander needs about friendly forces to plan and execute operations (Correct answer)

Correct answer: Information the commander needs about friendly forces to plan and execute operations

FFIR is information a commander needs about friendly forces, and it helps identify what an adversary would also want to know about those same forces.

Question 16: What factor MOST affects the validity of incident investigation & analysis outcomes in Department of Defense Certified?

The seniority of the person conducting the assessment
The format of the assessment report
The consistency and appropriateness of assessment methods used (Correct answer)
The speed at which the assessment is completed

Correct answer: The consistency and appropriateness of assessment methods used

Validity depends primarily on using consistent, appropriate methods that actually measure what they are intended to measure.

Question 17: Which element is ESSENTIAL for an effective regulatory compliance & standards program in Department of Defense Certified?

Regular audits and continuous monitoring processes (Correct answer)
Annual review without interim checks
Compliance responsibility assigned to one individual only
Documentation stored without regular updates

Correct answer: Regular audits and continuous monitoring processes

Regular audits and continuous monitoring enable early detection of compliance gaps and ensure ongoing adherence to standards.

Question 18: What is the required response time for an alarm activation at a DoD Category I resource (e.g., arms, ammunition, explosives)?

60 minutes
30 minutes
5 minutes
15 minutes or less (Correct answer)

Correct answer: 15 minutes or less

DoD policy requires security forces to respond to alarms at Category I resources (arms, ammunition, and explosives) within 15 minutes.

Question 19: What is the role of DHCP (Dynamic Host Configuration Protocol)?

It monitors network activity.
It improves data transfer rates.
It blocks unauthorized network traffic.
It assigns IP addresses automatically. (Correct answer)

Correct answer: It assigns IP addresses automatically.

The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol (IP) networks for dynamically distributing network configuration parameters, such as IP addresses, to devices. This automation simplifies network administration by eliminating the need for manual IP address configuration for each device. DHCP ensures efficient and error-free assignment of network settings.

Question 20: What is a typical first step in an incident response plan?

Identification of the incident (Correct answer)
Recovery of lost data.
Containment of the threat.
Eradication of the threat.

Correct answer: Identification of the incident

The first crucial step in any incident response plan is the identification phase, where an organization detects and confirms that a security incident has occurred. This involves monitoring systems for anomalies, analyzing alerts, and determining the nature and scope of the potential breach. Accurate and timely identification is essential for initiating an effective response.

Question 21: What is the significance of 'pattern analysis' in adversary intelligence collection against DOD units?

Adversaries study repeated unit behaviors to predict future actions and identify opportunities (Correct answer)
It is a classification process used to sort documents by sensitivity level
Pattern analysis is used exclusively in cyber threat detection
It allows commanders to predict weather patterns for mission planning

Correct answer: Adversaries study repeated unit behaviors to predict future actions and identify opportunities

Adversaries conduct pattern analysis to identify predictable behaviors, schedules, and routines that reveal critical information and exploitable vulnerabilities.

Question 22: Which DoD physical security measure ensures that only personnel with a verified need-to-know can enter a classified vault area?

Posted guard force only
Access control list (ACL) maintained by the security manager (Correct answer)
Combination lock without any visitor log
General building key issued to all cleared personnel

Correct answer: Access control list (ACL) maintained by the security manager

A security manager-maintained access control list verifies both security clearance and need-to-know before granting vault entry, as required by DoD security policy.

Question 23: What does a Critical Information List (CIL) primarily help commanders do?

Focus OPSEC efforts by listing specific information that must be protected (Correct answer)
Identify all personnel who require security clearances
Document security violations for disciplinary action
Classify and mark all sensitive documents within a command

Correct answer: Focus OPSEC efforts by listing specific information that must be protected

A CIL focuses an organization's OPSEC efforts by specifically listing which information, if acquired by an adversary, would degrade mission success.

Question 24: In DoD facilities, who is responsible for authorizing visitor access to a restricted area?

Any commissioned officer on duty
The area's designated Security Manager or authorized government sponsor (Correct answer)
The visitor's employer
The base public affairs officer

Correct answer: The area's designated Security Manager or authorized government sponsor

The designated Security Manager or an authorized government sponsor is responsible for approving and documenting visitor access to DoD restricted areas.

Question 25: A DoD security assessment identifies a 'vulnerability' in a facility. How is vulnerability defined in physical security terms?

A weakness in a security system that could be exploited by a threat to cause harm (Correct answer)
A gap in personnel training records
An expired equipment certification
A list of known criminal activities at the installation

Correct answer: A weakness in a security system that could be exploited by a threat to cause harm

In physical security, a vulnerability is any weakness — structural, procedural, or technological — that a threat could exploit to compromise a protected asset.

Question 26: What is the consequence of non-compliance with regulations?

Increased profit margins.
Increased efficiency in business operations.
Financial penalties, loss of reputation, and legal consequences (Correct answer)
Better customer satisfaction.

Correct answer: Financial penalties, loss of reputation, and legal consequences

Non-compliance with regulations can lead to severe repercussions for an organization. These often include substantial financial penalties imposed by regulatory bodies, significant damage to the organization's public image and customer trust, and potential legal actions such as lawsuits or criminal charges. These consequences can severely impact an organization's financial stability and long-term viability.

Question 27: In the OPSEC process, what does 'threat analysis' involve?

Reviewing personnel security clearances for all unit members
Assessing the physical security of classified storage areas
Identifying and studying adversaries who have the capability and intent to collect critical information (Correct answer)
Auditing computer systems for malware and vulnerabilities

Correct answer: Identifying and studying adversaries who have the capability and intent to collect critical information

Threat analysis identifies adversaries and evaluates their intelligence collection capabilities and intent to exploit critical information.

Question 28: What is a 'vulnerability' in the context of the DOD OPSEC process?

A software flaw in a classified information system
A personnel shortage that reduces unit combat effectiveness
An unclassified document stored in a classified container
A weakness that allows an adversary to collect critical information or prevent mission accomplishment (Correct answer)

Correct answer: A weakness that allows an adversary to collect critical information or prevent mission accomplishment

An OPSEC vulnerability is a condition that allows an adversary to obtain critical information, exploit friendly activities, or compromise mission success.

Question 29: When personal protective equipment in Department of Defense Certified shows signs of wear, what is the CORRECT response?

Continue using until the next scheduled maintenance
Replace immediately without investigation
Remove from service, tag out, inspect, and repair before returning to use (Correct answer)
Reduce operating speed and continue using

Correct answer: Remove from service, tag out, inspect, and repair before returning to use

Removing equipment from service, inspecting, and repairing ensures safety and prevents minor issues from becoming major failures.

Question 30: What is the primary goal of incident response?

To minimize damage and reduce recovery time and costs (Correct answer)
To ensure the incident is reported to the authorities.
To prevent all future cyber attacks.
To improve network speed.

Correct answer: To minimize damage and reduce recovery time and costs

The primary goal of incident response is to effectively manage and contain security incidents to limit their negative impact on an organization. This involves quickly identifying, containing, and eradicating threats, then recovering affected systems and data efficiently. By doing so, incident response aims to minimize financial losses, operational disruption, and reputational damage.

Question 31: What is 'tailgating' in the context of DoD access control?

An unauthorized person following an authorized person through a secured door without presenting credentials (Correct answer)
Parking a vehicle too close to a restricted building
Conducting surveillance of an installation's perimeter
Accessing a network resource after a legitimate user's session expires

Correct answer: An unauthorized person following an authorized person through a secured door without presenting credentials

Tailgating (or piggybacking) is a physical security breach where an unauthorized person gains access by closely following an authorized individual through a controlled entry point.

Question 32: Which action BEST demonstrates a commitment to regulatory compliance & standards in Department of Defense Certified?

Following only the regulations that are convenient
Maintaining current knowledge of all applicable regulations and standards (Correct answer)
Relying on colleagues to interpret regulatory requirements
Addressing compliance issues only when audited

Correct answer: Maintaining current knowledge of all applicable regulations and standards

Actively maintaining current knowledge of applicable regulations demonstrates genuine commitment to compliance and helps prevent violations.

Question 33: What is the PRIMARY objective of fire prevention & protection within the Department of Defense Certified profession?

To limit the scope of professional activities
To ensure quality outcomes through standardized practices and continuous improvement (Correct answer)
To create additional requirements for practitioners
To maintain the status quo without change

Correct answer: To ensure quality outcomes through standardized practices and continuous improvement

The primary objective is ensuring quality outcomes through established standards while continuously improving practices and processes.

Question 34: What consequence can result from failing to maintain proper regulatory compliance & standards standards in Department of Defense Certified?

Increased customer satisfaction
Reduced workload for staff
Lower training requirements
Loss of certification, legal penalties, and reputational damage (Correct answer)

Correct answer: Loss of certification, legal penalties, and reputational damage

Non-compliance can result in serious consequences including certification revocation, legal penalties, fines, and significant reputational damage.

Question 35: What is the MOST important factor in personal protective equipment selection for Department of Defense Certified?

Newest model available
Lowest purchase price
Brand popularity
Suitability for the intended purpose and compliance with applicable standards (Correct answer)

Correct answer: Suitability for the intended purpose and compliance with applicable standards

Equipment must be suitable for its intended purpose and comply with applicable standards to ensure safety and effectiveness.

Question 36: What is 'aggregation' in the context of OPSEC?

The process of consolidating classified documents into one secure location
The collection of after-action reports from multiple operations
Grouping personnel by security clearance level for briefing purposes
Combining multiple pieces of unclassified information to deduce sensitive or critical information (Correct answer)

Correct answer: Combining multiple pieces of unclassified information to deduce sensitive or critical information

Aggregation occurs when individually harmless pieces of information are combined to reveal critical details that would otherwise remain protected.

Question 37: Under DoD guidance, a Sensitive Compartmented Information Facility (SCIF) must meet construction standards outlined in which document?

DoD 5220.22-M
ICD 705 (Correct answer)
DoD 5200.01
NIST SP 800-171

Correct answer: ICD 705

Intelligence Community Directive (ICD) 705 establishes the technical and physical standards for constructing and accrediting SCIFs.

Question 38: What does the term ‘residual risk’ mean?

Risk before controls are implemented.
Risk after implementing controls (Correct answer)
Risk during risk assessment.
Risk that is ignored.

Correct answer: Risk after implementing controls

Residual risk refers to the level of risk that remains after all planned and implemented security controls and mitigation strategies have been applied. It's the risk that an organization accepts because it cannot be entirely eliminated or the cost of further mitigation outweighs the potential benefits. Understanding residual risk is crucial for informed decision-making.

Question 39: Which of the following is a key component of a risk management strategy?

Implementing controls without identifying risks.
Identifying risks and ignoring controls.
Identifying risks and implementing controls (Correct answer)
Focusing only on financial impacts.

Correct answer: Identifying risks and implementing controls

A robust risk management strategy fundamentally involves two key steps: first, thoroughly identifying all potential risks that could impact an organization's assets or operations. Second, it requires implementing appropriate security controls and countermeasures to either eliminate, reduce, or transfer these identified risks. This proactive approach minimizes vulnerabilities and protects critical resources.

Question 40: Which factor BEST indicates mastery of fire prevention & protection in Department of Defense Certified?

The ability to adapt knowledge and skills to varying contexts while maintaining standards (Correct answer)
Years of experience in a single setting
Number of certifications held
Speed of task completion

Correct answer: The ability to adapt knowledge and skills to varying contexts while maintaining standards

True mastery is demonstrated by the ability to apply knowledge flexibly across different contexts while consistently maintaining quality standards.

Question 41: What is 'two-person integrity (TPI)' as applied to DoD physical security?

A rule requiring two authorized individuals to be present whenever accessing certain sensitive materials or areas (Correct answer)
A dual-key requirement for arming nuclear systems only
A buddy system used during physical fitness training
A policy requiring two signatures on access request forms

Correct answer: A rule requiring two authorized individuals to be present whenever accessing certain sensitive materials or areas

Two-person integrity requires that two authorized individuals are always present together when accessing certain sensitive materials or areas, preventing any single person from acting alone.

Question 42: What is the role of a security information and event management (SIEM) system in incident response?

It provides backup for lost data.
It stores logs for future reference.
It helps detect, analyze, and respond to security incidents (Correct answer)
It helps prevent phishing attacks.

Correct answer: It helps detect, analyze, and respond to security incidents

A Security Information and Event Management (SIEM) system centralizes and analyzes security logs and event data from various sources across an organization's IT infrastructure. By correlating this data, SIEM can detect suspicious activities, generate alerts, and provide insights into potential security incidents. This capability significantly enhances an organization's ability to identify, investigate, and respond to threats in real-time.

Question 43: In Department of Defense Certified, what is the PRIMARY purpose of regular personal protective equipment maintenance?

To ensure reliability, safety, and extend useful service life (Correct answer)
To comply with warranty terms only
To justify maintenance staff positions
To create documentation for audits

Correct answer: To ensure reliability, safety, and extend useful service life

Regular maintenance ensures equipment remains reliable and safe while maximizing its useful service life.

Question 44: What is the difference between IPv4 and IPv6?

IPv6 is used only for wireless connections.
IPv4 uses 128-bit addresses, and IPv6 uses 32-bit addresses.
IPv6 is more secure than IPv4.
IPv6 has a larger address space than IPv4. (Correct answer)

Correct answer: IPv6 has a larger address space than IPv4.

IPv4 uses 32-bit addresses, allowing for approximately 4.3 billion unique addresses, which are rapidly depleting. In contrast, IPv6 uses 128-bit addresses, providing an astronomically larger address space (approximately 3.4 x 10^38 unique addresses). This vast increase in available addresses is the most significant difference and a primary reason for the transition to IPv6.

Question 45: Why is it crucial for organizations to stay up-to-date with compliance regulations?

To increase sales revenue.
To reduce the organization's workload.
To maintain legal compliance and avoid penalties (Correct answer)
To ensure competitive advantage.

Correct answer: To maintain legal compliance and avoid penalties

Compliance regulations are dynamic and frequently updated or introduced, reflecting changes in technology, societal expectations, and legal landscapes. Staying current with these regulations is essential for organizations to continuously meet their legal obligations and avoid the significant financial penalties, legal liabilities, and reputational damage associated with non-compliance. It ensures the organization operates within the bounds of the law.

Question 46: What is VPN (Virtual Private Network)?

It is a software for file sharing.
It provides anonymous browsing by masking your IP address. (Correct answer)
It is a tool for increasing network speed.
It is a backup solution for cloud data.

Correct answer: It provides anonymous browsing by masking your IP address.

A Virtual Private Network (VPN) creates a secure, encrypted connection over a less secure network, like the internet. While its primary function is to provide secure remote access to private networks, a common benefit for individual users is masking their real IP address and encrypting their internet traffic. This enhances privacy and can bypass geo-restrictions, making browsing more anonymous.

Question 47: Under DoD Physical Security standards, which color designates a Controlled Area where unauthorized access is restricted but classified material is not routinely handled?

Blue
Red
Yellow (Correct answer)
Green

Correct answer: Yellow

Yellow designates a Controlled Area in DoD physical security zoning, where access is restricted but classified material is not routinely present.

Question 48: Which of the following best defines 'Critical Information' in the OPSEC process?

Personnel records and medical information for DOD employees
Specific facts about friendly intentions, capabilities, or activities that adversaries need to harm operations (Correct answer)
Any information that has been marked SECRET or higher
All information stored on classified government networks

Correct answer: Specific facts about friendly intentions, capabilities, or activities that adversaries need to harm operations

Critical Information is specific data an adversary needs to prevent mission success or cause unacceptable harm, regardless of classification level.

Question 49: An OPSEC program review should be conducted:

Exclusively by the installation security officer without unit input
Only after a confirmed security breach has occurred
Periodically and whenever significant changes occur to operations or threats (Correct answer)
Once every five years as required by federal regulation

Correct answer: Periodically and whenever significant changes occur to operations or threats

OPSEC reviews must be conducted regularly and whenever operations, personnel, or threat environments change to ensure protections remain effective.

Question 50: Which factor determines the appropriate personal protective equipment replacement schedule in Department of Defense Certified?

Budget convenience
Performance data, safety records, and total cost of ownership analysis (Correct answer)
Availability of newer models
Age alone without considering condition

Correct answer: Performance data, safety records, and total cost of ownership analysis

Replacement decisions should be based on performance data, safety records, and total cost analysis rather than arbitrary timelines.

Question 51: What is an OPSEC 'indicator' as defined in DOD doctrine?

A classified marking applied to sensitive documents
Observable actions or information that can be pieced together by an adversary to deduce critical information (Correct answer)
A formal report submitted after a security breach
A warning signal issued by a commander before an operation

Correct answer: Observable actions or information that can be pieced together by an adversary to deduce critical information

An OPSEC indicator is observable friendly actions or open-source information that can be interpreted by adversaries to derive critical information.

Question 52: Which DOD directive provides the foundational policy for the OPSEC program?

DODD 3025.18
DODD 5200.01
DODD 8570.01
DODD 5205.02 (Correct answer)

Correct answer: DODD 5205.02

DODD 5205.02 establishes DOD OPSEC policy and assigns responsibilities for implementing OPSEC programs across the department.

Question 53: What is the FIRST step in conducting a thorough incident investigation & analysis in Department of Defense Certified?

Delegating the assessment to the least experienced team member
Defining clear assessment criteria and objectives (Correct answer)
Reviewing previous assessments only
Collecting data without a plan

Correct answer: Defining clear assessment criteria and objectives

Defining clear criteria and objectives ensures the assessment is focused, consistent, and produces actionable results.

Question 54: What is an example of an incident recovery action?

Restoring system backups to restore normal operations (Correct answer)
Changing all user credentials.
Updating the antivirus software.
Reinstalling the operating system.

Correct answer: Restoring system backups to restore normal operations

Incident recovery focuses on returning systems and data to their pre-incident state and resuming normal business operations. Restoring system backups is a primary recovery action because it allows organizations to quickly recover lost or corrupted data and configurations. This step is essential for minimizing downtime and ensuring business continuity after a security incident.

Question 55: What DoD policy mandates the use of encryption for data at rest on mobile devices and removable media containing CUI?

FAR Part 12
NIST SP 800-61 incident handling guide
DoD Directive 5100.01 only
DoD Instruction 8582.01 and FIPS 140-2 validated encryption (Correct answer)

Correct answer: DoD Instruction 8582.01 and FIPS 140-2 validated encryption

DoD Instruction 8582.01 requires FIPS 140-2 validated encryption for CUI stored on mobile devices and removable media to prevent unauthorized disclosure.

Question 56: Which regulation requires DoD contractors who handle CUI to implement specific cybersecurity controls?

DoD Instruction 5000.02
ITAR Part 120
FAR 52.204-21 only
DFARS 252.204-7012 and NIST SP 800-171 (Correct answer)

Correct answer: DFARS 252.204-7012 and NIST SP 800-171

DFARS 252.204-7012 requires DoD contractors handling CUI to implement the 110 security controls in NIST SP 800-171 and report cyber incidents within 72 hours.

Question 57: In Department of Defense Certified, how does fire prevention & protection contribute to professional credibility?

By avoiding challenging situations
By using impressive terminology
By demonstrating competence, maintaining standards, and delivering consistent results (Correct answer)
Through the number of years in practice alone

Correct answer: By demonstrating competence, maintaining standards, and delivering consistent results

Professional credibility is built through demonstrated competence, consistent adherence to standards, and reliable delivery of quality results.

Question 58: In Department of Defense Certified, how should incident investigation & analysis results be communicated to stakeholders?

Verbally without written documentation
Through clear, structured reports with actionable recommendations (Correct answer)
Only when specifically requested
Using technical jargon without explanation

Correct answer: Through clear, structured reports with actionable recommendations

Clear, structured reports with actionable recommendations ensure stakeholders understand findings and can take appropriate action.

Question 59: Which factor is MOST important when evaluating the effectiveness of environmental health & safety measures in Department of Defense Certified?

Volume of safety documentation produced
Reduction in incident rates over time (Correct answer)
Total cost of safety equipment
Number of training sessions held

Correct answer: Reduction in incident rates over time

The most meaningful measure of safety effectiveness is whether actual incident rates decrease over time, as this reflects real-world outcomes.

Question 60: What is the primary goal of security risk management?

To increase security protocols only.
To make systems more complex.
To identify and assess risks, then mitigate them (Correct answer)
To reduce compliance checks.

Correct answer: To identify and assess risks, then mitigate them

The primary goal of security risk management is a systematic process of identifying potential threats and vulnerabilities to an organization's assets. Once identified, these risks are assessed for their likelihood and potential impact. The final step involves implementing appropriate controls and strategies to mitigate or reduce these risks to an acceptable level.

Question 61: How often should risk assessments be conducted?

Only when a major incident occurs.
Once during system setup.
Every five years.
Regularly or as changes occur (Correct answer)

Correct answer: Regularly or as changes occur

Risk assessments should not be a one-time event but rather an ongoing process. Regular assessments ensure that an organization's risk profile remains current and that controls are effective against evolving threats. Furthermore, any significant changes to systems, processes, or the business environment necessitate a new assessment to identify new or altered risks.

Question 62: What is the first action to take when a data breach is suspected?

Inform the entire organization.
Disconnect the affected systems from the network (Correct answer)
Begin restoring data.
Analyze the affected systems.

Correct answer: Disconnect the affected systems from the network

The immediate priority when a data breach is suspected is containment. Disconnecting affected systems from the network prevents further unauthorized access, data exfiltration, and the potential spread of malware or compromise to other systems. This crucial first step isolates the incident, limiting its scope and impact while allowing for a more controlled investigation and response.

Question 63: Why is incident documentation important?

It reduces the cost of recovery.
It helps improve security measures and compliance (Correct answer)
It provides evidence for legal action.
It allows for better network performance.

Correct answer: It helps improve security measures and compliance

Incident documentation provides a detailed record of security events, including how they occurred, what was affected, and how they were resolved. This information is crucial for analyzing vulnerabilities, identifying patterns, and implementing preventative measures to strengthen overall security. Furthermore, thorough documentation demonstrates due diligence, which is often a requirement for various regulatory compliance frameworks.

Question 64: Which process formally grants a DoD IT system authorization to operate (ATO)?

The Inspector General annual audit
The Defense Acquisition System (DAS) Milestone B review
The Certification and Accreditation Legacy process only
The Risk Management Framework (RMF) Authorization process (Correct answer)

Correct answer: The Risk Management Framework (RMF) Authorization process

The DoD Risk Management Framework (RMF) Authorization process, replacing DIACAP, is the formal process through which an Authorizing Official (AO) grants an ATO to a DoD IT system.

Question 65: Which documentation is MOST critical when implementing environmental health & safety protocols in Department of Defense Certified?

Employee vacation schedules
Incident response plans and emergency procedures (Correct answer)
Vendor contact lists
Marketing materials

Correct answer: Incident response plans and emergency procedures

Incident response plans and emergency procedures are the most critical documentation for safety protocols, as they guide action during emergencies.

Question 66: Which of the following is a key component of a compliance program?

Minimizing employee benefits.
Reducing company transparency.
Regular audits and monitoring (Correct answer)
Hiring external legal consultants.

Correct answer: Regular audits and monitoring

A robust compliance program requires continuous oversight to ensure that policies and procedures are being followed and remain effective. Regular audits and monitoring activities help identify potential non-compliance, assess the effectiveness of controls, and detect emerging risks. This proactive approach allows organizations to address issues before they escalate into serious violations.

Question 67: Which personnel are authorized to conduct a search of a privately owned vehicle (POV) on a DoD installation?

Any DoD civilian employee
The vehicle owner's supervisor
Any military police officer regardless of jurisdiction
Security forces personnel with legal authority granted by the installation commander (Correct answer)

Correct answer: Security forces personnel with legal authority granted by the installation commander

Only security forces personnel with authority explicitly delegated by the installation commander may conduct POV searches on DoD installations under applicable law.

Question 68: Which training & awareness programs strategy BEST supports knowledge retention in Department of Defense Certified?

Reading assignments without discussion
Memorization of facts without context
Spaced repetition with practical application opportunities (Correct answer)
Intensive one-day workshops

Correct answer: Spaced repetition with practical application opportunities

Spaced repetition reinforces learning over time while practical application provides context that aids long-term retention.

Question 69: What document governs physical security standards for DoD installations and facilities?

DoD Instruction 5200.08 (Correct answer)
NIST SP 800-53
AR 25-2
DoD Directive 8570.01

Correct answer: DoD Instruction 5200.08

DoD Instruction 5200.08, 'Security of DoD Installations and Resources,' governs physical security standards for DoD facilities.

Question 70: Under DoD policy, which type of spillage occurs when classified information is placed on an information system accredited to handle only lower-classified or unclassified data?

Data exfiltration
Insider threat incident
Classified data spillage (Correct answer)
System compromise

Correct answer: Classified data spillage

Classified data spillage occurs when classified information is inadvertently or deliberately placed on a system not authorized to handle that classification level.

Question 71: What is the recommended FIRST step when a safety concern is identified in a Department of Defense Certified setting?

Address it only if required by regulation
Wait for the next scheduled inspection
Document the concern and notify the appropriate supervisor (Correct answer)
Ignore it if no one has been injured

Correct answer: Document the concern and notify the appropriate supervisor

Immediately documenting the concern and notifying the supervisor ensures timely action and creates an official record for tracking and resolution.

Question 72: What is the primary purpose of Operations Security (OPSEC) in the DOD?

To conduct background investigations on all personnel
To deny adversaries critical information that could be used against friendly operations (Correct answer)
To establish physical perimeters around military installations
To encrypt classified communications between units

Correct answer: To deny adversaries critical information that could be used against friendly operations

OPSEC denies adversaries critical information about friendly operations, capabilities, and intentions that could be exploited.

Question 73: Which step of the OPSEC process involves weighing the potential impact of a loss of critical information against the cost of protective measures?

Analyze Vulnerabilities
Identify Critical Information
Analyze Threats
Assess Risk (Correct answer)

Correct answer: Assess Risk

Risk assessment compares the threat and vulnerability against the potential impact to determine the priority and cost-effectiveness of countermeasures.

Question 74: What type of lock is required on DoD Secret-level storage containers (e.g., GSA-approved filing cabinets)?

Key-operated deadbolt
Two-key dual-custody lock
Three-position dial combination lock (Correct answer)
Electronic PIN-only lock

Correct answer: Three-position dial combination lock

GSA-approved storage containers for Secret material require a three-position dial combination lock as specified in DoD 5200.01.

Question 75: Which intrusion detection system (IDS) component detects motion inside a secured room using microwave or infrared energy?

Perimeter sensor
Duress alarm
Point sensor
Volumetric sensor (Correct answer)

Correct answer: Volumetric sensor

Volumetric sensors detect motion throughout the interior volume of a room using passive infrared, microwave, or ultrasonic technology.

Question 76: How does ongoing professional development support regulatory compliance & standards in Department of Defense Certified?

It only benefits entry-level professionals
It replaces the need for formal compliance audits
It is irrelevant to compliance outcomes
It keeps professionals informed of evolving standards and best practices (Correct answer)

Correct answer: It keeps professionals informed of evolving standards and best practices

Ongoing professional development ensures that practitioners stay current with evolving regulations, standards, and best practices in their field.

Question 77: What action is required when a DoD Common Access Card (CAC) is lost or stolen?

Notify the cardholder's supervisor within 72 hours
Wait 30 days before reporting to determine if it is truly lost
Report only if the card is believed to be stolen, not simply lost
Report immediately to the security office and revoke the certificate through RAPIDS (Correct answer)

Correct answer: Report immediately to the security office and revoke the certificate through RAPIDS

A lost or stolen CAC must be reported immediately so that PKI certificates can be revoked through the Real-time Automated Personnel Identification System (RAPIDS) to prevent unauthorized use.

Question 78: What is the DoD standard for sanitizing hard drives before disposal to prevent data remanence?

Removing the drive label and donating it
NIST SP 800-88 guidelines using overwrite, degaussing, or physical destruction based on media type and data sensitivity (Correct answer)
Overwriting once with zeros for all classification levels
Simply deleting all files and formatting the drive

Correct answer: NIST SP 800-88 guidelines using overwrite, degaussing, or physical destruction based on media type and data sensitivity

NIST SP 800-88, adopted by DoD policy, specifies appropriate sanitization methods — overwrite, degauss, or destroy — based on the media type and sensitivity of data previously stored.

Question 79: Under the DoD CUI Registry, which category covers technical data subject to export control laws such as ITAR?

CUI//PROPIN
CUI//FOUO
CUI//LES
CUI//Export Controlled (Correct answer)

Correct answer: CUI//Export Controlled

The CUI//Export Controlled designation covers technical data, including ITAR-controlled information, that is subject to U.S. export control laws and regulations.

Question 80: Which approach is used in risk management for controlling identified risks?

By creating more vulnerabilities.
By ignoring high-impact risks.
By transferring, avoiding, or controlling risks (Correct answer)
By only focusing on low-risk areas.

Correct answer: By transferring, avoiding, or controlling risks

Risk management employs several strategies to handle identified risks. Risk transfer involves shifting the financial burden to another party, often through insurance. Risk avoidance means eliminating the activity that creates the risk. Risk control (or mitigation) involves implementing measures to reduce the likelihood or impact of the risk.

Question 81: What is DNS (Domain Name System)?

It monitors network traffic.
It assigns IP addresses to devices.
It manages web traffic.
It translates domain names into IP addresses. (Correct answer)

Correct answer: It translates domain names into IP addresses.

The Domain Name System (DNS) acts like the internet's phonebook, translating human-readable domain names (like google.com) into machine-readable IP addresses (like 172.217.160.142). This translation is crucial because computers communicate using IP addresses, while humans find domain names easier to remember. Without DNS, users would have to type complex IP addresses to access websites.

Question 82: What is the minimum standoff distance required around DoD buildings under UFC 4-010-01 for vehicle-borne IED protection?

50 feet (15 meters)
82 feet (25 meters) (Correct answer)
25 feet (8 meters)
100 feet (30 meters)

Correct answer: 82 feet (25 meters)

UFC 4-010-01 establishes 82 feet (25 meters) as the minimum standoff distance for DoD buildings to mitigate vehicle-borne IED threats.

Question 83: In Department of Defense Certified, what role does employee training play in hazard identification & assessment?

It is only needed after an incident occurs
It is optional and only for new employees
It ensures all personnel can recognize, report, and respond to hazards (Correct answer)
It primarily serves as a legal formality

Correct answer: It ensures all personnel can recognize, report, and respond to hazards

Training empowers all personnel to recognize hazards, follow proper procedures, and respond effectively, making it a cornerstone of any safety program.

Question 84: Which practice BEST ensures safe personal protective equipment operation in Department of Defense Certified?

Experience-based operation without consulting manuals
Operating equipment only at maximum capacity
Pre-use inspection combined with proper training and adherence to procedures (Correct answer)
Maintenance only when equipment fails

Correct answer: Pre-use inspection combined with proper training and adherence to procedures

Pre-use inspections catch problems early, proper training prevents misuse, and following procedures ensures consistent safe operation.

Question 85: A unit publishes its training schedule on a public Facebook page. In OPSEC terms, this is an example of a(n):

Classified information spillage
Authorized information release
OPSEC indicator and potential vulnerability (Correct answer)
Required transparency measure under FOIA

Correct answer: OPSEC indicator and potential vulnerability

Posting operational schedules publicly creates observable indicators that adversaries can exploit to predict and counter unit activities.

Question 86: What is the purpose of conducting random antiterrorism measures (RAMs) at DoD installations?

To comply with annual audit requirements only
To identify employees who are late to work
To create unpredictable security patterns that make it harder for adversaries to plan and execute attacks (Correct answer)
To test security personnel's physical fitness levels

Correct answer: To create unpredictable security patterns that make it harder for adversaries to plan and execute attacks

RAMs introduce randomness and unpredictability into security routines, denying adversaries the ability to exploit predictable patrol or access patterns.

Question 87: How many steps are in the standard DOD OPSEC process?

4
7
3
5 (Correct answer)

Correct answer: 5

The DOD OPSEC process consists of five steps: identify critical information, analyze threats, analyze vulnerabilities, assess risk, and apply countermeasures.

Question 88: What documentation is ESSENTIAL for personal protective equipment management in Department of Defense Certified?

Manufacturer brochures
Purchase receipts only
Maintenance logs, calibration records, and incident reports (Correct answer)
Informal notes about repairs

Correct answer: Maintenance logs, calibration records, and incident reports

Maintenance logs, calibration records, and incident reports provide a complete history that supports safety, compliance, and lifecycle management.

Question 89: Which DoD program requires personnel to complete annual information assurance awareness training?

Security Assistant Training Program
Cyber Awareness Challenge (formerly Information Assurance Awareness Training) (Correct answer)
Base Access Training Program
Joint Staff Orientation Program

Correct answer: Cyber Awareness Challenge (formerly Information Assurance Awareness Training)

DoD requires all personnel with network access to annually complete the Cyber Awareness Challenge to maintain awareness of current threats, policies, and best practices.

Question 90: Which competency is MOST essential for professionals working in emergency preparedness & response in Department of Defense Certified?

Seniority-based decision making
Memorization of procedures without understanding principles
Critical thinking combined with practical application of knowledge (Correct answer)
Speed of task completion above all else

Correct answer: Critical thinking combined with practical application of knowledge

Critical thinking allows professionals to apply knowledge effectively in varied situations, leading to better outcomes than rote procedures.

Question 91: Who is responsible for implementing OPSEC within a DOD organization?

The installation commander alone
Only designated OPSEC officers and security managers
Every member of the organization, from commanders to individual personnel (Correct answer)
The Defense Intelligence Agency on behalf of all DOD components

Correct answer: Every member of the organization, from commanders to individual personnel

OPSEC is a command responsibility that applies to every member of the organization, as each individual can either protect or inadvertently expose critical information.

Question 92: Which of the following is a common compliance regulation for organizations?

General Data Protection Regulation (GDPR) (Correct answer)
Local Taxation Policies.
Labor Contract Negotiations.
International Tax Guidelines.

Correct answer: General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR) is a prominent and widely recognized data privacy and security law enacted by the European Union. It imposes strict rules on how organizations handle and protect the personal data of individuals within the EU and European Economic Area. Many organizations globally must comply with GDPR if they process data of EU residents, making it a common and significant compliance regulation.

Question 93: When conducting a hazard identification & assessment review in Department of Defense Certified, which approach yields the BEST results?

Focusing exclusively on equipment checks
Systematic analysis using established frameworks and checklists (Correct answer)
Informal observation without documentation
Reviewing only incidents from the past month

Correct answer: Systematic analysis using established frameworks and checklists

Systematic analysis using established frameworks ensures comprehensive coverage of all potential risks and provides consistent, reliable results.

Question 94: What is the maximum classification level that may be processed on a system accredited for 'Secret' under the DoD Risk Management Framework?

Top Secret/SCI
Secret (Correct answer)
Confidential
Top Secret

Correct answer: Secret

A system accredited to process Secret information may only handle up to and including Secret data; Top Secret or SCI requires a separately accredited system.

Question 95: What is the role of the Authorizing Official (AO) in the DoD RMF process?

A contractor who writes the System Security Plan
An auditor who reviews past incidents
A senior official who accepts the residual risk of operating a system and grants or denies the Authorization to Operate (Correct answer)
A technical engineer who implements security controls

Correct answer: A senior official who accepts the residual risk of operating a system and grants or denies the Authorization to Operate

The AO is a senior DoD official accountable for the mission risk associated with operating a system and is the only person with authority to grant or deny an ATO.

Question 96: Which of the following is the MOST important reason social media poses an OPSEC risk for DOD personnel?

Social media platforms are not authorized for government use
Personnel can unintentionally share location, schedules, and unit information that adversaries can exploit (Correct answer)
Social media violates HIPAA regulations for military medical records
Using social media on government devices is a criminal offense

Correct answer: Personnel can unintentionally share location, schedules, and unit information that adversaries can exploit

Social media enables adversaries to collect and aggregate personal and operational information from posts, photos, and check-ins without detection.

DOD Security Fundamentals Professional Certification (SFPC)

The SFPC measures competency in foundational DoD security principles across information security, physical security, OPSEC, industrial safety, and incident response domains required for DoD security workforce professionals.

Questions

135 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds