DOD Security Fundamentals Professional Certification (SFPC) — Questions and Answers

Question 1: Which of the following is the MOST important reason social media poses an OPSEC risk for DOD personnel?

Social media violates HIPAA regulations for military medical records
Social media platforms are not authorized for government use
Personnel can unintentionally share location, schedules, and unit information that adversaries can exploit (Correct answer)
Using social media on government devices is a criminal offense

Correct answer: Personnel can unintentionally share location, schedules, and unit information that adversaries can exploit

Social media enables adversaries to collect and aggregate personal and operational information from posts, photos, and check-ins without detection.

Question 2: What is the significance of 'pattern analysis' in adversary intelligence collection against DOD units?

It is a classification process used to sort documents by sensitivity level
Pattern analysis is used exclusively in cyber threat detection
Adversaries study repeated unit behaviors to predict future actions and identify opportunities (Correct answer)
It allows commanders to predict weather patterns for mission planning

Correct answer: Adversaries study repeated unit behaviors to predict future actions and identify opportunities

Adversaries conduct pattern analysis to identify predictable behaviors, schedules, and routines that reveal critical information and exploitable vulnerabilities.

Question 3: Under DoD guidance, a Sensitive Compartmented Information Facility (SCIF) must meet construction standards outlined in which document?

NIST SP 800-171
DoD 5220.22-M
DoD 5200.01
ICD 705 (Correct answer)

Correct answer: ICD 705

Intelligence Community Directive (ICD) 705 establishes the technical and physical standards for constructing and accrediting SCIFs.

Question 4: In the OPSEC process, what does 'threat analysis' involve?

Identifying and studying adversaries who have the capability and intent to collect critical information (Correct answer)
Reviewing personnel security clearances for all unit members
Assessing the physical security of classified storage areas
Auditing computer systems for malware and vulnerabilities

Correct answer: Identifying and studying adversaries who have the capability and intent to collect critical information

Threat analysis identifies adversaries and evaluates their intelligence collection capabilities and intent to exploit critical information.

Question 5: Who is responsible for implementing OPSEC within a DOD organization?

The installation commander alone
Every member of the organization, from commanders to individual personnel (Correct answer)
Only designated OPSEC officers and security managers
The Defense Intelligence Agency on behalf of all DOD components

Correct answer: Every member of the organization, from commanders to individual personnel

OPSEC is a command responsibility that applies to every member of the organization, as each individual can either protect or inadvertently expose critical information.

Question 6: Which type of barrier is classified as an 'active vehicle barrier' under DoD anti-terrorism standards?

Earthen berm
Chain-link fence
Concrete planter
Hydraulic bollard (Correct answer)

Correct answer: Hydraulic bollard

Hydraulic bollards are active vehicle barriers because they can be raised or lowered to control vehicle access dynamically.

Question 7: What is the purpose of conducting random antiterrorism measures (RAMs) at DoD installations?

To identify employees who are late to work
To create unpredictable security patterns that make it harder for adversaries to plan and execute attacks (Correct answer)
To comply with annual audit requirements only
To test security personnel's physical fitness levels

Correct answer: To create unpredictable security patterns that make it harder for adversaries to plan and execute attacks

RAMs introduce randomness and unpredictability into security routines, denying adversaries the ability to exploit predictable patrol or access patterns.

Question 8: In Department of Defense Certified, what role does employee training play in environmental health & safety?

It primarily serves as a legal formality
It is only needed after an incident occurs
It is optional and only for new employees
It ensures all personnel can recognize, report, and respond to hazards (Correct answer)

Correct answer: It ensures all personnel can recognize, report, and respond to hazards

Training empowers all personnel to recognize hazards, follow proper procedures, and respond effectively, making it a cornerstone of any safety program.

Question 9: What is the primary purpose of a Defense Biometric Identification System (DBIDS) credential?

To track personnel leave and attendance records
To manage classified document printing privileges
To grant base access and verify identity at installation entry control points (Correct answer)
To assign network user accounts

Correct answer: To grant base access and verify identity at installation entry control points

DBIDS credentials are used at military installation entry control points to verify identity and authorize base access.

Question 10: What is an example of a physical security risk?

Theft or fire damage (Correct answer)
Data corruption.
Data breaches.
Malware attacks.

Correct answer: Theft or fire damage

Physical security risks pertain to threats that can directly harm or compromise an organization's physical assets, infrastructure, or personnel. Theft of equipment, unauthorized physical access, or damage from environmental factors like fire or flood are prime examples. These risks require physical controls such as locks, surveillance, and fire suppression systems.

Question 11: What is an example of an incident recovery action?

Reinstalling the operating system.
Restoring system backups to restore normal operations (Correct answer)
Updating the antivirus software.
Changing all user credentials.

Correct answer: Restoring system backups to restore normal operations

Incident recovery focuses on returning systems and data to their pre-incident state and resuming normal business operations. Restoring system backups is a primary recovery action because it allows organizations to quickly recover lost or corrupted data and configurations. This step is essential for minimizing downtime and ensuring business continuity after a security incident.

Question 12: What is the first step required when a classified data spillage is discovered on an unclassified DoD network?

Shut down the entire network segment permanently
Delete the file and continue normal operations
Isolate the affected system immediately and report to the ISSM/security officer (Correct answer)
Email all users to warn them about the spillage

Correct answer: Isolate the affected system immediately and report to the ISSM/security officer

The first action upon discovering classified spillage is to isolate the affected system to prevent further spread and immediately report to the ISSM or security officer for remediation.

Question 13: What document governs physical security standards for DoD installations and facilities?

DoD Directive 8570.01
DoD Instruction 5200.08 (Correct answer)
NIST SP 800-53
AR 25-2

Correct answer: DoD Instruction 5200.08

DoD Instruction 5200.08, 'Security of DoD Installations and Resources,' governs physical security standards for DoD facilities.

Question 14: What consequence can result from failing to maintain proper regulatory compliance & standards standards in Department of Defense Certified?

Loss of certification, legal penalties, and reputational damage (Correct answer)
Reduced workload for staff
Lower training requirements
Increased customer satisfaction

Correct answer: Loss of certification, legal penalties, and reputational damage

Non-compliance can result in serious consequences including certification revocation, legal penalties, fines, and significant reputational damage.

Question 15: What is the first action to take when a data breach is suspected?

Inform the entire organization.
Disconnect the affected systems from the network (Correct answer)
Begin restoring data.
Analyze the affected systems.

Correct answer: Disconnect the affected systems from the network

The immediate priority when a data breach is suspected is containment. Disconnecting affected systems from the network prevents further unauthorized access, data exfiltration, and the potential spread of malware or compromise to other systems. This crucial first step isolates the incident, limiting its scope and impact while allowing for a more controlled investigation and response.

Question 16: What is the purpose of a Privacy Impact Assessment (PIA) required by the E-Government Act and DoD policy?

To analyze how personally identifiable information (PII) is collected, used, and protected in a DoD system (Correct answer)
To certify a system for classified processing
To document the cost of a new IT system
To assess physical security vulnerabilities of a data center

Correct answer: To analyze how personally identifiable information (PII) is collected, used, and protected in a DoD system

A PIA evaluates privacy risks by documenting what PII a system collects, how it is used, shared, and protected, ensuring compliance with the Privacy Act and DoD policy.

Question 17: What is the primary goal of compliance in organizations?

To increase market share.
To improve employee satisfaction.
To reduce operational costs.
To avoid legal penalties and risks (Correct answer)

Correct answer: To avoid legal penalties and risks

The primary goal of compliance in organizations is to adhere to relevant laws, regulations, industry standards, and internal policies. Failing to comply can result in significant financial penalties, legal action, reputational damage, and loss of trust from customers and partners. Therefore, compliance efforts are fundamentally aimed at mitigating these legal and financial risks.

Question 18: What is the primary goal of incident response?

To improve network speed.
To ensure the incident is reported to the authorities.
To minimize damage and reduce recovery time and costs (Correct answer)
To prevent all future cyber attacks.

Correct answer: To minimize damage and reduce recovery time and costs

The primary goal of incident response is to effectively manage and contain security incidents to limit their negative impact on an organization. This involves quickly identifying, containing, and eradicating threats, then recovering affected systems and data efficiently. By doing so, incident response aims to minimize financial losses, operational disruption, and reputational damage.

Question 19: Which documentation is MOST critical when implementing hazard identification & assessment protocols in Department of Defense Certified?

Employee vacation schedules
Incident response plans and emergency procedures (Correct answer)
Marketing materials
Vendor contact lists

Correct answer: Incident response plans and emergency procedures

Incident response plans and emergency procedures are the most critical documentation for safety protocols, as they guide action during emergencies.

Question 20: What is the purpose of a subnet mask in a network?

It encrypts data in the network.
It provides authentication for devices.
It prevents unauthorized access.
It specifies the size of the network and distinguishes network and host portions. (Correct answer)

Correct answer: It specifies the size of the network and distinguishes network and host portions.

A subnet mask works in conjunction with an IP address to define which part of the IP address identifies the network and which part identifies the specific host within that network. By doing so, it effectively divides a larger network into smaller, more manageable subnets. This allows for efficient routing of data packets and better organization of network resources.

Question 21: What is the required response time for an alarm activation at a DoD Category I resource (e.g., arms, ammunition, explosives)?

60 minutes
5 minutes
15 minutes or less (Correct answer)
30 minutes

Correct answer: 15 minutes or less

DoD policy requires security forces to respond to alarms at Category I resources (arms, ammunition, and explosives) within 15 minutes.

Question 22: What is the MOST important factor in personal protective equipment selection for Department of Defense Certified?

Newest model available
Brand popularity
Lowest purchase price
Suitability for the intended purpose and compliance with applicable standards (Correct answer)

Correct answer: Suitability for the intended purpose and compliance with applicable standards

Equipment must be suitable for its intended purpose and comply with applicable standards to ensure safety and effectiveness.

Question 23: Which step of the OPSEC process involves weighing the potential impact of a loss of critical information against the cost of protective measures?

Analyze Vulnerabilities
Assess Risk (Correct answer)
Analyze Threats
Identify Critical Information

Correct answer: Assess Risk

Risk assessment compares the threat and vulnerability against the potential impact to determine the priority and cost-effectiveness of countermeasures.

Question 24: In Department of Defense Certified, what is the PRIMARY purpose of regular personal protective equipment maintenance?

To justify maintenance staff positions
To comply with warranty terms only
To create documentation for audits
To ensure reliability, safety, and extend useful service life (Correct answer)

Correct answer: To ensure reliability, safety, and extend useful service life

Regular maintenance ensures equipment remains reliable and safe while maximizing its useful service life.

Question 25: What is the primary purpose of Operations Security (OPSEC) in the DOD?

To establish physical perimeters around military installations
To conduct background investigations on all personnel
To deny adversaries critical information that could be used against friendly operations (Correct answer)
To encrypt classified communications between units

Correct answer: To deny adversaries critical information that could be used against friendly operations

OPSEC denies adversaries critical information about friendly operations, capabilities, and intentions that could be exploited.

Question 26: Under DoD 8570.01-M (now superseded by DoD 8140.01), what was the primary purpose of the Information Assurance Workforce Improvement Program?

To license commercial software used on DoD networks
To certify DoD contractors for physical security roles
To establish baseline IA certification requirements for personnel performing information assurance functions (Correct answer)
To manage military personnel promotions in IT roles

Correct answer: To establish baseline IA certification requirements for personnel performing information assurance functions

DoD 8570.01-M established mandatory baseline certification requirements (e.g., CompTIA Security+, CISSP) for all personnel performing IA roles on DoD networks.

Question 27: A contractor working on a DOD installation is subject to OPSEC requirements:

Never, as contractors are not subject to military regulations
Only if they hold a SECRET clearance or higher
Only during declared periods of heightened security
To the same extent as DOD civilian and military personnel when performing work for DOD (Correct answer)

Correct answer: To the same extent as DOD civilian and military personnel when performing work for DOD

Contractors performing work for DOD are subject to applicable OPSEC requirements and must protect critical information just as government employees do.

Question 28: Which training & awareness programs strategy BEST supports knowledge retention in Department of Defense Certified?

Intensive one-day workshops
Reading assignments without discussion
Spaced repetition with practical application opportunities (Correct answer)
Memorization of facts without context

Correct answer: Spaced repetition with practical application opportunities

Spaced repetition reinforces learning over time while practical application provides context that aids long-term retention.

Question 29: Which factor BEST indicates mastery of fire prevention & protection in Department of Defense Certified?

Number of certifications held
The ability to adapt knowledge and skills to varying contexts while maintaining standards (Correct answer)
Speed of task completion
Years of experience in a single setting

Correct answer: The ability to adapt knowledge and skills to varying contexts while maintaining standards

True mastery is demonstrated by the ability to apply knowledge flexibly across different contexts while consistently maintaining quality standards.

Question 30: What is the purpose of containment during an incident response?

To restore lost data.
To prevent the incident from spreading (Correct answer)
To stop the attacker from accessing backup data.
To increase system security.

Correct answer: To prevent the incident from spreading

Containment is a critical phase in incident response aimed at limiting the scope and impact of a security incident. The goal is to stop the attack from spreading further within the network or to other systems. This might involve isolating infected machines, blocking malicious IP addresses, or temporarily shutting down compromised services to prevent wider damage.

Question 31: What documentation is ESSENTIAL for personal protective equipment management in Department of Defense Certified?

Manufacturer brochures
Informal notes about repairs
Maintenance logs, calibration records, and incident reports (Correct answer)
Purchase receipts only

Correct answer: Maintenance logs, calibration records, and incident reports

Maintenance logs, calibration records, and incident reports provide a complete history that supports safety, compliance, and lifecycle management.

DOD Security Fundamentals Professional Certification (SFPC)

The SFPC measures competency in foundational DoD security principles across information security, physical security, OPSEC, industrial safety, and incident response domains required for DoD security workforce professionals.

Questions

35 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds