DOD Information Assurance & Data Protection Flashcards
6 cards from real DOD practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 DOD Information Assurance & Data Protection flashcards as text
What DoD policy mandates the use of encryption for data at rest on mobile devices and removable media containing CUI?
Answer: DoD Instruction 8582.01 and FIPS 140-2 validated encryption
DoD Instruction 8582.01 requires FIPS 140-2 validated encryption for CUI stored on mobile devices and removable media to prevent unauthorized disclosure.
Which process formally grants a DoD IT system authorization to operate (ATO)?
Answer: The Risk Management Framework (RMF) Authorization process
The DoD Risk Management Framework (RMF) Authorization process, replacing DIACAP, is the formal process through which an Authorizing Official (AO) grants an ATO to a DoD IT system.
What is the role of the Authorizing Official (AO) in the DoD RMF process?
Answer: A senior official who accepts the residual risk of operating a system and grants or denies the Authorization to Operate
The AO is a senior DoD official accountable for the mission risk associated with operating a system and is the only person with authority to grant or deny an ATO.
Under DoD policy, which type of spillage occurs when classified information is placed on an information system accredited to handle only lower-classified or unclassified data?
Answer: Classified data spillage
Classified data spillage occurs when classified information is inadvertently or deliberately placed on a system not authorized to handle that classification level.
What is the first step required when a classified data spillage is discovered on an unclassified DoD network?
Answer: Isolate the affected system immediately and report to the ISSM/security officer
The first action upon discovering classified spillage is to isolate the affected system to prevent further spread and immediately report to the ISSM or security officer for remediation.
Which DoD program requires personnel to complete annual information assurance awareness training?
Answer: Cyber Awareness Challenge (formerly Information Assurance Awareness Training)
DoD requires all personnel with network access to annually complete the Cyber Awareness Challenge to maintain awareness of current threats, policies, and best practices.