DOD Information Assurance & Data Protection Flashcards
6 cards from real DOD practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 DOD Information Assurance & Data Protection flashcards as text
What does 'need-to-know' mean in the context of DoD classified information access?
Answer: A determination that access to specific classified information is necessary for a person to perform their official duties
Need-to-know is a separate determination from security clearance — even cleared personnel may only access classified information required to perform their specific duties.
Under the DoD CUI Registry, which category covers technical data subject to export control laws such as ITAR?
Answer: CUI//Export Controlled
The CUI//Export Controlled designation covers technical data, including ITAR-controlled information, that is subject to U.S. export control laws and regulations.
What is the purpose of a Privacy Impact Assessment (PIA) required by the E-Government Act and DoD policy?
Answer: To analyze how personally identifiable information (PII) is collected, used, and protected in a DoD system
A PIA evaluates privacy risks by documenting what PII a system collects, how it is used, shared, and protected, ensuring compliance with the Privacy Act and DoD policy.
Which DoD Instruction establishes the DoD Privacy Program and requires a System of Records Notice (SORN) for systems containing PII?
Answer: DoD Instruction 5400.11
DoD Instruction 5400.11 establishes the DoD Privacy Program, implementing the Privacy Act of 1974 and requiring a SORN to be published in the Federal Register for systems containing PII.
What is the DoD standard for sanitizing hard drives before disposal to prevent data remanence?
Answer: NIST SP 800-88 guidelines using overwrite, degaussing, or physical destruction based on media type and data sensitivity
NIST SP 800-88, adopted by DoD policy, specifies appropriate sanitization methods — overwrite, degauss, or destroy — based on the media type and sensitivity of data previously stored.
Under DoD policy, what must occur before any classified system is connected to the Non-classified Internet Protocol Router Network (NIPRNet)?
Answer: The classified system must be completely sanitized and re-accredited to an unclassified level before any connection is permitted
Classified systems must never connect to NIPRNet without complete sanitization and re-accreditation; doing so constitutes a spillage and serious security violation.