DOD DOD Information Assurance & Data Protection 2

Question 1

What DoD policy mandates the use of encryption for data at rest on mobile devices and removable media containing CUI?

Accepted Answer

DoD Instruction 8582.01 and FIPS 140-2 validated encryption

Answer

DoD Instruction 8582.01 requires FIPS 140-2 validated encryption for CUI stored on mobile devices and removable media to prevent unauthorized disclosure.

Question 2

Which process formally grants a DoD IT system authorization to operate (ATO)?

Accepted Answer

The Risk Management Framework (RMF) Authorization process

Answer

The DoD Risk Management Framework (RMF) Authorization process, replacing DIACAP, is the formal process through which an Authorizing Official (AO) grants an ATO to a DoD IT system.

Question 3

What is the role of the Authorizing Official (AO) in the DoD RMF process?

Accepted Answer

A senior official who accepts the residual risk of operating a system and grants or denies the Authorization to Operate

Answer

The AO is a senior DoD official accountable for the mission risk associated with operating a system and is the only person with authority to grant or deny an ATO.

Question 4

Under DoD policy, which type of spillage occurs when classified information is placed on an information system accredited to handle only lower-classified or unclassified data?

Accepted Answer

Classified data spillage

Answer

Classified data spillage occurs when classified information is inadvertently or deliberately placed on a system not authorized to handle that classification level.

Question 5

What is the first step required when a classified data spillage is discovered on an unclassified DoD network?

Accepted Answer

Isolate the affected system immediately and report to the ISSM/security officer

Answer

The first action upon discovering classified spillage is to isolate the affected system to prevent further spread and immediately report to the ISSM or security officer for remediation.

DOD - Department of Defense Certified Practice Test

DOD - Department of Defense Certified Practice Test

DOD DOD Information Assurance & Data Protection 2