DOD DOD Information Assurance & Data Protection 1 — Questions and Answers
Question 1: Under DoD 8570.01-M (now superseded by DoD 8140.01), what was the primary purpose of the Information Assurance Workforce Improvement Program?
- To establish baseline IA certification requirements for personnel performing information assurance functions (Correct answer)
- To manage military personnel promotions in IT roles
- To license commercial software used on DoD networks
- To certify DoD contractors for physical security roles
Correct answer: To establish baseline IA certification requirements for personnel performing information assurance functions
DoD 8570.01-M established mandatory baseline certification requirements (e.g., CompTIA Security+, CISSP) for all personnel performing IA roles on DoD networks.
Question 2: What does the term 'Controlled Unclassified Information (CUI)' mean under the DoD CUI Program?
- Information that requires safeguarding per law, regulation, or government policy but is not classified (Correct answer)
- Information classified at the Secret level
- Any information stored on a government computer
- Publicly releasable DoD information
Correct answer: Information that requires safeguarding per law, regulation, or government policy but is not classified
CUI is government-created or -possessed unclassified information that requires safeguarding under law, regulation, or policy — it is distinct from classified information.
Question 3: Which regulation requires DoD contractors who handle CUI to implement specific cybersecurity controls?
- DFARS 252.204-7012 and NIST SP 800-171 (Correct answer)
- FAR 52.204-21 only
- ITAR Part 120
- DoD Instruction 5000.02
Correct answer: DFARS 252.204-7012 and NIST SP 800-171
DFARS 252.204-7012 requires DoD contractors handling CUI to implement the 110 security controls in NIST SP 800-171 and report cyber incidents within 72 hours.
Question 4: What is the maximum classification level that may be processed on a system accredited for 'Secret' under the DoD Risk Management Framework?
- Secret (Correct answer)
- Top Secret
- Confidential
- Top Secret/SCI
Correct answer: Secret
A system accredited to process Secret information may only handle up to and including Secret data; Top Secret or SCI requires a separately accredited system.
Question 5: Under DoD policy, how long must audit logs be retained for systems processing classified information?
- At least 1 year (with 90 days online) (Correct answer)
- 30 days total
- 5 years total
- Indefinitely without deletion
Correct answer: At least 1 year (with 90 days online)
DoD requires audit logs for classified systems to be retained for at least one year, with the most recent 90 days kept online and accessible for review.
Question 6: What is 'data at rest' in the context of DoD information protection?
- Data stored on a device or media that is not actively being transmitted (Correct answer)
- Data that has been declassified and archived
- Data currently being processed by a running application
- Data transmitted over an encrypted VPN
Correct answer: Data stored on a device or media that is not actively being transmitted
Data at rest refers to inactive data stored on hard drives, SSDs, removable media, or databases — as opposed to data in transit or data in use.
DOD DOD Information Assurance & Data Protection 1
Under DoD 8570.01-M (now superseded by DoD 8140.01), what was the primary purpose of the Information Assurance Workforce Improvement Program?