DOD DOD Information Assurance & Data Protection

Question 1

Under DoD 8570.01-M (now superseded by DoD 8140.01), what was the primary purpose of the Information Assurance Workforce Improvement Program?

Accepted Answer

To establish baseline IA certification requirements for personnel performing information assurance functions

Answer

DoD 8570.01-M established mandatory baseline certification requirements (e.g., CompTIA Security+, CISSP) for all personnel performing IA roles on DoD networks.

Question 2

What does the term 'Controlled Unclassified Information (CUI)' mean under the DoD CUI Program?

Accepted Answer

Information that requires safeguarding per law, regulation, or government policy but is not classified

Answer

CUI is government-created or -possessed unclassified information that requires safeguarding under law, regulation, or policy — it is distinct from classified information.

Question 3

Which regulation requires DoD contractors who handle CUI to implement specific cybersecurity controls?

Accepted Answer

DFARS 252.204-7012 and NIST SP 800-171

Answer

DFARS 252.204-7012 requires DoD contractors handling CUI to implement the 110 security controls in NIST SP 800-171 and report cyber incidents within 72 hours.

Question 4

What is the maximum classification level that may be processed on a system accredited for 'Secret' under the DoD Risk Management Framework?

Accepted Answer

Secret

Answer

A system accredited to process Secret information may only handle up to and including Secret data; Top Secret or SCI requires a separately accredited system.

Question 5

Under DoD policy, how long must audit logs be retained for systems processing classified information?

Accepted Answer

At least 1 year (with 90 days online)

Answer

DoD requires audit logs for classified systems to be retained for at least one year, with the most recent 90 days kept online and accessible for review.

DOD - Department of Defense Certified Practice Test

DOD - Department of Defense Certified Practice Test

DOD DOD Information Assurance & Data Protection