Security Fundamentals Professional Certification (SFPC) — Questions and Answers

Question 1: A derivative classifier is building a new document from three classified sources. Each source has a different declassification instruction: 25X1 with a date, a specific date 10 years out, and a specific date 20 years out. Which declassification instruction should the new document carry?

The date that applies to the largest portion of the new document's content
A new date set by the derivative classifier, no more than 10 years out
The most restrictive instruction, the one giving the longest period of protection (Correct answer)
The earliest declassification date, to avoid over-classification

Correct answer: The most restrictive instruction, the one giving the longest period of protection

When derivatively classified material comes from multiple sources with different declassification instructions, the classifier carries forward the most restrictive one, which is the instruction with the longest period of classification. Exemptions such as 25X1 count in that comparison. Derivative classifiers have no authority to set their own declassification dates, and choosing the earliest date could release still-sensitive information too soon.

Question 2: An activity must pick between a GSA Class 5 and a GSA Class 6 container to store classified documents in an area where forced entry is a realistic threat. Which statement correctly tells them apart?

Both classes give 30 minutes of surreptitious-entry protection, but only Class 5 also gives forced-entry protection (Correct answer)
Class 6 gives more surreptitious-entry protection than Class 5, so it is preferred in high-threat areas
Class 5 is approved only for weapons and Class 6 only for documents, so Class 6 is the only choice
Both classes give the same forced-entry protection and differ only in fire resistance

Correct answer: Both classes give 30 minutes of surreptitious-entry protection, but only Class 5 also gives forced-entry protection

Class 5 and Class 6 containers both resist surreptitious entry for 30 minutes. Class 5 also resists forced entry for a set time, while Class 6 has no forced-entry rating. Where forced entry is a realistic threat, a Class 5 container is the right choice. Class 6 does not offer more surreptitious-entry protection, both classes can hold documents, and fire resistance is not what separates them.

Question 3: What are the 'Adjudicative Guidelines' used for?

Evaluating contractor performance
Establishing security clearance processing timelines
Determining salary levels for security positions
Evaluating personnel security investigation results to determine eligibility for access to classified information (Correct answer)

Correct answer: Evaluating personnel security investigation results to determine eligibility for access to classified information

The Adjudicative Guidelines provide the criteria used to evaluate investigation results and determine whether granting or continuing a security clearance is consistent with national security interests.

Question 4: A cleared company is setting up the insider threat program required by 32 CFR Part 117. Which statement about the Insider Threat Program Senior Official (ITPSO) is correct?

The ITPSO must be the FSO, because the two roles cannot be separated
The ITPSO must be a U.S. citizen employee and senior official of the company, cleared to the level of the FCL as part of the key management personnel (Correct answer)
The ITPSO needs a clearance only if the company stores classified material on site
The ITPSO can be an outside consultant, as long as the consultant holds a Secret eligibility determination

Correct answer: The ITPSO must be a U.S. citizen employee and senior official of the company, cleared to the level of the FCL as part of the key management personnel

The ITPSO must be a U.S. citizen employee and a senior official of the company. The ITPSO is one of the key management personnel (KMP) who must be cleared in connection with the FCL. One person may hold both the ITPSO and FSO roles, but that is not required. An outside consultant cannot fill a KMP role, and the clearance requirement applies whether or not the company stores classified material on site.

Question 5: Executive Order 13587 created the National Insider Threat Task Force (NITTF). Who co-chairs the NITTF?

The Secretary of Defense and the Director of National Intelligence
The Secretary of Homeland Security and the Attorney General
The Director of the FBI and the Director of the National Counterintelligence and Security Center
The Attorney General and the Director of National Intelligence (Correct answer)

Correct answer: The Attorney General and the Director of National Intelligence

EO 13587 (October 2011) set up the NITTF under the joint leadership of the Attorney General and the Director of National Intelligence. In practice the FBI and NCSC staff it, which is why those agencies look like plausible distractors. They are not the named co-chairs.

Question 6: A DoD component is categorizing a new national security system (NSS) during the RMF Categorize step. Which issuance does it use to set separate impact values for confidentiality, integrity and availability, and to select the starting control baseline?

CNSSI No. 1253, which builds on NIST categorization guidance but is tailored for national security systems (Correct answer)
NIST SP 800-53A, because it defines the assessment procedures tied to each impact level
FIPS 199 by itself, because it is the federal standard for categorizing every information system
DoDM 5200.01, because it sets the classification levels that determine system impact

Correct answer: CNSSI No. 1253, which builds on NIST categorization guidance but is tailored for national security systems

National security systems are categorized under CNSSI No. 1253. It draws on FIPS 199 and NIST SP 800-60, but it keeps separate low, moderate and high values for confidentiality, integrity and availability instead of using a single 'high-water mark', and it maps those values to control baselines. SP 800-53A covers assessment procedures, not categorization. DoDM 5200.01 covers classifying information, which is not the same as categorizing a system's impact.

Question 7: An organization is implementing a risk management program. After identifying potential threats and vulnerabilities, what is the logical next step in the risk management process?

Conduct a risk analysis. (Correct answer)
Monitor and review the risks.
Create an incident response plan.
Implement security controls.

Correct answer: Conduct a risk analysis.

The standard risk management process involves identifying assets, threats, and vulnerabilities, and then analyzing the risk. Risk analysis involves evaluating the likelihood of a threat exploiting a vulnerability and the potential impact it would have on the organization. This analysis is crucial before deciding which controls to implement.

Question 8: For months, a contractor facility that supports a classified program has run one day shift with a predictable parking-lot count. For three weeks before a program milestone, the lot is full at night and food deliveries arrive around 2300. Nothing about the program itself is posted publicly. Which characteristic of an OPSEC indicator does this change in activity mainly illustrate?

Signature, because the night-shift activity is unique enough to identify this specific program
Association, because the activity has to be linked to outside reporting before it means anything
Exposure, because the indicator appears only once and therefore cannot be analyzed
Contrast, because the activity is a noticeable departure from the facility's established pattern (Correct answer)

Correct answer: Contrast, because the activity is a noticeable departure from the facility's established pattern

Contrast is about change from an established profile, meaning any difference between normal, expected activity and what is happening now. An adversary may not know what the program is, but a sudden break from the baseline tells them something is happening and when. Signature is what makes an indicator identifiable or unique. Association links an indicator to other information. Exposure covers when, how often, and how long an indicator is seen. Here the activity has been visible for weeks, so the exposure option's claim that it appears only once is also wrong.

Question 9: A GSA-approved security container is emptied and permanently taken out of service before being sent to another organization. What must happen to its combination lock?

Leave the current combination and send the SF 700 with the container
Reset it to 10-20-30 so the receiving activity can identify it
Remove and destroy the lock, because it cannot be reused
Reset it to the standard combination 50-25-50 (Correct answer)

Correct answer: Reset it to the standard combination 50-25-50

When a container is taken out of service, the combination lock is reset to the factory standard combination of 50-25-50. This keeps the old combination from being exposed and lets the next user set a new one. Sending the SF 700 with the container would hand over the combination, and the lock does not have to be destroyed.

Question 10: A cleared defense contractor employee receives a Statement of Reasons and later has their eligibility denied. Under the industrial security due process framework, where does the employee get a personal appearance or hearing and appeal the decision?

The Merit Systems Protection Board (MSPB)
The Facility Security Officer and the company's senior management official
A DOHA Administrative Judge hearing, with appeal to the DOHA Appeal Board (Correct answer)
The DoD Personnel Security Appeals Board (PSAB) after a DOHA personal appearance

Correct answer: A DOHA Administrative Judge hearing, with appeal to the DOHA Appeal Board

Contractor employees in the NISP get due process through the Defense Office of Hearings and Appeals (DOHA). That means a hearing before a DOHA Administrative Judge, with appeal to the DOHA Appeal Board. The PSAB process is for DoD civilian employees and military members. The MSPB handles adverse employment actions, not clearance merits. The FSO has no adjudicative authority.

Question 11: Under SEAD 3 reporting requirements, a cleared employee who lives near the border makes a short, unplanned day trip into Mexico. What is the employee's reporting obligation?

The employee must report the trip after returning, within five business days (Correct answer)
The trip has to be reported only if the employee had contact with a foreign national during it
No report is needed, because day trips to contiguous countries are exempt from foreign travel reporting
The employee must get written approval from the agency head before crossing, even for unplanned travel

Correct answer: The employee must report the trip after returning, within five business days

SEAD 3 generally requires covered individuals to report unofficial foreign travel before they go. It makes a specific exception for unplanned day trips to Canada or Mexico, which must be reported within five business days after return. The trip is still reportable, so it is not exempt. Prior approval from the agency head is not the standard. The reporting duty does not depend on whether foreign contacts happened, although such contacts may have their own separate reporting rules.

Question 12: What is the role of the 'Authorizing Official' (AO) in the NIST RMF?

A technical specialist who implements security controls
An external auditor who certifies system security
A senior official who has the authority and accountability to accept risk on behalf of the organization and grant ATOs (Correct answer)
A contractor who manages system operations

Correct answer: A senior official who has the authority and accountability to accept risk on behalf of the organization and grant ATOs

The AO is a senior official with the authority and accountability to authorize a system to operate by accepting the risk associated with its operation.

Question 13: A cleared employee sees a news website publish what looks like a classified document from a program their company supports. A coworker says it's 'public now,' so it can be discussed openly. What is the correct position?

The information can be discussed internally but not with outsiders, because its classification is downgraded one level.
The coworker is right. Unauthorized public release declassifies the information automatically.
The information becomes unclassified only for employees who were not briefed on the program.
The information stays classified. Employees should not confirm, deny, or spread it further, and the matter should be reported through the FSO to the CSA. (Correct answer)

Correct answer: The information stays classified. Employees should not confirm, deny, or spread it further, and the matter should be reported through the FSO to the CSA.

Under EO 13526 Sec. 1.1(c), classified information is not automatically declassified because of an unauthorized disclosure. Cleared personnel must keep protecting it: no confirming, denying, discussing, or downloading it on unclassified systems. The suspected compromise should be reported through the FSO to the CSA.

Question 14: What is the purpose of industrial security counterintelligence briefings?

To teach employees foreign languages
To brief employees on international travel packages
To make cleared employees aware of foreign intelligence collection threats and how to respond (Correct answer)
To provide employees with intelligence about foreign companies

Correct answer: To make cleared employees aware of foreign intelligence collection threats and how to respond

Counterintelligence briefings make cleared personnel aware of the threats posed by foreign intelligence services and other adversaries, and how to recognize and report suspicious contacts or activities.

Question 15: A security manager is implementing Crime Prevention Through Environmental Design (CPTED) principles for a new corporate campus. Which of the following measures BEST exemplifies the principle of 'Natural Surveillance'?

Issuing key cards to all employees to restrict access to specific buildings.
Using thorny bushes below ground-floor windows and ensuring building entrances are well-lit and visible from the street. (Correct answer)
Posting signs that clearly define the property line and designate private areas.
Installing a high-perimeter fence with a single, guarded entry point.

Correct answer: Using thorny bushes below ground-floor windows and ensuring building entrances are well-lit and visible from the street.

Natural Surveillance, a core principle of CPTED, focuses on designing the environment to maximize visibility and the perception that people can be seen. Placing thorny bushes makes it difficult for potential intruders to hide near windows, and ensuring entrances are well-lit and visible from public areas increases the chances that illicit activities will be observed by employees, visitors, or passersby.

Question 16: A newly hired contractor will not require access to classified information but will have access to government facilities and IT systems. What is the minimum personnel security process this individual must undergo?

A favorable suitability or fitness determination. (Correct answer)
An interview with the Director of National Intelligence.
Enrollment in a polygraph examination program.
A comprehensive Single Scope Background Investigation (SSBI).

Correct answer: A favorable suitability or fitness determination.

Personnel vetting determines an individual's suitability for government employment or fitness to work as a contractor, even if access to classified information is not required. This process ensures the individual is reliable and trustworthy enough to be granted access to government resources like facilities and IT systems.

Question 17: Top Secret material is stored in a GSA-approved container inside a facility that has no intrusion detection system (IDS). The required supplemental control is cleared guards or duty personnel inspecting the container. How often must they inspect it?

Once per shift, as long as the SF 702 is annotated
Every 8 hours
Every 2 hours (Correct answer)
Every 4 hours

Correct answer: Every 2 hours

Under DoDM 5200.01 Volume 3, Top Secret in a GSA-approved container needs supplemental controls. Without IDS (which requires a response force within 15 minutes), cleared guards or duty personnel must inspect the container every 2 hours. The 4-hour interval applies to Secret material in areas where supplemental controls are required.

Question 18: A cleared company wants to keep some key management personnel (KMP) from needing personnel clearances (PCLs) by using an exclusion resolution of the board. Which position CANNOT be excluded this way?

The Insider Threat Program Senior Official (ITPSO) (Correct answer)
The Vice President of Human Resources
The corporate Treasurer, who has no involvement in classified contracts
An outside member of the board of directors

Correct answer: The Insider Threat Program Senior Official (ITPSO)

Under 32 CFR 117.9, the senior management official, the FSO, and the ITPSO must always be cleared to the level of the facility clearance (FCL). Other officers, directors, and KMP may be excluded by a formal board action if they won't need access to classified information and can be kept from affecting the classified contracts.

Question 19: A cleared employee who is NOT an original classification authority (OCA) produces new information. The employee believes it meets the standards for classification, but no guide or source document covers it. Under EO 13526, what is the correct action?

Release it as unclassified, because only an OCA can make the information classified
Protect it as though classified and send it right away to an agency with OCA and subject-matter interest, which must decide on classification within 30 days (Correct answer)
Hold it at Top Secret until the next annual review of the security classification guide
Mark it at the level they believe is appropriate and treat that as a final, binding derivative decision

Correct answer: Protect it as though classified and send it right away to an agency with OCA and subject-matter interest, which must decide on classification within 30 days

EO 13526 Sec. 1.3(e) says that someone without classification authority who originates information they believe should be classified must protect it in line with the order and its implementing directives. They then send it promptly to an agency with both the appropriate subject-matter interest and classification authority, and that agency decides within 30 days. This is sometimes called tentative classification. It protects the information without giving a non-OCA the power to classify it permanently.

Question 20: A program manager wants to designate an internal audit report as CUI. Under 32 CFR Part 2002, which of these is an IMPERMISSIBLE reason for the designation?

The report contains export-controlled technical data
The report includes privacy information about named employees
The report contains proprietary contractor data protected under a federal statute
The report reveals a cost overrun that would embarrass the program office, and CUI marking would discourage its release (Correct answer)

Correct answer: The report reveals a cost overrun that would embarrass the program office, and CUI marking would discourage its release

32 CFR 2002.20 prohibits designating information as CUI to conceal violations of law, inefficiency, or administrative error; to prevent embarrassment to a person, organization, or agency; to prevent open competition; or to control information that doesn't need safeguarding under a law, regulation, or government-wide policy. Proprietary, privacy, and export-controlled data are all legitimate CUI categories in the CUI Registry.

Question 21: Which of the following is a key component of the Trusted Workforce 2.0 initiative, designed to modernize the personnel security process?

Elimination of self-reporting requirements for security clearance holders.
Continuous Vetting/Evaluation to monitor for new risk information in near real-time. (Correct answer)
A one-time, comprehensive background investigation with no follow-up.
Periodic reinvestigations conducted every ten years for all clearance levels.

Correct answer: Continuous Vetting/Evaluation to monitor for new risk information in near real-time.

Continuous Vetting (CV) or Continuous Evaluation (CE) is a cornerstone of the Trusted Workforce 2.0 reform. It replaces the traditional periodic reinvestigation model with ongoing, automated checks of various data sources to identify potential security risks as they arise.

Question 22: What is 'identity theft' and why is it a personal security concern?

Assuming a false identity for undercover operations
The fraudulent acquisition and use of another person's private identifying information (Correct answer)
Changing one's legal name
Using a nickname professionally

Correct answer: The fraudulent acquisition and use of another person's private identifying information

Identity theft involves using another person's personal information without their consent, typically for financial gain, and can severely impact the victim's reputation and security clearance.

Question 23: A facility uses a physical access control system (PACS) where employees present a key fob to a reader to unlock a door. Which components are essential for this system to function?

Biometric scanner, server, and a security guard.
Motion detector, alarm, and a keypad.
Surveillance camera, turnstile, and a visitor log.
Credential, reader, and a control panel. (Correct answer)

Correct answer: Credential, reader, and a control panel.

A basic electronic physical access control system requires a credential (the key fob), a reader to interpret the credential's data, and a control panel that makes the access decision and signals the lock to open. The server stores the access rules and logs, and the control panel communicates with it, but the core interaction at the access point involves the credential, reader, and controller.

Question 24: SEAD 4 lists the whole-person factors an adjudicator weighs when looking at a person's past conduct. Which of these is NOT one of those listed factors?

The potential for pressure, coercion, exploitation, or duress
The voluntariness of the person's participation
The person's age and maturity at the time of the conduct
The seniority and mission importance of the position the person holds or will hold (Correct answer)

Correct answer: The seniority and mission importance of the position the person holds or will hold

SEAD 4 lists nine factors: the nature, extent, and seriousness of the conduct; its circumstances; how often and how recently it happened; age and maturity at the time; voluntariness; rehabilitation and other lasting behavioral changes; motivation; potential for pressure or coercion; and the likelihood that it will continue or happen again. How senior or important the person's job is does not appear on the list. The same standards apply to everyone, and doubts are resolved in favor of national security no matter how valuable the person is.

Question 25: Definition of BIOMETRIC: <br> "Measurable Physical characteristics or personal behavior traits used to recognize the identity, or verify the claimed identity. Fingerprints, Iris, handwriting, voice recognition."

True (Correct answer)
False

Correct answer: True

An accidental disclosure of classified information to a foreign entity, especially if facilitated by technology, falls under the broad guidelines governing the 'Use of Information Technology Systems.' These guidelines encompass policies and procedures for handling, processing, and transmitting classified data on IT systems, and any breach constitutes a violation of these protocols.

Question 26: A DoD civilian position requires access to Top Secret collateral information but no SCI access, and the job has no other special duties. What position sensitivity designation and investigation tier apply?

Critical-Sensitive, Tier 5 (Correct answer)
Noncritical-Sensitive, Tier 3
Special-Sensitive, Tier 5
Critical-Sensitive, Tier 3

Correct answer: Critical-Sensitive, Tier 5

Critical-Sensitive positions are those that could cause exceptionally grave damage to national security, which is the Top Secret standard. They require a Tier 5 investigation. Special-Sensitive is reserved for positions with potential for inestimable damage, such as SCI access. Noncritical-Sensitive positions (Secret or Confidential) use Tier 3.

Question 27: A DoD activity wants to openly store SECRET material in a secure room that has no intrusion detection system (IDS). Under DoD Manual 5200.01, Volume 3, which supplemental control would allow this?

Cleared security force personnel inspect the room at least once every 4 hours (Correct answer)
Cleared security force personnel inspect the room at least once every 8 hours
An end-of-day security check (SF 701) is completed and the door is fitted with an FF-L-2740 lock
CCTV records the entrance continuously and the footage is reviewed the next business day

Correct answer: Cleared security force personnel inspect the room at least once every 4 hours

For open storage of SECRET in a secure room, the supplemental control is either an IDS with a response time of 30 minutes or less, or inspections by cleared security force personnel every 4 hours. An 8-hour interval is too long. An SF 701 check plus a compliant lock is a baseline requirement, not a supplemental control. CCTV that is reviewed later does not give timely detection and response.

Question 28: A cleared company is acquired by a foreign parent that will hold majority ownership and keep effective control. DCSA mitigates the FOCI with a Special Security Agreement (SSA). The company's new contract requires access to Top Secret and COMSEC information. What additional step is required before access can be granted?

A National Interest Determination (NID) must be approved for the proscribed information (Correct answer)
The foreign parent must sign a Board Resolution excluding its representatives from classified access
The foreign parent's government must sign a reciprocal security agreement with the U.S.
The company must convert the SSA into a Proxy Agreement before any classified access is allowed

Correct answer: A National Interest Determination (NID) must be approved for the proscribed information

Top Secret, COMSEC, SCI, SAP, and Restricted Data are 'proscribed information.' Under an SSA, access to proscribed information requires a National Interest Determination (NID) showing that the access is consistent with U.S. national security interests. Board Resolutions apply to minority foreign interests that are not entitled to board representation. Voting Trust and Proxy Agreements remove the foreign owner's voting rights and do not require NIDs.

Question 29: What is a 'self-inspection' in the context of industrial security?

A review of employee performance
An inspection conducted by the employee union
A personal health check
A contractor-conducted internal review of its security program to assess compliance with NISPOM requirements (Correct answer)

Correct answer: A contractor-conducted internal review of its security program to assess compliance with NISPOM requirements

A self-inspection is an internal review conducted by the contractor to assess the effectiveness and compliance of its security program, identifying and correcting deficiencies before a government inspection.

Question 30: What is 'biometric authentication' and what advantage does it provide over traditional access cards?

A method using multiple keys to open a lock
A backup authentication method
A type of electronic keypad
Authentication using unique physical or behavioral characteristics that cannot easily be stolen, lost, or shared (Correct answer)

Correct answer: Authentication using unique physical or behavioral characteristics that cannot easily be stolen, lost, or shared

Biometric authentication uses unique physical traits (fingerprints, iris patterns, facial features) that are much harder to steal, duplicate, or share than access cards, providing stronger authentication.

Question 31: A cleared defense contractor wants to start processing classified information on a new information system at its facility. Under 32 CFR Part 117 (NISPOM), who has the authority to grant the system an authorization to operate (ATO)?

The Facility Security Officer (FSO), because the FSO is the senior security official at the cleared facility
The DCSA Authorizing Official (AO), the government official who formally accepts the risk of running the system (Correct answer)
The contractor's Information System Security Manager (ISSM), after approving the System Security Plan
The Government Contracting Activity's contracting officer, because the classified work comes from that contract

Correct answer: The DCSA Authorizing Official (AO), the government official who formally accepts the risk of running the system

Under the NISPOM, contractor classified information systems are authorized by the Cognizant Security Agency, which in practice means the DCSA Authorizing Official. The AO reviews the security authorization package and formally accepts the residual risk on behalf of the government. The ISSM builds the System Security Plan and maintains the system, but cannot authorize it. The FSO runs the overall facility security program. The contracting officer sets contract requirements, not system authorizations.

Question 32: A magnetic hard disk drive that processed classified information is being removed from service. Under NSA/CSS Policy Manual 9-12, which method is acceptable for sanitizing it?

Encrypting the entire drive with AES-256 and destroying the key (cryptographic erase)
Degaussing the drive with an NSA/CSS-evaluated degausser and then physically destroying it (Correct answer)
Running the drive's built-in ATA Secure Erase command and reissuing the drive within the same classification level
Overwriting the drive three times with a DoD 5220.22-M pattern, then verifying the overwrite

Correct answer: Degaussing the drive with an NSA/CSS-evaluated degausser and then physically destroying it

NSA/CSS Policy Manual 9-12 does not accept overwriting, Secure Erase, or cryptographic erase as sanitization for classified magnetic hard drives. The drive must be degaussed with a degausser listed on the NSA/CSS Evaluated Products List and then physically destroyed (for example, by disintegrating, shredding, or crushing it). The older 'DoD 5220.22-M overwrite' is a well-known myth and is not an approved method for classified media.

Question 33: What is a 'carve-out' in the context of SAP security programs?

Removing classified information from documents
Reducing the classification level of information
When a cleared contractor excludes specific personnel from a security program for which they would otherwise be eligible (Correct answer)
Separating a program from its parent agency

Correct answer: When a cleared contractor excludes specific personnel from a security program for which they would otherwise be eligible

A carve-out occurs when a contractor excludes certain personnel, such as union members, from a security program, creating a separate workforce for sensitive activities.

Question 34: An adjudicator is applying the whole-person concept under SEAD 4. Which of the following is NOT one of the nine adjudicative process factors?

How critical the position is to the mission, and how much classified information it involves (Correct answer)
The person's age and maturity at the time of the conduct
The potential for pressure, coercion, exploitation or duress
Whether the person took part voluntarily

Correct answer: How critical the position is to the mission, and how much classified information it involves

SEAD 4 lists nine factors: (1) the nature, extent and seriousness of the conduct; (2) the circumstances around it, including how knowingly the person took part; (3) how often it happened and how recently; (4) the person's age and maturity at the time; (5) whether participation was voluntary; (6) whether there has been rehabilitation or other lasting change in behavior; (7) the motivation for the conduct; (8) the potential for pressure, coercion, exploitation or duress; and (9) how likely the conduct is to continue or happen again. The sensitivity of the position affects which investigation tier is required, but it is not a factor for judging the person's conduct.

Question 35: What is a 'security clearance upgrade' and when is it required?

When an individual needs access to information at a higher classification level than their current clearance, requiring a new, more extensive investigation (Correct answer)
An automatic annual process
A review to verify existing clearance information
A re-examination of cleared individuals over 60 years old

Correct answer: When an individual needs access to information at a higher classification level than their current clearance, requiring a new, more extensive investigation

A security clearance upgrade is needed when an individual requires access to a higher classification level and involves a more thorough investigation appropriate for that level.

Question 36: What is the purpose of a 'security badge' or 'access control card' in physical security?

To control physical access by verifying identity and authorization, allowing entry only to appropriately authorized individuals (Correct answer)
To provide employee benefit information
To track employee attendance for HR purposes
To identify employees for payroll purposes only

Correct answer: To control physical access by verifying identity and authorization, allowing entry only to appropriately authorized individuals

Security badges and access control cards serve to verify an individual's identity and authorization level, allowing electronic access systems to grant or deny entry to specific areas based on programmed permissions.

Question 37: A passive infrared (PIR) motion sensor is mounted at the far end of a long, narrow corridor, aimed straight down its length. A penetration test shows an intruder walking directly toward the sensor sets off the alarm late or not at all. What is the most likely reason?

PIR sensors detect best when a heat source moves across their detection zones; moving straight at the sensor crosses few zones (Correct answer)
The corridor walls reflect the sensor's emitted infrared beam away from the intruder
PIR sensors only detect objects warmer than 40°C, so normal body heat is not enough at that distance
PIR sensors detect Doppler shift, which is weakest when a target moves straight toward the sensor

Correct answer: PIR sensors detect best when a heat source moves across their detection zones; moving straight at the sensor crosses few zones

A PIR sensor is passive. It sends out nothing and detects changes in infrared (heat) energy as a warm body moves between its segmented detection zones. Movement across those zones gives the strongest signal. Walking straight toward the sensor keeps the intruder in roughly the same zone, so detection is weak. Doppler sensitivity describes microwave sensors, which are actually best at picking up movement toward or away from them. That is why dual-technology (PIR plus microwave) sensors are used to cover each other's blind spots.

Question 38: During the Assess step, which document records the findings of the security control assessor, including controls that are not implemented correctly?

Privacy Impact Assessment (PIA)
System Security Plan (SSP)
Security Assessment Report (SAR) (Correct answer)
Plan of Action and Milestones (POA&M)

Correct answer: Security Assessment Report (SAR)

The SAR documents the assessor's findings and recommendations about how effective the controls are.

Question 39: What is 'patch management' in information security?

Managing software licenses
Tracking security awareness training completion
Repairing physical damage to hardware
The process of acquiring, testing, and deploying software updates to fix vulnerabilities and improve functionality (Correct answer)

Correct answer: The process of acquiring, testing, and deploying software updates to fix vulnerabilities and improve functionality

Patch management is the systematic process of keeping software up to date by applying vendor-released updates that fix security vulnerabilities and improve functionality.

Question 40: What happens when a SAP is terminated or declassified?

Information and materials are sanitized, properly disposed of, or downgraded according to formal termination procedures (Correct answer)
All program records are immediately destroyed
All cleared personnel automatically lose their clearances
Nothing; records remain classified indefinitely

Correct answer: Information and materials are sanitized, properly disposed of, or downgraded according to formal termination procedures

SAP termination involves formal procedures to sanitize, properly dispose of, or downgrade program information and materials, and to formally debrief all personnel who had access.

Question 41: What is the purpose of 'security containers' (safes) in industrial security?

To store personal items of value
To store computer equipment
To secure administrative records only
To provide approved storage for classified materials, preventing unauthorized access (Correct answer)

Correct answer: To provide approved storage for classified materials, preventing unauthorized access

GSA-approved security containers provide the required level of protection for classified materials, preventing unauthorized access while materials are not in use.

Question 42: A program manager asks an OCA to classify an entire test report SECRET. The report mostly covers contractor cost overruns and schedule slips that would draw congressional criticism. One paragraph describes an exploitable system vulnerability. What is the proper classification decision?

Classify only the vulnerability portion if it meets the damage standard; the cost and schedule data may not be classified to hide inefficiency or prevent embarrassment (Correct answer)
Classify the whole report CONFIDENTIAL as a compromise between the two concerns
Leave the whole report unclassified, because a request made partly to avoid embarrassment taints the entire classification decision
Classify the whole report SECRET, because one SECRET portion justifies the overall marking for every portion

Correct answer: Classify only the vulnerability portion if it meets the damage standard; the cost and schedule data may not be classified to hide inefficiency or prevent embarrassment

EO 13526 Sec. 1.7(a) prohibits classifying information to hide inefficiency or administrative error, to prevent embarrassment, or to delay the release of information that does not need protection. The vulnerability paragraph can be classified on its own merits and portion-marked SECRET, and the document's banner then reflects its highest level. The cost and schedule portions must be marked (U). A bad motive behind the request does not stop legitimate information from being classified.

Question 43: A cleared U.S. defense contractor is 40% owned by a foreign parent company. The foreign parent cannot effectively own or control the company, but under the shareholder agreement it is entitled to representation on the Board of Directors. Under 32 CFR Part 117 (NISPOM), which FOCI mitigation instrument is normally used in this situation?

Security Control Agreement (SCA) (Correct answer)
Special Security Agreement (SSA)
Board Resolution
Proxy Agreement

Correct answer: Security Control Agreement (SCA)

An SCA is used when the foreign interest does not effectively own or control the company but is entitled to representation on the board. A Board Resolution fits only when the foreign owner cannot get board representation. An SSA is for a foreign interest that effectively owns or controls the company. Proxy Agreements and Voting Trusts are for cases where the foreign owner must give up almost all of its ownership rights.

Question 44: A solid-state drive (SSD) used in an accredited classified system is being retired and must leave classified control. Which method is acceptable for sanitizing it?

Run the manufacturer's ATA Secure Erase command and have the ISSM document the result
Destroy it with an NSA/CSS Evaluated Products List (EPL) device approved for solid-state media, such as a disintegrator that reduces it to the required particle size (Correct answer)
Degauss it with an NSA/CSS-evaluated degausser, then reformat it
Run a three-pass DoD 5220.22-M overwrite and verify the drive reads back as zeros

Correct answer: Destroy it with an NSA/CSS Evaluated Products List (EPL) device approved for solid-state media, such as a disintegrator that reduces it to the required particle size

SSDs store data in flash memory cells, not on magnetic domains, so degaussing has no effect on them. Wear-leveling and over-provisioned blocks mean that overwrites and vendor secure-erase commands cannot be trusted to reach every cell. NSA/CSS guidance therefore requires physical destruction with EPL-listed equipment rated for solid-state media before the device can leave classified control. The three-pass overwrite method is outdated and has never been acceptable for releasing classified media.

Question 45: According to DHS active shooter guidance, what is the preferred first response when a safe escape path is available?

Run (evacuate) and leave belongings behind (Correct answer)
Call 911 before doing anything else
Fight to disrupt the shooter
Hide behind a locked door

Correct answer: Run (evacuate) and leave belongings behind

DHS 'Run, Hide, Fight' guidance makes evacuation the first option whenever an accessible escape route exists.

Question 46: Which executive order established the government-wide Controlled Unclassified Information (CUI) program?

Executive Order 12968
Executive Order 13556 (Correct answer)
Executive Order 13526
Executive Order 12829

Correct answer: Executive Order 13556

EO 13556 (2010) created the CUI program to standardize how the executive branch handles unclassified information that requires safeguarding or dissemination controls. EO 13526 covers classified national security information, EO 12968 covers access to classified information, and EO 12829 created the NISP.

Question 47: A foreign cyber actor sees that engineers at several cleared contractors often visit a niche professional association's website. The actor compromises that website so it delivers malware to visitors and never contacts the engineers directly. What is this technique called?

Watering hole attack (Correct answer)
Spear phishing
Whaling
Credential stuffing

Correct answer: Watering hole attack

A watering hole attack compromises a third-party site the target group trusts and visits regularly, then infects visitors without contacting them directly. Spear phishing sends tailored messages to specific people. Whaling is spear phishing aimed at senior executives. Credential stuffing tries stolen username/password pairs against other services.

Question 48: What is a 'waiver' in the context of SAP security requirements?

A formal documented authorization to deviate from a specific security requirement when strict compliance is impractical and an alternative means of protection is provided (Correct answer)
Eliminating all security requirements for a program
A verbal permission to bypass security procedures
An automatic exception for senior personnel

Correct answer: A formal documented authorization to deviate from a specific security requirement when strict compliance is impractical and an alternative means of protection is provided

A waiver is a formal, documented authorization to deviate from a specific security requirement, granted only when strict compliance is impractical and equivalent alternative protective measures are in place.

Question 49: An agency builds a multi-week course for its security staff. The course covers the behavioral science behind insider threat indicators, the reasoning behind countermeasure policies, and how to design new mitigation strategies. Under the NIST awareness-training-education model used in SETA programs, how is this course best classified?

Education, because it builds deep understanding of the 'why' so learners can develop new solutions (Correct answer)
Briefing, because it is delivered to a defined audience with a specific security role
Training, because it teaches staff specific security procedures
Awareness, because it concerns recognizing insider threat indicators

Correct answer: Education, because it builds deep understanding of the 'why' so learners can develop new solutions

The NIST model (SP 800-16/800-50) separates three levels. Awareness focuses attention on 'what' (recognition). Training builds skills for 'how' (performing procedures). Education builds understanding of 'why' so people can reason about a problem and create new approaches. Because this course teaches the underlying science and how to design countermeasures, it is education.

Question 50: Which continuity concept transfers statutory authority and responsibilities from an organization's primary staff to other designated staff when the primary staff cannot function?

Devolution (Correct answer)
Activation
Relocation
Reconstitution

Correct answer: Devolution

Devolution shifts authority and essential functions to designated personnel at another location when primary staff are unavailable.

Question 51: An employee at a defense contracting company frequently discusses specific project details, such as testing timelines and equipment capabilities, with friends at a local restaurant. While the information is not classified, a competitor could piece it together to gain a competitive advantage. This employee's behavior creates an OPSEC _______.

vulnerability (Correct answer)
threat
countermeasure
risk assessment

Correct answer: vulnerability

The employee's behavior creates a vulnerability, which is a weakness that can be exploited by a threat. Discussing sensitive details in a public, unsecured setting is a weakness in the company's security posture that an adversary (the threat) could exploit.

Question 52: What is the significance of 'personal protective equipment' in a security context?

Software that protects personal computers
Only relevant for physical labor
Encryption tools for personal communications
Items like body armor and trauma kits that protect security professionals from physical harm (Correct answer)

Correct answer: Items like body armor and trauma kits that protect security professionals from physical harm

In security contexts, personal protective equipment includes physical protection items such as body armor, helmets, and first aid supplies used to protect security professionals from physical harm.

Security Fundamentals Professional Certification (SFPC)

The SFPC exam validates foundational knowledge of DoD security disciplines including personnel security, information security, physical security, industrial security, and operations security.

Questions

120 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cdse.edu — Test delivery, eligibility, exam format, passing score, retake policy, score release, score validity, exam information · verified Oct 2026