Facility Security Officer (FSO) Certification — Questions and Answers

Question 1: Which of the 13 Adjudicative Guidelines specifically addresses concerns about debt, bankruptcy, and financial irresponsibility?

Guideline F – Financial Considerations (Correct answer)
Guideline J – Criminal Conduct
Guideline B – Foreign Influence
Guideline E – Personal Conduct

Correct answer: Guideline F – Financial Considerations

Adjudicative Guideline F covers financial considerations, recognizing that financial irresponsibility can make individuals vulnerable to coercion or inducement.

Question 2: Under NISPOM, contractors with facility clearances must designate which individual to establish and oversee the insider threat program?

Safety manager
Insider Threat Program Senior Official (ITPSO) (Correct answer)
Union steward
Chief financial officer

Correct answer: Insider Threat Program Senior Official (ITPSO)

The ITPSO, a cleared employee, is designated to run the insider threat program.

Question 3: Which cover sheet is used for Confidential documents?

SF 701 (yellow)
SF 703 (orange)
SF 704 (red)
SF 705 (blue) (Correct answer)

Correct answer: SF 705 (blue)

SF 705 is blue for Confidential material.

Question 4: Which is a primary purpose of a risk assessment in a facility security program?

Eliminating all risk entirely
Determining employee salaries
Replacing the need for DCSA oversight
Identifying assets, threats and vulnerabilities to prioritize countermeasures (Correct answer)

Correct answer: Identifying assets, threats and vulnerabilities to prioritize countermeasures

Risk assessment identifies assets, threats and vulnerabilities so countermeasures can be prioritized cost-effectively.

Question 5: Which law criminalizes gathering, transmitting, or losing defense information with intent or reason to believe it could injure the U.S.?

Fair Credit Reporting Act
Freedom of Information Act
Sarbanes-Oxley Act
Espionage Act, 18 U.S.C. 793 (Correct answer)

Correct answer: Espionage Act, 18 U.S.C. 793

18 U.S.C. 793 covers gathering, transmitting, or losing defense information.

Question 6: What is the primary role of a Facility Security Officer (FSO)?

To supervise the cafeteria staff.
To oversee and maintain the security program (Correct answer)
To provide IT support.
To manage financial accounts.

Correct answer: To oversee and maintain the security program

The primary role of a Facility Security Officer (FSO) is to establish, implement, and maintain a comprehensive security program within their facility. This encompasses managing classified information, overseeing personnel security clearances, implementing physical security measures, and ensuring strict compliance with government regulations to protect national security information. The FSO acts as the central point of contact for all security-related matters.

Question 7: Which federal standard covers neutralizing and repairing GSA containers and locks?

FIPS 140-2
NIST 800-53
ISO 27001
FED-STD-809 (Correct answer)

Correct answer: FED-STD-809

Neutralization, repair, and inspection of GSA containers are governed by FED-STD-809 and performed by authorized personnel.

Question 8: When Secret material is transmitted outside the facility, which control is required?

A verbal acknowledgment
A receipt (Correct answer)
No documentation
An email notification only

Correct answer: A receipt

Secret and above transmitted outside the facility requires a receipt for accountability.

Question 9: Secret material stored in a closed area without GSA containers needs which kind of supplemental control?

No supplemental control
A posted sign only
An unmonitored camera
An IDS or periodic cleared-guard checks (Correct answer)

Correct answer: An IDS or periodic cleared-guard checks

Closed areas holding Secret material need supplemental controls such as an IDS or cleared guard patrols.

Question 10: In a subcontract situation under the NISP, what does a 'Visited Contractor' (VC) arrangement mean?

A cleared contractor temporarily loans employees to another contractor
A cleared contractor visits a government site to provide security consulting
An uncleared contractor is escorted through a classified area by a cleared employee
A cleared subcontractor performs classified work at the prime contractor's cleared facility (Correct answer)

Correct answer: A cleared subcontractor performs classified work at the prime contractor's cleared facility

A Visited Contractor relationship occurs when a cleared subcontractor performs classified work at the prime contractor's facility, requiring coordination between both parties and notification to DCSA.

Question 11: What distinguishes CUI Specified from CUI Basic?

It never needs marking
It applies only to contractors
It is always classified Confidential
Its authority sets specific handling controls that differ from the baseline (Correct answer)

Correct answer: Its authority sets specific handling controls that differ from the baseline

CUI Specified has law, regulation, or policy requiring controls beyond the basic standard.

Question 12: Which form records the opening and closing of a GSA-approved security container?

SF 703
SF 700
SF 702 (Correct answer)
SF 701

Correct answer: SF 702

SF 702 is the Security Container Check Sheet used to log each opening and closing.

Question 13: Under the plain view doctrine, an officer may seize an item without a warrant if:

The item appears suspicious to anyone
The officer has a hunch about the owner
The owner is not at the location
The officer is lawfully present and its incriminating nature is immediately apparent (Correct answer)

Correct answer: The officer is lawfully present and its incriminating nature is immediately apparent

Plain view requires lawful presence and immediately apparent incriminating character of the item.

Question 14: Who must the Insider Threat Program Senior Official (ITPSO) be?

The IT help desk lead
A cleared U.S. citizen employee and KMP (Correct answer)
An outside consultant
Any uncleared manager

Correct answer: A cleared U.S. citizen employee and KMP

The ITPSO must be a cleared employee who is a senior official of the company and a KMP.

Question 15: Which form must a cleared employee sign before being granted initial access to classified information?

SF-328
SF-312 Classified Information Nondisclosure Agreement (Correct answer)
DD Form 254
DD Form 441

Correct answer: SF-312 Classified Information Nondisclosure Agreement

The SF-312 NDA is a prerequisite for access to classified information.

Question 16: Which component is essential for monitoring physical access points in real-time?

Employee manual
Intercom system
Fire extinguisher
Real-time surveillance camera feeds (Correct answer)

Correct answer: Real-time surveillance camera feeds

Real-time surveillance camera feeds are essential for monitoring physical access points because they provide immediate visual information about who is entering or exiting a facility. This allows security personnel to detect unauthorized access, suspicious activities, or breaches as they happen. Live video directly supports proactive security monitoring and enables a rapid, informed response to potential threats.

Question 17: Employees question whether to report a concern about a coworker. The FSO should emphasize that reporting is:

Discouraged by DCSA
Optional for supervisors
Only for managers
An obligation that supports national security (Correct answer)

Correct answer: An obligation that supports national security

Cleared personnel have a duty to report concerning behavior and security issues.

Question 18: A change in a cleared company's ownership is a:

Changed condition requiring report to the CSA (Correct answer)
Item reported only to the IRS
Matter for the annual newsletter
Non-reportable business event

Correct answer: Changed condition requiring report to the CSA

Changes in ownership are reportable changed conditions affecting the facility clearance.

Question 19: Which principle governs how many employees a contractor may request be cleared?

The minimum number necessary for contract performance (Correct answer)
Only executives
All employees to reduce risk
As many as possible for flexibility

Correct answer: The minimum number necessary for contract performance

PCL requests must be limited to the minimum required to perform on classified contracts.

Question 20: Which standard governs locks approved for GSA security containers?

FF-L-2740 (Correct answer)
ISO 27001
FIPS 140-2
UL 2050

Correct answer: FF-L-2740

Federal Specification FF-L-2740 covers electromechanical combination locks such as the X-10.

Question 21: An FSO learns of a suspicious contact attempt by a foreign national seeking classified information. What should the FSO do?

Report it to the CSA (DCSA) as a suspicious contact (Correct answer)
Ignore it unless the employee gave information
Wait for the annual self-inspection to document it
Handle it internally and keep a note in the employee file

Correct answer: Report it to the CSA (DCSA) as a suspicious contact

Suspicious contacts must be reported to the cognizant security agency.

Question 22: What is TSCM?

Threat Signature Classification Model
Trusted System Control Module
Top Secret Container Marking
Technical Surveillance Countermeasures Management (Correct answer)

Correct answer: Technical Surveillance Countermeasures Management

TSCM detects and deters technical surveillance such as eavesdropping devices.

Question 23: What does the SF-328 certify?

Visit authorization
Personnel investigation completion
Information about foreign ownership, control, or influence (FOCI) (Correct answer)
Contract classification levels

Correct answer: Information about foreign ownership, control, or influence (FOCI)

The SF-328 is the Certificate Pertaining to Foreign Interests used in FOCI evaluation.

Question 24: What is the FIRST step in an incident response process according to Facility Security Officer Certification best practices?

Immediately shutting down all affected systems
Erasing logs to prevent further exploitation
Detection and identification of the security incident (Correct answer)
Notifying law enforcement before investigation

Correct answer: Detection and identification of the security incident

The incident response process begins with detection and identification, which involves recognizing that an incident has occurred and determining its scope and nature.

Question 25: A utility company has a recorded right to run power lines across a corner of a company's land. This right is best described as a(n):

Easement (Correct answer)
Lien
Fee simple absolute
Leasehold

Correct answer: Easement

An easement grants a non-owner a limited right to use another's land for a specific purpose.

Question 26: Which record should the FSO retain to demonstrate self-inspection was performed?

Nothing is required
Employees' tax records
Verbal notes only
Written self-inspection report and corrective action documentation (Correct answer)

Correct answer: Written self-inspection report and corrective action documentation

Written documentation shows completion and supports DCSA review.

Question 27: What is the primary function of an access control system?

To monitor internet usage.
To regulate entry and exit points (Correct answer)
To control HVAC systems.
To record employee performance.

Correct answer: To regulate entry and exit points

The primary function of an access control system is to manage and regulate who can enter or exit specific areas within a facility, and when. It enforces security policies by granting or denying access based on credentials, ensuring that only authorized personnel can reach sensitive locations. This is a fundamental component of physical security, protecting assets and personnel from unauthorized intrusion.

Question 28: Which agency serves as the Executive Agent for the CUI program?

General Services Administration
National Archives and Records Administration (NARA) (Correct answer)
Federal Reserve
Department of Commerce

Correct answer: National Archives and Records Administration (NARA)

NARA's Information Security Oversight Office oversees the CUI program.

Question 29: What is the purpose of an after-action report?

To close the case quickly.
To review performance and improve future readiness (Correct answer)
To inform competitors.
To discipline staff.

Correct answer: To review performance and improve future readiness

An after-action report (AAR) is a critical tool for post-incident analysis, systematically reviewing the effectiveness of the response, identifying strengths, and pinpointing areas for improvement. By documenting what happened, what went well, and what could have been done better, the AAR provides valuable lessons learned. This information is then used to update plans, enhance training, and improve overall readiness for future incidents, fostering continuous improvement.

Question 30: An insider threat program must be able to gather and integrate information from which sources?

Records such as HR, security, and information assurance (Correct answer)
Only exit interviews
Only social media
Only the FBI

Correct answer: Records such as HR, security, and information assurance

Programs must gather, integrate and report relevant information from HR, security, and information assurance offices.

Question 31: How often must refresher security training be provided to cleared employees?

Every ten years
Annually (Correct answer)
Never required
Only at hire

Correct answer: Annually

Refresher briefings are required annually.

Question 32: After a suspected compromise, the FSO's preliminary inquiry primarily aims to determine:

The cost of replacing the document
Which contract to cancel
Who to terminate
Whether loss or compromise actually occurred (Correct answer)

Correct answer: Whether loss or compromise actually occurred

A preliminary inquiry establishes the facts and whether loss, compromise, or suspected compromise occurred.

Question 33: What role does a CCTV system play in physical security?

Regulates employee schedules.
Provides ventilation.
Monitors and records facility activity (Correct answer)
Maintains equipment performance.

Correct answer: Monitors and records facility activity

A Closed-Circuit Television (CCTV) system is a cornerstone of physical security, primarily used to monitor and record activity within and around a facility. It provides real-time visual surveillance, allowing security personnel to observe potential threats, detect incidents, and gather evidence. CCTV acts as both a deterrent and a forensic tool, significantly enhancing situational awareness and response capabilities.

Question 34: The contractor's self-inspection of its security program must be certified by whom?

The Senior Management Official (Correct answer)
The newest cleared employee
The government contracting officer
An outside auditor chosen by DCSA

Correct answer: The Senior Management Official

The SMO must certify in writing that the self-inspection was conducted and corrective action taken.

Question 35: What communication method is most effective during a crisis?

Word of mouth.
Daily newsletters.
Email updates every hour.
Mass notification systems and radios (Correct answer)

Correct answer: Mass notification systems and radios

During a crisis, mass notification systems and radios are the most effective communication methods because they enable rapid, widespread, and reliable dissemination of critical information to a large audience or specific response teams. Mass notification systems can alert personnel through multiple channels simultaneously, while radios provide instant, two-way communication for responders in areas where other networks might be compromised. These methods ensure timely updates and coordinated actions, which are paramount in an emergency.

Question 36: What does a hypervisor snapshot of a VM that processed sensitive data create a risk of?

Faster boot times only
Reduced CPU usage
A stored copy of memory and disk state that may retain sensitive data (Correct answer)
Automatic declassification

Correct answer: A stored copy of memory and disk state that may retain sensitive data

Snapshots can preserve memory contents and data, so they must be protected and sanitized like the original.

Question 37: The final report on a classified information loss should include:

Nothing beyond the initial report
A list of company vendors
Only the employee's name
Corrective actions taken to prevent recurrence (Correct answer)

Correct answer: Corrective actions taken to prevent recurrence

The final report details root cause, responsible parties and corrective action.

Question 38: Which document provides the contractor with security classification guidance for a specific classified contract?

SF-702
DD Form 254 (Correct answer)
SF-328
SF-86

Correct answer: DD Form 254

The DD-254 Contract Security Classification Specification gives classification guidance and security requirements.

Question 39: What color is the SF 704 cover sheet that marks Secret documents?

Blue
Red (Correct answer)
Orange
Green

Correct answer: Red

SF 704 is red for Secret, SF 703 orange for Top Secret, and SF 705 blue for Confidential.

Question 40: Which best describes the scope of Property Law & Real Estate in professional practice?

An outdated concept no longer relevant to modern practice
A theoretical framework with no practical applications
A narrow topic relevant only to entry-level professionals
A comprehensive area covering both theoretical foundations and practical applications (Correct answer)

Correct answer: A comprehensive area covering both theoretical foundations and practical applications

Property Law & Real Estate encompasses both theoretical foundations and practical applications that are essential to professional practice in this field.

Question 41: What is the main purpose of a preliminary inquiry into a security incident?

Assign disciplinary punishment
Replace the DD 254
Determine whether loss, compromise, or suspected compromise occurred (Correct answer)
Renew the facility clearance

Correct answer: Determine whether loss, compromise, or suspected compromise occurred

The inquiry establishes the facts needed to decide whether classified information was compromised.

Question 42: Which agency should a Facility Security Officer contact during a major breach?

The local fire department.
A private contractor.
The appropriate government authority (Correct answer)
The news station.

Correct answer: The appropriate government authority

During a major breach, a Facility Security Officer (FSO) must contact the appropriate government authority, such as law enforcement (e.g., FBI, local police) or specific regulatory bodies. This is crucial for legal compliance, initiating official investigations, and leveraging external resources to contain the incident and apprehend perpetrators. Failing to do so can have severe legal and operational consequences.

Question 43: What system do FSOs primarily use to manage personnel security eligibility and access records for cleared employees?

The company intranet
SIPRNet email
NCIC
DISS (Defense Information System for Security) (Correct answer)

Correct answer: DISS (Defense Information System for Security)

DISS is the system of record for eligibility and access determinations.

Question 44: Which set lists the four elements a plaintiff must prove in a negligence claim?

Breach, warning, causation, punishment
Intent, motive, causation, damages
Duty, notice, intent, injury
Duty, breach, causation, damages (Correct answer)

Correct answer: Duty, breach, causation, damages

Negligence requires duty, breach, causation, and actual damages.

Question 45: Who must certify the annual self-inspection results?

DCSA
Senior management official (Correct answer)
A random employee
The IT manager

Correct answer: Senior management official

The SMO must certify that self-inspections were conducted and results reviewed with senior management.

Question 46: How should a contractor document its insider threat program?

No documentation required
Maintain a written program plan and self-certify its implementation to the CSA (Correct answer)
Post a poster in the break room
Verbal policy only

Correct answer: Maintain a written program plan and self-certify its implementation to the CSA

A written plan is required and implementation must be self-certified to the CSA.

Question 47: What is the most important competency assessed in Civil Procedure & Litigation for professionals in this field?

Memorization of textbook definitions only
Applied knowledge and practical problem-solving ability (Correct answer)
Academic credentials without practical application
Years of experience without demonstrated skill

Correct answer: Applied knowledge and practical problem-solving ability

Civil Procedure & Litigation assessment focuses on applied knowledge and practical problem-solving ability, ensuring professionals can effectively perform in real-world situations.

Question 48: What is the typical standard for a Central Station monitoring an IDS for classified storage?

Any commercial alarm vendor
UL 2050 certified (Correct answer)
No certification required
Residential UL 1023 only

Correct answer: UL 2050 certified

Central Station services for classified storage are expected to be UL 2050 certified.

Question 49: Which security container form records combinations and is placed inside the container?

SF-328
SF-700 (Correct answer)
SF-702
SF-312

Correct answer: SF-700

SF-700 records combination and contact information for the container.

Question 50: A cleared employee changes their name. What must the FSO do?

Ignore it as a personal matter
Terminate the employee's access
Report the change and update the employee's record per procedures (Correct answer)
Wait for the next investigation

Correct answer: Report the change and update the employee's record per procedures

Changes in cleared employee status such as name changes must be reported and recorded.

Question 51: When a combination lock is taken out of service, what should it be reset to?

A combination equal to the vault's
Factory standard such as 50-25-50 (Correct answer)
The previous combination
The FSO's birth date

Correct answer: Factory standard such as 50-25-50

Before removal, combination locks are set to the standard 50-25-50 setting.

Question 52: What is the maximum imprisonment under 18 U.S.C. 1924 for unauthorized removal and retention of classified documents at an unauthorized location?

Ten years
Five years
One year (Correct answer)
Life

Correct answer: One year

Section 1924 provides a fine and/or imprisonment of not more than one year.

Question 53: Which of the following is a changed condition that an FSO must report to the CSA?

Change in the employee parking policy
Change in ownership or Key Management Personnel (Correct answer)
Change in office paint color
Change in the company's lunch vendor

Correct answer: Change in ownership or Key Management Personnel

Ownership and KMP changes affect the facility clearance and must be reported.

Question 54: Which of the following is considered adverse information that an FSO should report about a cleared employee?

Employee's preference for remote work
Normal job promotion
Routine vacation requests
Information that may reflect on the employee's trustworthiness or suitability for access (Correct answer)

Correct answer: Information that may reflect on the employee's trustworthiness or suitability for access

Adverse information bearing on eligibility must be reported to the CSA.

Question 55: An FSO must maintain which of the following for the facility's classified program?

Personal social media passwords
Records of training, briefings, and self-inspections as required (Correct answer)
Employees' tax returns
Employees' medical files

Correct answer: Records of training, briefings, and self-inspections as required

The FSO keeps security education records and self-inspection documentation per NISPOM.

Question 56: A cleared employee plans personal foreign travel. Under SEAD 3, the employee generally must:

Report only after returning
Do nothing if traveling for under a week
Report in advance to the FSO (Correct answer)
Ask the local police

Correct answer: Report in advance to the FSO

Covered individuals must report unofficial foreign travel in advance for approval and briefing.

Question 57: Under the Privacy Act, an individual generally has the right to do what with their agency record?

Delete it at will
Request access to it and seek amendment of inaccurate information (Correct answer)
Classify it
Sell it to third parties

Correct answer: Request access to it and seek amendment of inaccurate information

The Act provides access and amendment rights, subject to exemptions.

Question 58: Interrogatories are:

Jury instructions
Oral questions at trial
Written questions that a party must answer under oath (Correct answer)
Subpoenas to nonparties

Correct answer: Written questions that a party must answer under oath

Interrogatories are written discovery questions answered in writing under oath.

Question 59: Why is timely incident reporting crucial?

It helps in faster threat containment and evidence collection (Correct answer)
It allows more time to react.
It makes the incident disappear.
It prevents any investigation.

Correct answer: It helps in faster threat containment and evidence collection

Timely incident reporting is crucial because it allows security personnel and relevant authorities to react quickly, which is essential for containing a threat before it escalates further and for preserving critical evidence. Rapid reporting facilitates immediate investigation, helps in identifying the root cause, and supports potential legal actions or recovery efforts. Delays can lead to increased damage, loss of evidence, and a more difficult resolution.

Question 60: What is a DD Form 254 used for in the NISP?

Providing security classification guidance to a contractor on a classified contract (Correct answer)
Recording the results of a personnel security investigation
Applying for a facility security clearance
Reporting a security violation to DCSA

Correct answer: Providing security classification guidance to a contractor on a classified contract

The DD Form 254 (Contract Security Classification Specification) conveys security requirements and classification guidance from the government to a contractor for a specific classified contract.

Question 61: When must an initial security briefing be given to an employee being granted access to classified information?

Before access to classified information is granted (Correct answer)
At the next annual refresher
Only after the first classified visit
Within 90 days after access begins

Correct answer: Before access to classified information is granted

Initial briefings must precede access to classified information.

Question 62: Who has the authority to conduct security reviews of a cleared contractor's facility under the NISP?

The Office of Personnel Management
State governors' offices
The Cognizant Security Agency, typically through DCSA for DoD contractors (Correct answer)
The prime contractor's FSO

Correct answer: The Cognizant Security Agency, typically through DCSA for DoD contractors

DCSA acts as the CSA's representative for conducting security reviews.

Question 63: What is the exclusionary rule?

Evidence obtained through unconstitutional searches is generally inadmissible against the defendant in a criminal trial (Correct answer)
Hearsay is excluded from security hearings
Employees are excluded from testifying against their employer
Classified evidence is excluded from public trials

Correct answer: Evidence obtained through unconstitutional searches is generally inadmissible against the defendant in a criminal trial

Under Mapp v. Ohio, evidence obtained in violation of the Fourth Amendment is generally suppressed.

Question 64: What form is used to initiate a personnel security investigation for a DoD security clearance?

SF-312
SF-85
SF-86 (Correct answer)
DD-254

Correct answer: SF-86

The SF-86 (Questionnaire for National Security Positions) is the standard form used to apply for national security clearances.

Question 65: What best supports the lawful inspection of employees' bags at a cleared facility entrance?

A random decision by the guard on duty
No action is needed; employers may search anything
A written, publicized policy with notice and consent (Correct answer)
A verbal remark by the guard

Correct answer: A written, publicized policy with notice and consent

Written policy and notice reduce privacy expectations and document consent.

Question 66: Who must authorize a contractor information system before it processes classified information?

The system's vendor
The FSO alone
The Cognizant Security Authority (DCSA) via its Authorizing Official (Correct answer)
The company president

Correct answer: The Cognizant Security Authority (DCSA) via its Authorizing Official

Classified systems require government authorization before operation.

Question 67: Who is ultimately responsible for ensuring the contractor maintains a security program compliant with the NISPOM?

The newest cleared employee
The government contracting officer
The Senior Management Official (Correct answer)
The DCSA Industrial Security Representative

Correct answer: The Senior Management Official

The SMO is accountable for the overall security program and provides it the necessary authority and resources.

Question 68: Which credential is most commonly used in electronic access control systems?

Email address
Key fob or access card (Correct answer)
Social Security Number
Home address

Correct answer: Key fob or access card

Key fobs and access cards are the most common credentials used in electronic access control systems. These devices contain unique identifiers that, when presented to a reader, authenticate the user and grant or deny access based on pre-programmed permissions. They offer a convenient and secure method for managing entry to restricted areas, replacing traditional keys with more flexible and auditable solutions.

Question 69: Which type of lock is currently approved for GSA security containers and vault doors under Federal Specification FF-L-2740?

Keyed deadbolt
Magnetic card strike
Standard dial padlock
Electromechanical combination lock (Correct answer)

Correct answer: Electromechanical combination lock

FF-L-2740 covers electromechanical locks such as the X-09 and X-10 used on GSA-approved containers.

Question 70: What is the main purpose of a litigation hold?

To seal court records
To delay a trial date
To preserve potentially relevant records by suspending routine destruction (Correct answer)
To limit discovery requests

Correct answer: To preserve potentially relevant records by suspending routine destruction

A litigation hold requires preservation of potentially relevant documents once litigation is reasonably anticipated.

Question 71: What is the PRIMARY consideration when performing patient assessment in Facility Security Officer Certification practice?

Convenience for the healthcare provider
Speed of completing the assessment
Cost-effectiveness of the procedure
Patient safety and accurate data collection (Correct answer)

Correct answer: Patient safety and accurate data collection

Patient safety and accurate data collection are always the top priorities during any patient assessment to ensure proper diagnosis and treatment planning.

Question 72: A bomb threat is received at a facility that stores classified material. The priority is:

Protecting life while following the emergency plan (Correct answer)
Hiding the threat from employees
Calling the news media
Securing every document before evacuating

Correct answer: Protecting life while following the emergency plan

Life safety comes first, with classified protection handled per the emergency plan and then reported as needed.

Question 73: Who normally receives the initial report of loss, compromise, or suspected compromise of classified information from a cleared contractor?

The cognizant security agency (DCSA) (Correct answer)
The local newspaper
The company's marketing director only
The employee's family

Correct answer: The cognizant security agency (DCSA)

NISPOM requires reporting such events to the CSA, and contractors also notify the GCA as applicable.

Question 74: A Technology Control Plan (TCP) in a FOCI mitigation context is primarily designed to:

Schedule security training
Control access by foreign persons to classified and export-controlled information (Correct answer)
Document visitor parking
Track employee vacation time

Correct answer: Control access by foreign persons to classified and export-controlled information

A TCP prevents unauthorized access by foreign persons to classified and export-controlled technology.

Question 75: Within what timeframe must a newly appointed FSO complete required FSO training?

Before the first self-inspection only
Within 30 days of appointment
Within 2 years of appointment
Within 6 months of appointment (Correct answer)

Correct answer: Within 6 months of appointment

The NISPOM requires FSO training to be completed within six months of appointment.

Question 76: A cleared contractor wants to publish a paper that relates to a classified contract. Public release requires:

No review if marked unclassified
Approval from the appropriate government authority (Correct answer)
A company press office check
Only the FSO's signature

Correct answer: Approval from the appropriate government authority

Information pertaining to classified contracts needs government approval prior to public release.

Question 77: Which standard form is the Security Container Information form that records combination holders?

SF 703
SF 702
SF 700 (Correct answer)
SF 701

Correct answer: SF 700

SF 700 lists the container's custodians and holds the sealed combination envelope.

Question 78: When a cleared employee leaves the company, the FSO should:

Debrief and update the employee's record (Correct answer)
Keep their SF 312 secret
Transfer clearance personally
Do nothing

Correct answer: Debrief and update the employee's record

Debrief the employee and update records in the personnel security system.

Question 79: What is the primary purpose of the DD Form 254?

To convey security requirements and classification guidance for a classified contract (Correct answer)
To record a personnel clearance investigation
To request a visit to another cleared facility
To certify a company's foreign ownership

Correct answer: To convey security requirements and classification guidance for a classified contract

The DD Form 254 provides contract-specific security requirements and classification guidance to the contractor.

Question 80: Which of the following is a common type of physical barrier in security?

Data encryption software
Fire alarm system
Security fencing (Correct answer)
Smoke detector

Correct answer: Security fencing

Security fencing is a classic and highly effective physical barrier used to define perimeters, deter unauthorized entry, and delay intruders. It acts as a first line of defense, making it more difficult for individuals to access restricted areas. Physical barriers like fencing are fundamental components of a layered security approach, providing visible and tangible protection.

Question 81: What must the Insider Threat Program Senior Official (ITPSO) be?

A cleared U.S. citizen employee who is a KMP (Correct answer)
Any employee regardless of clearance
A foreign national with a clearance
A DCSA employee

Correct answer: A cleared U.S. citizen employee who is a KMP

The ITPSO must be a cleared employee designated as KMP and is responsible for the program.

Question 82: Under the 'eggshell plaintiff' rule, a defendant:

Is immune for fragile plaintiffs
Pays only half of damages
Is liable only for typical injuries
Takes the plaintiff as found and is liable for the full extent of harm (Correct answer)

Correct answer: Takes the plaintiff as found and is liable for the full extent of harm

A defendant is liable for unforeseeable extent of harm caused to a particularly vulnerable plaintiff.

Question 83: What is a Facility Clearance (FCL)?

A physical security certification for a contractor's building
An individual employee's security clearance at a cleared facility
An administrative determination that a contractor organization is eligible to access classified information (Correct answer)
A temporary permit to store classified materials on-site

Correct answer: An administrative determination that a contractor organization is eligible to access classified information

An FCL is an administrative determination by the CSA that a contractor entity and its key management personnel are eligible to access classified information at a specified level.

Question 84: A spillage of classified data onto an unclassified information system is first reported to:

The ISSM/ISSP and the FSO (Correct answer)
All employees by email
The vendor's help desk
Public affairs

Correct answer: The ISSM/ISSP and the FSO

Spillages must be isolated and reported through the ISSM/FSO to the CSA, not broadcast or ignored.

Question 85: Under the National Industrial Security Program (NISP), which agency has primary authority to grant security clearances to contractor personnel?

The Department of State
The contractor's Facility Security Officer
The Defense Counterintelligence and Security Agency (DCSA) (Correct answer)
The Federal Bureau of Investigation (FBI)

Correct answer: The Defense Counterintelligence and Security Agency (DCSA)

DCSA (formerly DSS) serves as the Cognizant Security Agency (CSA) for the DoD and administers the NISP, including granting and revoking clearances for contractor personnel.

Question 86: Under contract law, what does 'consideration' mean?

A legal opinion from counsel
Careful thought before signing
Something of value exchanged by each party (Correct answer)
A government approval stamp

Correct answer: Something of value exchanged by each party

Consideration is the bargained-for exchange of value that makes promises enforceable.

Question 87: What should an FSO do when a vulnerability cannot be corrected immediately?

Stop all classified work permanently
Accept it silently
Implement compensatory controls and track a remediation plan (Correct answer)
Remove the item from the report

Correct answer: Implement compensatory controls and track a remediation plan

Compensatory controls reduce risk until remediation is complete.

Question 88: How does Torts & Personal Injury contribute to overall professional effectiveness?

It is relevant only during the certification examination
It provides essential knowledge and skills that directly impact quality of work and outcomes (Correct answer)
It serves only as a credential requirement with no practical impact
It applies only to supervisory-level professionals

Correct answer: It provides essential knowledge and skills that directly impact quality of work and outcomes

Torts & Personal Injury directly contributes to professional effectiveness by providing essential knowledge and skills that improve the quality of work and outcomes across all career levels.

Question 89: What is a key responsibility in personnel security for FSOs?

Oversee personnel clearance procedures (Correct answer)
Manage training budgets.
Monitor cafeteria menus.
Review marketing plans.

Correct answer: Oversee personnel clearance procedures

A key responsibility of an FSO in personnel security is to oversee the entire personnel security clearance process for employees who require access to classified information. This includes initiating background investigations, ensuring employees understand their security responsibilities, and managing ongoing eligibility for classified access. The FSO ensures that all personnel with access to classified information meet government security standards.

Question 90: Cyber incidents involving covered defense information are generally reported to DoD within:

One year
30 days
7 days
72 hours (Correct answer)

Correct answer: 72 hours

DFARS 252.204-7012 requires cyber incident reporting within 72 hours of discovery.

Question 91: What is the primary purpose of virtual machine isolation?

To reduce licensing
To make VMs run faster
To remove the need for patching
To prevent one VM from accessing or interfering with another VM's resources (Correct answer)

Correct answer: To prevent one VM from accessing or interfering with another VM's resources

Isolation keeps guests separated so compromise or failure of one does not spill into others.

Question 92: Under the Contract Disputes Act, a contractor's claim must first be submitted to whom?

The contracting officer (Correct answer)
The Government Accountability Office
A federal district judge
The Inspector General

Correct answer: The contracting officer

CDA claims go to the contracting officer for a final decision.

Question 93: What is the 'need-to-know' principle in personnel security?

The requirement to notify employees when a security breach occurs
The requirement that cleared employees must be informed of all classified programs
The rule that clearance holders must share information with all colleagues at the same clearance level
The principle that access to classified information must be justified by an official duty requirement (Correct answer)

Correct answer: The principle that access to classified information must be justified by an official duty requirement

Need-to-know means an individual must have a specific, official reason to access classified information beyond merely holding the appropriate clearance level.

Question 94: What are the three levels of security clearance in the U.S. national security system?

Level 1, Level 2, Level 3
Confidential, Secret, Top Secret (Correct answer)
Low, Medium, High
Basic, Enhanced, Maximum

Correct answer: Confidential, Secret, Top Secret

The three standard clearance levels are Confidential, Secret, and Top Secret, each requiring progressively more extensive investigations.

Question 95: What is required for a closed area's walls constructed to protect classified information?

Construction from true floor to true ceiling (Correct answer)
Only a lockable door
Drop ceilings with no barrier above
Glass partitions to improve visibility

Correct answer: Construction from true floor to true ceiling

Walls must run from true floor to true ceiling so the area cannot be bypassed above or below.

Question 96: What does 'open storage' mean in a cleared facility?

Storing material in an unlocked cabinet
Storing material in a public lobby
Leaving documents on a desk overnight
Storing classified material in an approved closed area without a GSA container (Correct answer)

Correct answer: Storing classified material in an approved closed area without a GSA container

Open storage is CSA-approved storage in a secured area not requiring containers for each item.

Question 97: What does the facility clearance (FCL) determine?

The employees' personal clearances automatically
Administrative determination that a company is eligible for access to classified information at a certain level (Correct answer)
The company's profitability
The company's tax status

Correct answer: Administrative determination that a company is eligible for access to classified information at a certain level

An FCL is an administrative determination of eligibility for access at the same or lower classification level.

Question 98: Which of these is an adverse information report trigger for a cleared employee?

Transferring to a different department
Repeated unreported foreign contacts and financial problems (Correct answer)
Changing a parking space
Taking annual leave

Correct answer: Repeated unreported foreign contacts and financial problems

Adverse information, such as concerning conduct or financial issues, bearing on eligibility must be reported to the CSA.

Question 99: An unsolicited email from an unknown foreign entity requests detailed product specs for a defense program. This is:

A potential suspicious contact to report (Correct answer)
A routine sales inquiry
Not reportable if the email is unclassified
Spam to delete only

Correct answer: A potential suspicious contact to report

Unsolicited requests for protected information are indicators of possible collection attempts and are reportable.

Question 100: In Facility Security Officer Certification, what role does continuous improvement play in security policies & procedures?

It is only necessary when problems are identified
It applies only to new professionals entering the field
It ensures practices evolve to meet changing requirements and improve outcomes (Correct answer)
It is a theoretical concept with limited practical application

Correct answer: It ensures practices evolve to meet changing requirements and improve outcomes

Continuous improvement ensures that practices in this area evolve to meet changing requirements, incorporate new knowledge, and consistently improve outcomes.

Facility Security Officer (FSO) Certification

The Facility Security Officer (FSO) certification validates an individual's knowledge of the National Industrial Security Program Operating Manual (NISPOM) and their ability to manage security programs for cleared facilities.

100

Questions

120 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. We have not yet matched this exam's facts to an official source, so confirm fees, dates and rules with the exam body. Not reviewed by a subject-matter expert. Editorial policy