Industrial Security Professional (ISP) Certification Exam — Questions and Answers

Question 1: Which Item on the DD Form 254 is used to show that the CSA has been relieved of inspection responsibility for part of the work (a carve-out)?

Item 14
Item 15 (Correct answer)
Item 12
Item 13

Correct answer: Item 15

Item 15 identifies elements of the contract outside the CSA's inspection responsibility.

Question 2: Unless the GCA says otherwise, how long may a contractor keep classified material after a contract ends?

1 year
Indefinitely
2 years (Correct answer)
30 days

Correct answer: 2 years

Contractors may keep classified material for 2 years after contract completion unless the GCA notifies them otherwise.

Question 3: A 'security baseline' in an industrial information security program refers to:

A benchmark test for measuring network throughput
The starting point for a risk assessment before any controls are applied
The minimum acceptable configuration and security controls applied uniformly to all systems (Correct answer)
The highest security standard applied only to classified networks

Correct answer: The minimum acceptable configuration and security controls applied uniformly to all systems

A security baseline defines the minimum set of controls every system must have, ensuring a consistent security floor across the organization.

Question 4: What is the purpose of a security risk assessment in facility protection?

To increase the amount of physical security systems.
To monitor employee attendance.
To identify potential security risks and inform protection strategies (Correct answer)
To reduce the number of employees.

Correct answer: To identify potential security risks and inform protection strategies

A security risk assessment systematically identifies potential threats, vulnerabilities, and the likelihood and impact of security incidents. By understanding these risks, organizations can prioritize and implement appropriate security measures and allocate resources effectively. This ensures that protection strategies are informed, effective, and tailored to the specific risks faced by the facility.

Question 5: The effectiveness of a security awareness program is BEST measured by:

The number of training hours logged per employee
Changes in employee behavior, reduction in security incidents, and improved phishing simulation click rates (Correct answer)
Executive approval of the training materials
The cost per training module delivered

Correct answer: Changes in employee behavior, reduction in security incidents, and improved phishing simulation click rates

Behavioral metrics and incident trend data are the true indicators of whether awareness training is producing the desired security outcomes.

Question 6: An employee needs to hand-carry classified material on a commercial flight. What is required?

Approval from the airline captain
Nothing if the material is double-wrapped
A courier authorization with approval from the FSO and a briefing on courier responsibilities (Correct answer)
Only a note from a supervisor

Correct answer: A courier authorization with approval from the FSO and a briefing on courier responsibilities

Hand-carrying classified material requires formal authorization, an official courier briefing, and a courier card or letter, plus advance coordination with airport security. Material must be properly packaged and inventoried.

Question 7: What is the role of surveillance systems in physical security?

To focus only on monitoring employees.
To monitor and deter unauthorized activities (Correct answer)
To increase the cost of security systems.
To reduce employee morale.

Correct answer: To monitor and deter unauthorized activities

Surveillance systems, such as CCTV cameras, serve as a critical tool for continuous monitoring of an area. Their visible presence acts as a deterrent to potential intruders or malicious activities, while also providing crucial visual evidence for investigations if an incident occurs. This enhances overall security by increasing situational awareness and accountability.

Question 8: In an industrial security information classification scheme, which label typically applies to trade secrets and proprietary formulas?

Internal Use Only
Top Secret
Public
Confidential / Proprietary (Correct answer)

Correct answer: Confidential / Proprietary

Confidential or Proprietary is the standard commercial classification for sensitive business information like trade secrets that require restricted handling.

Question 9: When a document is derived from several classified sources with different declassification instructions, which Declassify On date is applied?

The latest (most restrictive) date (Correct answer)
The date 10 years from creation
The earliest date
The date of the first source listed

Correct answer: The latest (most restrictive) date

Derivative classifiers carry forward the longest duration among the sources to fully protect the information.

Question 10: Which security control is MOST critical when allowing third-party vendors to remotely access ICS/OT systems for maintenance?

Using unencrypted direct modem connections for legacy system compatibility
Granting vendors permanent administrative access to reduce service call delays
Allowing vendors to use their own VPN credentials for convenience
Implementing time-limited, monitored, and audited remote access sessions with least-privilege accounts specific to the maintenance task (Correct answer)

Correct answer: Implementing time-limited, monitored, and audited remote access sessions with least-privilege accounts specific to the maintenance task

Vendor remote access is a major ICS attack vector; time-limited, monitored sessions with just-in-time access dramatically reduce the risk window.

Question 11: Item 1b of a DD Form 254 is marked 'None.' What does this most likely mean?

The contractor will not store classified material at its own facility (Correct answer)
The contractor needs no facility clearance
The contractor may store any level of classified information
The contract is unclassified

Correct answer: The contractor will not store classified material at its own facility

Item 1b states the level of safeguarding required at the contractor's facility; 'None' means no classified storage is needed there.

Question 12: A security investigator discovers a suspicious USB drive in a secured area. The FIRST action should be:

Photograph it in place, document its location, and secure it as evidence without inserting it into any system (Correct answer)
Discard it to prevent further risk to the facility
Plug it into a computer to identify its contents
Hand it to the nearest employee to identify the owner

Correct answer: Photograph it in place, document its location, and secure it as evidence without inserting it into any system

Documenting and preserving the device without connecting it protects both evidence integrity and facility systems from potential malware.

Question 13: A Special Security Agreement (SSA) is used when the foreign interest:

Is a U.S. citizen dual national
Holds only non-voting bonds
Owns no voting stock
Effectively owns or controls the company (Correct answer)

Correct answer: Effectively owns or controls the company

An SSA preserves the foreign owner's ability to participate in management while protecting classified information when it effectively owns or controls the entity.

Question 14: Which U.S. government agency is the primary authority for protecting critical infrastructure cybersecurity and coordinates sector-specific agencies?

Department of Justice (DOJ)
Cybersecurity and Infrastructure Security Agency (CISA) (Correct answer)
National Security Agency (NSA)
Federal Bureau of Investigation (FBI)

Correct answer: Cybersecurity and Infrastructure Security Agency (CISA)

CISA leads national efforts to understand, manage, and reduce risk to cyber and physical infrastructure across the 16 critical infrastructure sectors.

Question 15: Why is it important to have a business continuity plan?

To reduce customer trust.
To decrease operational efficiency.
To ensure that critical operations continue during a crisis (Correct answer)
To increase the likelihood of a crisis.

Correct answer: To ensure that critical operations continue during a crisis

A business continuity plan (BCP) focuses on maintaining essential business functions during and after a disruptive event, such as a natural disaster or cyberattack. It outlines strategies and procedures to minimize downtime, recover critical systems, and ensure the ongoing delivery of products or services. This safeguards an organization's financial stability, customer relationships, and overall operational resilience.

Question 16: Why is post-crisis evaluation important?

To reduce the number of employees.
To avoid repeating mistakes in future crises (Correct answer)
To ignore lessons learned.
To focus only on financial recovery.

Correct answer: To avoid repeating mistakes in future crises

Post-crisis evaluation is crucial for organizational learning and resilience. By thoroughly reviewing the crisis response, organizations can identify what worked well and, more importantly, what went wrong. This analysis allows them to implement corrective actions, refine their crisis management plans, and develop better strategies to prevent or more effectively handle similar incidents in the future, ultimately avoiding the repetition of mistakes.

Question 17: What is the 'whole-person concept' in personnel security adjudication?

Requiring a polygraph for every clearance decision
Evaluating only the most serious derogatory issue
Considering all available reliable information, favorable and unfavorable, past and present (Correct answer)
Interviewing every family member of the applicant

Correct answer: Considering all available reliable information, favorable and unfavorable, past and present

Adjudicators weigh the totality of a person's conduct and circumstances, including mitigating factors.

Question 18: Which type of investigation focuses specifically on determining the root cause of a security system failure rather than identifying a perpetrator?

Root cause analysis (RCA) / technical investigation (Correct answer)
Grand jury investigation
Administrative investigation
Criminal investigation

Correct answer: Root cause analysis (RCA) / technical investigation

RCA investigations analyze system failures, process gaps, or equipment malfunctions to prevent recurrence rather than to assign criminal liability.

Question 19: Which change must a cleared contractor report to DCSA as a changed condition?

Routine office supply purchases
Hiring an uncleared janitor
Updated employee holiday schedule
Change in ownership, including stock transfers affecting control (Correct answer)

Correct answer: Change in ownership, including stock transfers affecting control

Ownership changes affect FCL eligibility and FOCI status and must be reported.

Question 20: An insider threat is BEST defined as a risk posed by which of the following?

Foreign intelligence agents who never entered the facility
Vendors who deliver supplies to the facility
Current or former employees, contractors, or partners who misuse authorized access (Correct answer)
External hackers who gain physical access

Correct answer: Current or former employees, contractors, or partners who misuse authorized access

Insider threats originate from individuals who already have or recently had authorized access and can abuse that trust.

Question 21: For a multiple facility organization, what clearance level must the home office hold relative to cleared branches?

No FCL required
Top Secret only
Same or higher level (Correct answer)
Lower than the branch

Correct answer: Same or higher level

The home office must be cleared at the same or higher level as any cleared branch.

Question 22: Which plan is required under FOCI mitigation to control foreign national access to export-controlled and classified information?

Technology Control Plan (TCP) (Correct answer)
Continuity of Operations Plan
Standard Practice Procedures only
Emergency Action Plan

Correct answer: Technology Control Plan (TCP)

A TCP outlines measures to prevent unauthorized access by foreign persons, including affiliates.

Question 23: How long must an executed SF-312 Classified Information Nondisclosure Agreement be retained?

25 years from the date of signature
50 years from the date of signature (Correct answer)
Until the employee's clearance is terminated
5 years after the employee leaves

Correct answer: 50 years from the date of signature

SF-312s are retained for 50 years from the date signed.

Question 24: An industrial security investigation MUST remain within which legal boundary when interviewing employees?

Employees must be informed of their rights, and interviews must comply with applicable labor and employment law (Correct answer)
Employees may be detained indefinitely pending investigation outcomes
Investigators may use physical coercion if the employee refuses to cooperate
Investigators can review employee medical records without consent

Correct answer: Employees must be informed of their rights, and interviews must comply with applicable labor and employment law

Industrial security investigations must respect labor laws, privacy rights, and employee rights to counsel to avoid legal liability.

Question 25: An employee reports that a coworker has been downloading large volumes of proprietary schematics to a personal USB drive. The FIRST security response should be:

Disable the entire facility's USB ports without investigation
Post a notice about USB policies on the bulletin board
Immediately confront the coworker in front of the team
Document the observation and report it to the insider threat officer or security manager (Correct answer)

Correct answer: Document the observation and report it to the insider threat officer or security manager

Proper reporting to the designated security authority allows a structured investigation without tipping off the subject or compromising evidence.

Question 26: Under Trusted Workforce 2.0, what largely replaces fixed-interval periodic reinvestigations?

Continuous vetting with automated record checks (Correct answer)
Self-certification by the FSO
Annual polygraph examinations
Biennial in-person interviews

Correct answer: Continuous vetting with automated record checks

Continuous vetting uses ongoing automated checks instead of waiting for periodic reinvestigations.

Question 27: Which of the following is an example of a SECOND-TIER supply chain risk?

A subcontractor used by your primary vendor experiencing a data breach (Correct answer)
An internal employee misusing procurement credentials
A natural disaster affecting your own facility
A direct vendor failing to deliver on time

Correct answer: A subcontractor used by your primary vendor experiencing a data breach

Second-tier (or sub-tier) risks involve suppliers of your suppliers; a subcontractor breach can propagate vulnerabilities up through your primary vendor to your organization.

Question 28: A cleared prime contractor wants to award a classified subcontract. What must it confirm about the prospective subcontractor before releasing classified information?

That the subcontractor's employees all hold Top Secret clearances
That the subcontractor has signed an NDA with the GCA
That the subcontractor has an FCL at the required level and adequate safeguarding if storage is needed (Correct answer)
That the subcontractor is a small business

Correct answer: That the subcontractor has an FCL at the required level and adequate safeguarding if storage is needed

The prime must verify the subcontractor's FCL and safeguarding capability before giving it classified access.

Question 29: What is the primary goal of physical security in facility protection?

To minimize employee involvement in security.
To increase facility profits.
To reduce energy consumption.
To protect facilities and assets from physical threats (Correct answer)

Correct answer: To protect facilities and assets from physical threats

Physical security is specifically designed to protect tangible assets, personnel, and the physical environment from harm. Its primary objective is to prevent unauthorized access, theft, vandalism, and other physical threats that could disrupt operations or compromise safety. This ensures the integrity and continuous operation of the facility and its valuable contents.

Question 30: Why is incident response planning important in security risk management?

To ensure a coordinated and effective response to security incidents (Correct answer)
To avoid making security decisions.
To delay response times.
To increase the number of security breaches.

Correct answer: To ensure a coordinated and effective response to security incidents

Incident response planning provides a structured framework for how an organization will react to a security breach or event. A well-defined plan ensures that all necessary steps are taken in a timely and organized manner, minimizing damage, facilitating recovery, and maintaining business continuity. It outlines roles, responsibilities, and procedures, preventing chaos during a crisis.

Question 31: Which is a required element of a contractor insider threat program under 32 CFR Part 117?

Gathering, integrating, and reporting relevant information indicative of a potential insider threat (Correct answer)
Hiring an outside counterintelligence firm
Monitoring of employees' personal social media accounts
Mandatory annual polygraphs for all cleared staff

Correct answer: Gathering, integrating, and reporting relevant information indicative of a potential insider threat

Programs must gather, integrate, and report information that may indicate an insider threat, consistent with the NISPOM.

Question 32: Which artifact is MOST useful in reconstructing the timeline of a cyber incident on a Windows system?

Desktop wallpaper settings
Windows Event Logs (Security, System, Application) (Correct answer)
Browser bookmarks folder
Printer queue history

Correct answer: Windows Event Logs (Security, System, Application)

Windows Event Logs record system events with timestamps, providing the chronological record investigators need to reconstruct an incident.

Question 33: Under 32 CFR Part 117, what is a Facility Security Clearance (FCL)?

A personnel eligibility determination for the company owner
An administrative determination that an entity is eligible for access to classified information at the same or lower classification level (Correct answer)
A physical security approval for a closed area
A contract clause authorizing classified storage

Correct answer: An administrative determination that an entity is eligible for access to classified information at the same or lower classification level

An FCL is an administrative eligibility determination for the entity, not a storage or personnel approval.

Question 34: Visits between the cleared U.S. entity and its foreign parent under an SSA are generally:

Subject to approval and documentation per the affiliated operations and visitation procedures (Correct answer)
Approved automatically by the foreign owner
Prohibited entirely
Only allowed with an embassy escort

Correct answer: Subject to approval and documentation per the affiliated operations and visitation procedures

Visits are permitted but must be approved and recorded under the mitigation agreement's procedures.

Question 35: The concept of 'functional safety' in an industrial security context refers to:

Ensuring the security team's workstations are ergonomically designed
The correct functioning of safety-critical systems that depend on automated protective actions to prevent hazardous conditions (Correct answer)
Annual safety drills for fire evacuations
Personal protective equipment requirements for maintenance staff

Correct answer: The correct functioning of safety-critical systems that depend on automated protective actions to prevent hazardous conditions

Functional safety ensures safety instrumented systems (SIS) operate correctly to automatically protect personnel and equipment from dangerous process conditions.

Question 36: A contractor wants to submit clearance requests for new hires 'just in case' a future contract requires access. Is this allowed?

Yes, to reduce processing time later
No, unless DCSA approves a pre-clearance waiver
No, clearances may be requested only when there is a bona fide need for access (Correct answer)
Yes, if the number does not exceed 10% of the workforce

Correct answer: No, clearances may be requested only when there is a bona fide need for access

Contractors may request PCLs only for employees with a current, legitimate need to access classified information.

Question 37: A cleared contractor learns that an employee was arrested for driving under the influence over the weekend. What should the FSO do?

Suspend the employee's clearance internally and notify the FBI
Wait until the case is resolved in court before reporting
Submit an adverse information report to DCSA through the system of record (Correct answer)
Report it only if the employee is convicted

Correct answer: Submit an adverse information report to DCSA through the system of record

Adverse information about a cleared employee must be reported to the CSA regardless of the outcome of legal proceedings.

Question 38: What is the role of mitigation strategies in security risk management?

To increase costs for security measures.
To eliminate all security threats.
To reduce the impact of identified risks (Correct answer)
To delay security actions.

Correct answer: To reduce the impact of identified risks

Mitigation strategies are specific actions or controls implemented to lessen the likelihood or severity of a security incident once a risk has been identified. While it's often impossible to eliminate all risks, mitigation aims to bring them down to an acceptable level. This involves implementing safeguards, policies, and procedures to minimize potential harm.

Question 39: Which federal regulation requires industrial facilities to develop and maintain Emergency Response Plans for hazardous chemical releases?

OSHA 29 CFR 1910.119 (PSM)
EPA 40 CFR Part 68 (RMP)
OSHA 29 CFR 1910.120 (HAZWOPER)
Both OSHA 29 CFR 1910.120 and EPA 40 CFR Part 68 (Correct answer)

Correct answer: Both OSHA 29 CFR 1910.120 and EPA 40 CFR Part 68

HAZWOPER (1910.120) governs emergency response operations for hazardous substance releases, while EPA's RMP (40 CFR 68) requires separate emergency response program elements for covered facilities.

Question 40: Which branch office form documents a cleared branch's security agreement?

DD Form 254
DD Form 441-1 (Correct answer)
SF 86
SF 328

Correct answer: DD Form 441-1

DD Form 441-1 is the appendage used for cleared branch or division offices.

Question 41: For FOCI-mitigated companies, outside directors must be:

Foreign nationals approved by the parent
Current employees of the company
Members of the GCA
U.S. citizens eligible for a personnel security clearance with no prior ties to the foreign interest (Correct answer)

Correct answer: U.S. citizens eligible for a personnel security clearance with no prior ties to the foreign interest

Outside directors must be cleared-eligible U.S. citizens independent of the foreign interest.

Question 42: Which of the following is NOT one of the 13 Adjudicative Guidelines under SEAD 4?

Drug Involvement
Allegiance to the United States
Sexual Behavior
Physical Fitness Standards (Correct answer)

Correct answer: Physical Fitness Standards

Physical fitness is not an adjudicative guideline; the 13 guidelines focus on loyalty, conduct, and character issues relevant to trustworthiness.

Question 43: A non-U.S. citizen with unique, needed expertise requires limited access to classified information. What may be granted?

A reciprocal clearance from their home country
A facility clearance
A Limited Access Authorization (LAA) (Correct answer)
An interim Secret clearance

Correct answer: A Limited Access Authorization (LAA)

Non-U.S. citizens are ineligible for clearances but may receive an LAA in rare, justified circumstances.

Question 44: Which event does NOT by itself require a security container combination change?

The container is first put into use
Someone who knows the combination no longer needs access
The combination is suspected of being compromised
A cleared visitor sees the container from across the room (Correct answer)

Correct answer: A cleared visitor sees the container from across the room

Combinations change at first use, when an authorized person no longer needs access, or on compromise; merely seeing the container is not one of these.

Question 45: An employee hand-carries Secret documents to another cleared facility in a locked briefcase. How does the briefcase count toward wrapping requirements?

It is not allowed for hand-carry
It counts only as the inner wrapper
It replaces both wrappers
It may serve as the outer wrapper (Correct answer)

Correct answer: It may serve as the outer wrapper

A locked briefcase or similar container may serve as the outer wrapper, but the material still needs an inner wrapper.

Question 46: Which committee oversees the implementation of FOCI mitigation measures at an SSA or SCA company?

The Government Security Committee (GSC) (Correct answer)
The Audit Committee
The Compensation Committee
The Insider Threat Working Group

Correct answer: The Government Security Committee (GSC)

The GSC, made up of outside directors and cleared officers, oversees security and FOCI compliance.

Question 47: How often should cleared personnel typically receive refresher security training?

Once during initial hiring only
Only after a security violation occurs
At least annually, with additional training when threats or requirements change (Correct answer)
Every five years aligned with reinvestigation cycles

Correct answer: At least annually, with additional training when threats or requirements change

Annual refresher training keeps employees current on evolving threats and reinforces security responsibilities throughout their tenure.

Question 48: When must a security incident be reported to the relevant government authority in a cleared industrial facility?

Never—all incidents are handled internally without government notification
Only if classified information was confirmed as compromised
Only after a full internal investigation is complete
Whenever a reportable security incident occurs, per the facility's reporting requirements and DD Form 577 obligations (Correct answer)

Correct answer: Whenever a reportable security incident occurs, per the facility's reporting requirements and DD Form 577 obligations

Government-cleared facilities are obligated to report security incidents to their Cognizant Security Agency (CSA) as specified in their facility clearance agreement.

Question 49: What is the role of security audits in ensuring compliance?

To increase security costs.
To ensure security measures meet legal standards and identify gaps (Correct answer)
To reduce the number of security cameras.
To monitor employee productivity.

Correct answer: To ensure security measures meet legal standards and identify gaps

Security audits specifically assess whether an organization's security practices align with relevant laws, regulations, and industry standards. They help identify any deviations or gaps in compliance, allowing the organization to implement corrective actions before they lead to penalties or legal issues. This proactive approach ensures that security measures meet legal requirements and helps maintain a strong compliance posture.

Question 50: Travel briefings for employees visiting high-threat countries should include information on:

Currency exchange rates and tourist attractions
Airline loyalty program benefits for frequent travelers
Visa application fees and baggage allowance policies
Foreign intelligence collection techniques, communication security, and procedures for reporting suspicious contacts during travel (Correct answer)

Correct answer: Foreign intelligence collection techniques, communication security, and procedures for reporting suspicious contacts during travel

Travel briefings prepare employees to recognize and counter foreign intelligence threats that commonly target business travelers in high-threat countries.

Question 51: Which mitigation instruments generally allow the entity to access classified information without NIDs because the foreign owner is effectively insulated?

Board Resolution and SCA
SSA only
Proxy Agreement and Voting Trust Agreement (Correct answer)
Limited FCL

Correct answer: Proxy Agreement and Voting Trust Agreement

Proxy and voting trust arrangements insulate the entity so it is not denied access due to FOCI, so no NID is required.

Question 52: A 'continuous evaluation' program in personnel security is designed to:

Conduct a new full background investigation every five years
Replace the initial security clearance investigation
Evaluate employee performance on a monthly basis
Monitor cleared individuals for concerning behaviors between periodic reinvestigations (Correct answer)

Correct answer: Monitor cleared individuals for concerning behaviors between periodic reinvestigations

Continuous evaluation uses automated record checks to flag relevant derogatory information between reinvestigations without waiting for a scheduled review.

Question 53: Which of the following BEST describes the primary goal of supply chain security in an industrial environment?

Ensuring integrity, authenticity, and continuity of goods and services throughout the supply chain (Correct answer)
Reducing procurement costs through vendor consolidation
Limiting the number of approved suppliers to two or fewer
Automating vendor contract negotiations

Correct answer: Ensuring integrity, authenticity, and continuity of goods and services throughout the supply chain

Supply chain security aims to protect the integrity, authenticity, and continuity of products and services from origin through delivery to the end user.

Question 54: Which type of approved foreign visit covers intermittent visits to the same facility over a set period, usually up to one year?

Emergency visit
Extended visit
One-time visit
Recurring visit (Correct answer)

Correct answer: Recurring visit

Recurring visit authorizations allow repeated visits to the same facility over an approved period for a specific program or contract.

Question 55: Which training element is MOST effective at reducing successful phishing attacks?

Blocking all external email from reaching employee inboxes
Regular simulated phishing campaigns followed by immediate targeted training for those who click (Correct answer)
Requiring employees to read and sign an anti-phishing policy
Annual slideshow presentations about phishing statistics

Correct answer: Regular simulated phishing campaigns followed by immediate targeted training for those who click

Simulated phishing with real-time, just-in-time training for those who fall for it creates a teachable moment directly tied to the behavior you want to change.

Question 56: Classified information may be transferred to a foreign government only through:

Any registered mail service
Email with encryption
Commercial courier
Government-to-government channels (Correct answer)

Correct answer: Government-to-government channels

International transfers of classified material must take place through government-to-government channels, such as diplomatic pouches or authorized government representatives, with receipts and written assurances.

Question 57: Which federal guideline governs adjudicative standards for personnel security clearances in U.S. industrial environments?

Title 18 U.S. Code Section 1030
ISO 27001 Annex A
The 13 Adjudicative Guidelines (Security Executive Agent Directive 4) (Correct answer)
NIST SP 800-53

Correct answer: The 13 Adjudicative Guidelines (Security Executive Agent Directive 4)

SEAD 4 establishes the 13 Adjudicative Guidelines used to evaluate individuals for U.S. government-related security clearances.

Question 58: Which classification level applies to information whose unauthorized disclosure could reasonably be expected to cause serious damage to national security?

CUI
Confidential
Top Secret
Secret (Correct answer)

Correct answer: Secret

Confidential means damage, Secret means serious damage, and Top Secret means exceptionally grave damage to national security. CUI is not classified.

Question 59: Which State Department license is used for the permanent export of unclassified defense articles and technical data?

DSP-73
DSP-61
DSP-85
DSP-5 (Correct answer)

Correct answer: DSP-5

The DSP-5 is the license for permanent export of unclassified defense articles and related technical data.

Question 60: What is a 'zero-day vulnerability'?

A software flaw unknown to the vendor for which no patch exists at the time of discovery or exploitation (Correct answer)
A flaw in a zero-trust network architecture
A vulnerability discovered exactly at midnight
A vulnerability with no exploits available in any threat database

Correct answer: A software flaw unknown to the vendor for which no patch exists at the time of discovery or exploitation

Zero-day vulnerabilities are particularly dangerous because defenders have 'zero days' to patch before the flaw can be exploited.

Question 61: How can perimeter security help protect a facility?

By reducing security surveillance.
By increasing facility use for non-security purposes.
By increasing the number of security guards.
By blocking unauthorized access and enhancing protection (Correct answer)

Correct answer: By blocking unauthorized access and enhancing protection

Perimeter security establishes a clear boundary around a facility, acting as the first line of defense against external threats. Elements like fences, gates, and intrusion detection systems are designed to detect, deter, and delay unauthorized entry. This helps to control access to the entire property and provides early warning of potential security breaches.

Question 62: Which regulation, administered by the State Department's Directorate of Defense Trade Controls, governs the export of defense articles and services?

Federal Acquisition Regulation (FAR)
Privacy Act
International Traffic in Arms Regulations (ITAR) (Correct answer)
Export Administration Regulations (EAR)

Correct answer: International Traffic in Arms Regulations (ITAR)

ITAR governs items on the United States Munitions List and is administered by DDTC. The EAR is administered by the Commerce Department's Bureau of Industry and Security and covers dual-use items.

Question 63: Which adjudicative guideline addresses actions such as exercising rights of a foreign citizenship over U.S. citizenship?

Guideline E – Personal Conduct
Guideline C – Foreign Preference (Correct answer)
Guideline B – Foreign Influence
Guideline A – Allegiance to the United States

Correct answer: Guideline C – Foreign Preference

Guideline C covers acting in preference to a foreign country, such as exercising foreign citizenship rights.

Question 64: Which form must a company complete to disclose foreign ownership, control, or influence for facility clearance purposes?

SF 86
SF 312
DD Form 254
SF 328 (Correct answer)

Correct answer: SF 328

The SF 328, Certificate Pertaining to Foreign Interests, is used to report FOCI factors to the cognizant security agency.

Question 65: When does information become classified by compilation?

When combining individually unclassified items reveals a relationship that meets classification standards (Correct answer)
Any time more than 10 unclassified items appear in a document
Whenever a document cites a Secret source
Only when the GCA lists the items in a DD Form 254 annex

Correct answer: When combining individually unclassified items reveals a relationship that meets classification standards

Compilation applies when the combination of items reveals an additional relationship that is not apparent from any single item.

Question 66: How can technology support security risk management?

By limiting access to sensitive areas.
By enhancing monitoring, detection, and response capabilities (Correct answer)
By focusing only on physical barriers.
By reducing the number of security guards.

Correct answer: By enhancing monitoring, detection, and response capabilities

Technology provides advanced tools like surveillance systems, access control, intrusion detection, and cybersecurity software that significantly bolster security efforts. These technologies enable continuous monitoring, rapid detection of anomalies, and automated responses to potential threats. They extend the reach and effectiveness of human security personnel, creating a more robust defense.

Question 67: Which factor MOST significantly affects how quickly an industrial facility can recover from a major security incident?

The size of the facility's security department
Pre-incident planning, resource staging, and rehearsed recovery procedures (Correct answer)
The number of government agencies involved in the response
The age of the facility's physical infrastructure

Correct answer: Pre-incident planning, resource staging, and rehearsed recovery procedures

Facilities that have pre-planned, resourced, and rehearsed recovery procedures consistently achieve faster and more complete recovery than those relying on improvised responses.

Question 68: A parent company owns a subsidiary that needs a Secret FCL. What is generally required of the parent?

The parent must hold an FCL at the same or higher level, or be formally excluded from access (Correct answer)
Nothing; parents are never evaluated
The parent must sign a Proxy Agreement
The parent must hold a Top Secret FCL

Correct answer: The parent must hold an FCL at the same or higher level, or be formally excluded from access

The parent must be cleared at the same or higher level as the subsidiary or be excluded via board action.

Question 69: Which three items typically make up the classification authority block on a derivatively classified document?

Author, Reviewer, Date
Classified By, Derived From, Declassify On (Correct answer)
Owner, Custodian, Expiry
Created By, Approved By, Filed On

Correct answer: Classified By, Derived From, Declassify On

A derivatively classified document shows the derivative classifier ('Classified By'), the source or guide ('Derived From'), and the declassification instruction ('Declassify On').

Question 70: How do physical barriers contribute to facility protection?

By reducing employee productivity.
By improving facility aesthetics.
By increasing the amount of security staff.
By blocking unauthorized access to sensitive areas (Correct answer)

Correct answer: By blocking unauthorized access to sensitive areas

Physical barriers, such as fences, walls, gates, and reinforced doors, create tangible obstacles to entry. They are specifically designed to delay, deter, or prevent unauthorized individuals from gaining access to a facility or specific secure zones within it. These barriers form a crucial first line of defense in a layered security strategy.

Question 71: Which population typically receives the MOST targeted security training in an industrial facility due to their elevated access?

Systems administrators, security managers, and executives with privileged access (Correct answer)
Cafeteria and janitorial staff
Marketing and public relations teams
New employees in their first two weeks

Correct answer: Systems administrators, security managers, and executives with privileged access

Privileged users with elevated access to critical systems pose greater risk and require role-specific training beyond general awareness.

Question 72: What is the importance of regular security audits?

To reduce security costs.
To limit employee involvement.
To ensure security measures are working and identify areas for improvement (Correct answer)
To increase security breaches.

Correct answer: To ensure security measures are working and identify areas for improvement

Regular security audits are essential for continuously assessing the effectiveness of existing security controls and identifying any vulnerabilities or outdated practices. They help ensure that security measures are functioning as intended and highlight areas that require improvement or updating. This proactive evaluation allows organizations to adapt and strengthen their security posture against evolving threats.

Question 73: Which NIST publication provides the catalog of security and privacy controls selected during the Risk Management Framework process?

NIST SP 800-53 (Correct answer)
NIST SP 800-61
NIST SP 800-30
NIST SP 800-88

Correct answer: NIST SP 800-53

NIST SP 800-53 is the control catalog used to select and tailor baselines in RMF.

Question 74: What is the purpose of a security clearance adjudication?

To determine whether granting access is clearly consistent with national or industrial security interests (Correct answer)
To terminate employees who fail polygraph examinations
To assign an employee's access level based solely on job title
To issue an employee identification badge

Correct answer: To determine whether granting access is clearly consistent with national or industrial security interests

Adjudication evaluates all available information to decide if an individual's access is consistent with security interests.

Question 75: Why are security personnel an essential part of physical security?

To focus only on security system maintenance.
To act as customer service representatives.
To provide physical protection and respond to security events (Correct answer)
To manage office supplies.

Correct answer: To provide physical protection and respond to security events

Security personnel are trained professionals who provide a vital human element to physical security. They actively patrol, monitor systems, enforce policies, and are capable of direct intervention during security incidents. Their presence and ability to respond quickly are crucial for mitigating threats, protecting assets, and ensuring the safety of individuals within the facility.

Question 76: Which USPS service is authorized for transmitting Confidential material but NOT Secret material?

Priority Mail Express
Registered Mail
Certified Mail (Correct answer)
Defense Courier Service

Correct answer: Certified Mail

Certified Mail is acceptable for Confidential but does not provide the protection required for Secret.

Question 77: What is the purpose of a security incident log?

To publicly share breach information with competitors
To replace the need for an incident response plan
To track employee vacation schedules during incidents
To create an auditable record of all events, actions taken, and decision points during an investigation (Correct answer)

Correct answer: To create an auditable record of all events, actions taken, and decision points during an investigation

Incident logs provide the documentary trail needed for post-incident review, legal proceedings, insurance claims, and regulatory reporting.

Question 78: A termination security briefing (debriefing) of a cleared employee should PRIMARILY cover:

Performance review documentation
Employee benefits continuation options (COBRA)
Future employment opportunities within the company
Continuing obligations to protect classified information and prohibited post-employment disclosures (Correct answer)

Correct answer: Continuing obligations to protect classified information and prohibited post-employment disclosures

Termination debriefings remind departing cleared employees that their security obligations do not end with employment and may be lifelong.

Question 79: A contractor holding foreign government information (FGI) receives a request to share it with a third country. What is required?

Consent of the originating foreign government (Correct answer)
Approval from the contractor's FSO
Nothing, if the third country is a NATO member
A DSP-5 license only

Correct answer: Consent of the originating foreign government

FGI may not be released to a third country or third party without the prior consent of the originating government.

Question 80: A hazardous material release at an industrial site triggers shelter-in-place orders. Which action should be taken FIRST?

Call local fire department before taking any protective action
Evacuate all personnel immediately through the main gate
Distribute personal protective equipment to all employees
Seal air intakes and move personnel to interior rooms (Correct answer)

Correct answer: Seal air intakes and move personnel to interior rooms

Shelter-in-place requires immediately sealing ventilation pathways and moving personnel to protected interior areas before any outward-facing actions.

Question 81: What role does communication play in crisis management?

It helps to escalate the crisis.
It increases confusion during the crisis.
It limits the flow of information.
It ensures that all stakeholders are informed and response efforts are coordinated (Correct answer)

Correct answer: It ensures that all stakeholders are informed and response efforts are coordinated

Effective communication is paramount during a crisis to manage perceptions, provide accurate information, and prevent misinformation. It ensures that all stakeholders, including employees, customers, and media, receive timely updates, fostering trust and enabling coordinated actions. Clear and consistent communication helps maintain control, guides the response effort, and protects the organization's reputation.

Question 82: A phishing email that targets a specific senior executive is known as:

Vishing
Whaling (Correct answer)
Spear phishing
Smishing

Correct answer: Whaling

Whaling is a form of spear phishing specifically aimed at high-value targets such as executives or key decision-makers.

Question 83: A security manager wants to assess whether employees understand how to report a suspicious contact. The BEST assessment method is:

A realistic scenario exercise requiring employees to demonstrate the actual reporting process (Correct answer)
A written multiple-choice test on reporting procedures
Asking employees informally in the hallway if they know the procedure
Reviewing attendance records for the last security briefing

Correct answer: A realistic scenario exercise requiring employees to demonstrate the actual reporting process

Practical performance assessments test whether employees can actually execute the reporting process, not just recall it on a test.

Question 84: Which federal specification applies to high-security locks on GSA-approved containers and vault doors?

MIL-STD-810
FF-L-2740 (Correct answer)
FIPS 140-2
NIST SP 800-53

Correct answer: FF-L-2740

FF-L-2740 is the federal specification for the high-security combination locks used on classified containers and doors.

Question 85: What must a cleared contractor employee receive before accessing NATO classified information?

A polygraph examination
A NATO security briefing (Correct answer)
A Limited Access Authorization
An ITAR registration certificate

Correct answer: A NATO security briefing

Employees need an appropriate clearance and a NATO security briefing before accessing NATO classified information.

Question 86: When multiple source documents are used to derivatively classify a new document, what should appear on the 'Derived From' line?

The name of the newest source only
The name of the document's author
'Multiple Sources', with a list of the sources kept with the file copy (Correct answer)
Nothing, because it is optional

Correct answer: 'Multiple Sources', with a list of the sources kept with the file copy

For more than one source, 'Multiple Sources' is annotated on the Derived From line. A list of the sources must be maintained with the file or record copy of the document.

Question 87: A cleared contractor has a non-U.S. citizen employee who needs access to SECRET information. What authorization might be granted?

Limited Access Authorization (Correct answer)
Interim Top Secret clearance
Reciprocal SCI eligibility
Foreign national PCL waiver

Correct answer: Limited Access Authorization

A Limited Access Authorization (LAA) may let a non-U.S. citizen access information up to SECRET, but never Top Secret, COMSEC, or intelligence information.

Question 88: Which threat actor type poses the GREATEST risk to critical national infrastructure due to their resources and long-term strategic objectives?

Script kiddies using publicly available exploit tools
Opportunistic ransomware criminals targeting random organizations
Nation-state Advanced Persistent Threat (APT) groups (Correct answer)
Disgruntled former employees with residual access

Correct answer: Nation-state Advanced Persistent Threat (APT) groups

Nation-state APT groups have significant resources, technical sophistication, and long-term strategic patience that makes them uniquely dangerous to critical infrastructure.

Question 89: Which USPS method is authorized for a cleared contractor to send Secret material within the United States?

Certified Mail
Registered Mail (Correct answer)
First Class Mail
Media Mail

Correct answer: Registered Mail

Secret material may be sent within the US by USPS Registered Mail (or Priority Mail Express under set conditions), not Certified or First Class.

Question 90: Why is access control important in facility security?

To limit access to secure areas and protect sensitive information (Correct answer)
To allow unrestricted access to all employees.
To monitor employee attendance.
To reduce security staff.

Correct answer: To limit access to secure areas and protect sensitive information

Access control systems are fundamental to facility security as they regulate who can enter specific areas and at what times. By restricting entry to only authorized personnel, these systems prevent unauthorized individuals from reaching sensitive information, critical infrastructure, or valuable assets. This is essential for maintaining security, confidentiality, and operational integrity.

Question 91: Which process is used to verify that employees only retain access rights appropriate to their current role?

Access recertification or entitlement review (Correct answer)
Annual security awareness training
Visitor log auditing
Periodic reinvestigation

Correct answer: Access recertification or entitlement review

Access recertification (entitlement review) is the formal process of confirming that each user's permissions still match their job requirements.

Question 92: A contractor employee believes a DD Form 254 has assigned the wrong classification to an item. What is the proper action?

Destroy the item to prevent over-classification
Formally challenge it through the GCA while protecting the information at its current level (Correct answer)
Ignore the guidance and mark the item at the level they think is correct
Post the concern in an unclassified company forum

Correct answer: Formally challenge it through the GCA while protecting the information at its current level

Authorized holders are encouraged to challenge classification through proper channels but must keep protecting the information at its assigned level until it is resolved.

Question 93: How can security policies help prevent data breaches?

By promoting unrestricted access to data.
By increasing security system complexity.
By providing clear guidelines for protecting data from breaches (Correct answer)
By eliminating all forms of data monitoring.

Correct answer: By providing clear guidelines for protecting data from breaches

Security policies outline specific procedures and controls for data handling, access, storage, and transmission within an organization. By mandating practices like strong passwords, encryption, regular backups, and least privilege access, they significantly reduce the risk of data breaches. These clear guidelines ensure employees understand their responsibilities in protecting sensitive information.

Question 94: Why is compliance with legal and regulatory requirements important for security management?

To limit security system installation.
To avoid employee accountability.
To increase the number of security personnel.
To avoid legal penalties and protect organizational reputation (Correct answer)

Correct answer: To avoid legal penalties and protect organizational reputation

Compliance with legal and regulatory requirements is crucial because failure to adhere to these standards can result in significant financial penalties, legal action, and severe damage to an organization's reputation. Adhering to these mandates demonstrates due diligence and a commitment to security, fostering trust with customers, partners, and stakeholders. It also helps avoid operational disruptions caused by non-compliance issues.

Question 95: Confidential material at a cleared contractor facility may be stored in which of the following?

Only a vault with IDS
A locked desk drawer
A steel filing cabinet with a bar and padlock, without CSA approval
A GSA-approved security container, without supplemental controls (Correct answer)

Correct answer: A GSA-approved security container, without supplemental controls

Confidential can be stored like Secret in a GSA-approved container, but it does not need supplemental controls.

Question 96: An engineer with a Secret clearance files for Chapter 7 bankruptcy. Which adjudicative guideline is most directly implicated?

Guideline E – Personal Conduct
Guideline L – Outside Activities
Guideline F – Financial Considerations (Correct answer)
Guideline K – Handling Protected Information

Correct answer: Guideline F – Financial Considerations

Bankruptcy and financial distress fall under Guideline F, Financial Considerations.

Question 97: Which of these is a prohibited reason for classifying information under EO 13526?

Protecting vulnerabilities of systems relating to national security
Protecting intelligence sources and methods
Concealing administrative error or preventing embarrassment (Correct answer)
Protecting military plans and weapons systems

Correct answer: Concealing administrative error or preventing embarrassment

EO 13526 Section 1.7 forbids classification to conceal violations of law, inefficiency, error, or embarrassment.

Question 98: An approved foreign visitor asks to see classified information related to, but outside the scope of, the approved visit request. The host should:

Decline, since disclosure is limited to what the visit authorization approved (Correct answer)
Release it if the visitor holds an equivalent foreign clearance
Release it with a verbal approval from the program manager
Release it after the visitor signs an NDA

Correct answer: Decline, since disclosure is limited to what the visit authorization approved

Disclosures to foreign visitors must not go beyond the information specifically authorized in the approved visit request and disclosure authorization.

Question 99: What does the term 'vendor lock-in' represent as a supply chain security concern?

A vendor physically securing their facility
A security feature that limits vendor system access
Excessive dependence on a single vendor that limits an organization's ability to switch suppliers (Correct answer)
A contractual clause preventing vendors from disclosing pricing

Correct answer: Excessive dependence on a single vendor that limits an organization's ability to switch suppliers

Vendor lock-in creates a single point of failure and reduces negotiating leverage, making the organization vulnerable if that vendor is compromised, disrupted, or becomes adversarial.

Question 100: When integrating cybersecurity into a new industrial system design, the approach of building security in from the start rather than adding it later is known as:

Retrospective security hardening
Security theater
Compliance-driven patching
Secure-by-design (or security-by-design) (Correct answer)

Correct answer: Secure-by-design (or security-by-design)

Secure-by-design embeds security requirements into system architecture from the earliest design phase, reducing the cost and risk of retrofitting controls later.

Question 101: Who grants the authorization to operate (ATO) for a contractor classified information system under DCSA cognizance?

The Government Contracting Activity's program manager
The DCSA Authorizing Official (Correct answer)
The contractor's ISSM
The Facility Security Officer

Correct answer: The DCSA Authorizing Official

The DCSA Authorizing Official makes the risk-based decision to authorize contractor classified systems.

Question 102: Which federal law requires agencies to develop, document, and implement agency-wide information security programs?

Atomic Energy Act
Federal Information Security Modernization Act (FISMA) (Correct answer)
Privacy Act of 1974
Clinger-Cohen Act

Correct answer: Federal Information Security Modernization Act (FISMA)

FISMA establishes the federal information security program framework that NIST guidance implements.

Question 103: During a container's period of use, where is the SF 700 copy holding the combination kept?

In the container itself for convenience
Sealed in its envelope and stored in a different container cleared to the same level or higher (Correct answer)
Taped inside the container drawer
With the FSO's personal records at home

Correct answer: Sealed in its envelope and stored in a different container cleared to the same level or higher

Part 2A of the SF 700 is sealed and kept in a separate container approved for the classification level of the protected material.

Question 104: What must happen when a cleared employee terminates employment with a contractor?

The employee's SF-312 is shredded
The employee keeps access until the clearance expires
DCSA conducts an exit interview with the employee
The contractor debriefs the employee and updates the system of record (Correct answer)

Correct answer: The contractor debriefs the employee and updates the system of record

Departing employees are debriefed and their access is removed in the system of record.

Question 105: When must the combination to a security container be changed?

Only once a year on January 1
When first placed into use, when someone with knowledge of it departs or loses access, when it is compromised, or when the container is taken out of service (Correct answer)
Every 30 days without exception
Only when the container is replaced

Correct answer: When first placed into use, when someone with knowledge of it departs or loses access, when it is compromised, or when the container is taken out of service

Combinations must be changed on initial use, on departure or loss of clearance of anyone who knows them, on suspected compromise, and when the container is taken out of service (reset to the factory standard 50-25-50).

Question 106: Which NIST publication specifies requirements for protecting Controlled Unclassified Information (CUI) on nonfederal contractor systems?

NIST SP 800-37
NIST SP 800-53A
NIST SP 800-63
NIST SP 800-171 (Correct answer)

Correct answer: NIST SP 800-171

NIST SP 800-171 sets the security requirements DFARS 252.204-7012 requires for CUI on contractor systems.

Question 107: What is the primary legal reason for maintaining a 'chain of custody' during a security investigation?

To assign blame quickly within the organization
To preserve the integrity and admissibility of evidence in legal or disciplinary proceedings (Correct answer)
To comply with annual audit requirements
To ensure the fastest possible resolution of the incident

Correct answer: To preserve the integrity and admissibility of evidence in legal or disciplinary proceedings

Proper chain of custody documents who handled evidence and when, ensuring it has not been tampered with and remains legally admissible.

Question 108: Which phase of an incident response plan involves returning systems to normal operations after a security event?

Identification
Lessons Learned
Recovery (Correct answer)
Containment

Correct answer: Recovery

The recovery phase restores affected systems and verifies they are clean and functional before returning them to production.

Question 109: Which access control model grants permissions based on a user's job function rather than individual identity?

Role-Based Access Control (RBAC) (Correct answer)
Discretionary Access Control (DAC)
Mandatory Access Control (MAC)
Attribute-Based Access Control (ABAC)

Correct answer: Role-Based Access Control (RBAC)

RBAC assigns permissions to roles rather than individuals, simplifying administration and enforcing least privilege by job function.

Question 110: Why is leadership important in crisis management?

To focus only on business continuity.
To delay the decision-making process.
To ensure that decisions are made quickly and effectively (Correct answer)
To ignore the crisis until it passes.

Correct answer: To ensure that decisions are made quickly and effectively

Strong leadership is critical during a crisis to provide clear direction, make swift and informed decisions under immense pressure, and maintain calm among the team. Leaders guide the crisis management team, allocate resources effectively, and communicate the organization's stance to internal and external stakeholders. Their decisive actions are essential for navigating the crisis successfully and minimizing its impact.

Question 111: Which security vetting tool requires the subject to disclose foreign contacts, travel, and financial information?

IRS Form W-4
OSHA 300 Log
Form I-9 (Employment Eligibility Verification)
Standard Form 86 (Questionnaire for National Security Positions) (Correct answer)

Correct answer: Standard Form 86 (Questionnaire for National Security Positions)

SF-86 is the U.S. government form used to collect the personal history needed to conduct a national security background investigation.

Question 112: In incident response, 'scope creep' during the containment phase refers to:

Adding additional security analysts to speed up the investigation
Increasing the severity rating of an incident after new evidence is found
Documenting more detail than required in the incident report
Expanding the investigation to include unrelated systems unnecessarily, prolonging downtime (Correct answer)

Correct answer: Expanding the investigation to include unrelated systems unnecessarily, prolonging downtime

Scope creep in containment can take more systems offline than necessary, causing excessive business disruption beyond what the incident warrants.

Question 113: What is the role of confidentiality in security policies?

To reduce the use of encryption.
To protect sensitive information from unauthorized access (Correct answer)
To limit the number of employees.
To increase the level of public access.

Correct answer: To protect sensitive information from unauthorized access

Confidentiality is a core principle of information security, ensuring that sensitive data is accessible only to authorized individuals. Security policies establish clear rules for handling, storing, and transmitting such information, preventing its unauthorized disclosure to those without a legitimate need-to-know. This safeguards privacy, proprietary data, and intellectual property from compromise.

Question 114: Presidential Policy Directive 21 (PPD-21) identifies how many critical infrastructure sectors in the United States?

16 (Correct answer)
21
12
8

Correct answer: 16

PPD-21 designates 16 critical infrastructure sectors, each with a designated Sector Risk Management Agency (SRMA) responsible for sector-specific guidance.

Question 115: A company discovers that a critical component supplier has been acquired by a foreign entity with potential ties to a nation-state adversary. What is the MOST appropriate immediate action?

Immediately terminate the contract without further review
Continue business as usual until the next contract renewal
Report the acquisition to the media
Conduct a supply chain risk assessment and consider alternative suppliers (Correct answer)

Correct answer: Conduct a supply chain risk assessment and consider alternative suppliers

A supply chain risk assessment allows the organization to evaluate the actual threat level and develop an informed mitigation strategy, including identifying alternative suppliers if necessary.

Question 116: A cleared contractor creates a new document using information from a classified source document. This activity is called:

Downgrading
Derivative classification (Correct answer)
Declassification
Original classification

Correct answer: Derivative classification

Derivative classification is incorporating, paraphrasing or restating already-classified information in a new document and marking it according to the source or a security classification guide. Contractors perform derivative classification, not original classification.

Question 117: Within an ITAR-registered company, who is authorized to sign export license applications and has the authority to refuse to proceed with a transaction?

Contracting Officer's Representative
Insider Threat Program Senior Official
Empowered Official (Correct answer)
Facility Security Officer

Correct answer: Empowered Official

An Empowered Official is a company employee legally authorized to sign license applications and empowered to stop any export transaction.

Question 118: The 'need-to-know' principle in personnel security means:

Any cleared employee may access all information at their clearance level
Access to specific information is granted only when operationally necessary for assigned duties (Correct answer)
Employees need to know all security procedures regardless of role
Managers must know all employees' personal background information

Correct answer: Access to specific information is granted only when operationally necessary for assigned duties

Need-to-know limits access to information to only what is required for a person to perform their specific job functions.

Question 119: What is a 'counterfeit part' in the context of supply chain security?

A part manufactured by an unapproved domestic supplier
A part that fails quality inspection due to manufacturing defects
An item that is a copy, imitation, or substitute that has been misrepresented as genuine (Correct answer)
A surplus part sold at a reduced price

Correct answer: An item that is a copy, imitation, or substitute that has been misrepresented as genuine

A counterfeit part is misrepresented as genuine or authorized, posing safety and security risks especially in critical industrial systems.

Question 120: Social engineering targeting employees is BEST countered by:

Ongoing security awareness training and clear reporting procedures (Correct answer)
Restricting all employee communication with external parties
Requiring managers to approve every employee decision
Installing email filters that block all external messages

Correct answer: Ongoing security awareness training and clear reporting procedures

Awareness training equips employees to recognize social engineering tactics and empowers them to report suspicious contacts.

Question 121: A security manager discovers that a former employee's access credentials were used to log in two weeks after termination. This indicates a failure in:

Annual penetration testing processes
Fire suppression system maintenance
Physical perimeter control
Access termination and offboarding procedures (Correct answer)

Correct answer: Access termination and offboarding procedures

Access that survives beyond an employee's departure indicates the offboarding process failed to revoke credentials in a timely manner.

Question 122: What is the role of continuous monitoring in security risk management?

It reduces the need for employee training.
It increases the risk of security breaches.
It eliminates the need for preventive measures.
It helps identify emerging threats in real-time (Correct answer)

Correct answer: It helps identify emerging threats in real-time

Continuous monitoring involves constantly observing and analyzing security systems, networks, and environments for any unusual activity or new vulnerabilities. This ongoing vigilance allows organizations to detect and respond to emerging threats, changes in risk profiles, or failures in existing controls promptly. It's crucial for maintaining an adaptive and resilient security posture against evolving dangers.

Question 123: Which industrial control system (ICS) protocol is most commonly targeted by adversaries due to its lack of built-in authentication?

SSH
HTTPS
Modbus (Correct answer)
TLS 1.3

Correct answer: Modbus

Modbus was designed for reliability in isolated networks and lacks authentication, making it vulnerable when exposed to broader networks.

Question 124: The 'lessons learned' phase of incident response primarily aims to:

Identify what worked, what failed, and how to improve processes and controls to prevent recurrence (Correct answer)
Archive the incident report and close the ticket permanently
Notify external media about the security breach
Assign blame and initiate disciplinary actions against responsible personnel

Correct answer: Identify what worked, what failed, and how to improve processes and controls to prevent recurrence

Lessons learned transform incident experience into measurable improvements in security posture, policy, and training.

Question 125: Which of the following key management personnel must always be cleared to the level of the facility clearance?

All company shareholders
Senior Management Official, Facility Security Officer and Insider Threat Program Senior Official (Correct answer)
Every employee in the facility
Only the receptionist and the janitorial staff

Correct answer: Senior Management Official, Facility Security Officer and Insider Threat Program Senior Official

The SMO, FSO and ITPSO must be cleared to the level of the facility clearance, along with other officials as determined by DCSA. Other board members or officers may be excluded from access through a formal exclusion resolution.

Question 126: When investigating a suspected theft of trade secrets, which type of specialist should typically be involved?

Customer service manager
Legal counsel with IP and employment law expertise (Correct answer)
Payroll administrator
Marketing analyst

Correct answer: Legal counsel with IP and employment law expertise

IP theft investigations have significant legal dimensions requiring attorneys familiar with trade secret law, employment agreements, and evidence handling.

Question 127: Which policy governs the release of classified military information to foreign governments and international organizations?

National Disclosure Policy (NDP-1) (Correct answer)
Arms Export Control Act Section 38
NISPOM Security Classification Guide
Executive Order 12968

Correct answer: National Disclosure Policy (NDP-1)

NDP-1 sets out the criteria and limits for disclosing classified military information to foreign governments.

Question 128: Which international standard provides the framework for organizational crisis management and business continuity management systems?

ISO 31000
ISO 22301 (Correct answer)
ISO 27001
ISO 9001

Correct answer: ISO 22301

ISO 22301 is the international standard specifically for Business Continuity Management Systems, providing requirements for planning, implementing, and improving continuity capabilities.

Question 129: Which behavior is the strongest potential insider threat indicator requiring a report?

An employee asking the FSO about clearance reinvestigation timelines
An employee taking approved vacation abroad after reporting the travel
An employee repeatedly attempting to access classified files outside their need-to-know (Correct answer)
An employee working late to meet a contract deadline

Correct answer: An employee repeatedly attempting to access classified files outside their need-to-know

Attempts to gain access beyond need-to-know are a classic insider threat indicator.

Question 130: Encryption of data in transit is BEST enforced in an industrial network by requiring:

Transport Layer Security (TLS) or equivalent cryptographic protocols on all network channels (Correct answer)
Physical mail delivery for sensitive documents
Verbal communication only for classified operational data
All communications to use plaintext for troubleshooting visibility

Correct answer: Transport Layer Security (TLS) or equivalent cryptographic protocols on all network channels

TLS ensures data integrity and confidentiality while in transit across networks that may traverse untrusted segments.

Question 131: Mitigating an employee's financial vulnerability to espionage recruitment can BEST be accomplished by:

Requiring employees to submit monthly financial statements
Monitoring all personal bank accounts of cleared employees
Providing access to financial counseling and encouraging early self-reporting of financial difficulties (Correct answer)
Denying clearances to all employees with any debt

Correct answer: Providing access to financial counseling and encouraging early self-reporting of financial difficulties

Financial counseling and a non-punitive self-reporting culture reduce the exploitation window before a vulnerability becomes a national security risk.

Question 132: Which FOCI mitigation instrument is typically used when a foreign interest does NOT own voting stock sufficient to elect a board representative?

Proxy Agreement
Board Resolution (Correct answer)
Special Security Agreement
Voting Trust Agreement

Correct answer: Board Resolution

A Board Resolution is the least restrictive measure, used when the foreign interest cannot elect a representative to the board.

Question 133: What is the role of lighting in facility protection?

To enhance security by increasing visibility and deterring crime (Correct answer)
To improve employee comfort.
To reduce energy consumption.
To improve workplace morale.

Correct answer: To enhance security by increasing visibility and deterring crime

Proper lighting eliminates dark spots and shadows, which can be exploited by intruders to conceal their activities. Increased visibility makes it harder for unauthorized individuals to approach or operate undetected, thereby deterring criminal activity. It also allows surveillance systems to function more effectively and helps security personnel identify potential threats.

Question 134: Which behavioral indicator is most commonly associated with a potential malicious insider?

Requesting additional training on new equipment
Taking vacation shortly after a performance review
Working overtime during a major project
Unexplained affluence inconsistent with salary (Correct answer)

Correct answer: Unexplained affluence inconsistent with salary

Unexplained wealth that cannot be reconciled with an employee's known salary is a classic red flag for theft or espionage.

Question 135: Pre-employment polygraph examinations in the industrial security context are PRIMARILY used to:

Provide legally admissible evidence in court
Detect deception regarding undisclosed past activities relevant to suitability (Correct answer)
Replace background investigations entirely
Measure psychological fitness for high-stress roles

Correct answer: Detect deception regarding undisclosed past activities relevant to suitability

Polygraphs are used as an investigative tool to surface undisclosed information, not to replace full background checks or provide court evidence.

Question 136: Which situation would most likely lead DCSA to conclude a company is under FOCI?

A U.S. citizen employee travels abroad
A foreign entity has power, direct or indirect, to direct management decisions affecting classified contracts (Correct answer)
A U.S. bank holds a mortgage on the building
The company sells products overseas through a U.S. distributor

Correct answer: A foreign entity has power, direct or indirect, to direct management decisions affecting classified contracts

FOCI exists when a foreign interest has the power, whether or not exercised, to decide matters that could lead to unauthorized access.

Question 137: Which type of malware is specifically designed to remain hidden while granting an attacker persistent, privileged access to a system?

Adware
Rootkit (Correct answer)
Worm
Ransomware

Correct answer: Rootkit

Rootkits are designed to hide their presence and provide an attacker with sustained administrative access to a compromised system.

Question 138: How does a security audit contribute to risk management?

By delaying risk management actions.
By identifying vulnerabilities and improving security practices (Correct answer)
By increasing the number of employees involved.
By focusing only on technical systems.

Correct answer: By identifying vulnerabilities and improving security practices

A security audit systematically evaluates an organization's security posture, identifying weaknesses and vulnerabilities in its systems and processes. By pinpointing these gaps, the organization can implement targeted improvements and strengthen its defenses. This proactive identification and remediation of flaws are crucial for effective risk management, reducing the likelihood and impact of potential security incidents.

Question 139: Which FOCI mitigation method is typically used when the foreign owner does NOT own enough voting stock to elect a representative to the board?

Voting Trust Agreement
Special Security Agreement
Proxy Agreement
Board Resolution (Correct answer)

Correct answer: Board Resolution

A Board Resolution is used when a foreign interest cannot elect board representation, and it certifies that the foreign owner will not access classified information.

Question 140: What does 'triage' mean in the context of security incident management?

Quickly assessing and prioritizing incidents based on severity and potential impact to allocate response resources (Correct answer)
Documenting every detail before taking any action
Escalating every incident to executive leadership immediately
Eliminating all infected systems from the network immediately

Correct answer: Quickly assessing and prioritizing incidents based on severity and potential impact to allocate response resources

Triage allows security teams to focus limited resources on the most critical incidents first by rapidly assessing severity.

Question 141: When establishing a command post during an industrial emergency, it should be located:

At the main entrance gate for easy public access
Inside the facility to maintain communication with workers
Upwind and uphill from the incident site (Correct answer)
Adjacent to the affected area for direct oversight

Correct answer: Upwind and uphill from the incident site

Positioning the command post upwind and uphill keeps responders out of hazardous vapors and runoff from the incident site.

Question 142: What does 'two-person integrity' (TPI) primarily protect against in a personnel security context?

Physical injuries during heavy-lifting tasks
A single insider acting alone to commit theft or sabotage of critical assets (Correct answer)
Unauthorized photography on the production floor
Cyber intrusions from external threat actors

Correct answer: A single insider acting alone to commit theft or sabotage of critical assets

TPI requires two authorized individuals to be present during access to sensitive areas or materials, preventing unilateral insider action.

Question 143: Which standard form label is used to mark removable media containing Secret information?

SF 706
SF 708
SF 707 (Correct answer)
SF 710

Correct answer: SF 707

The SF 707 is the Secret media label; the SF 706 is Top Secret, SF 708 Confidential, and SF 710 Unclassified.

Question 144: What is the DoD enterprise system used to create and distribute electronic DD Forms 254?

SWFT
NISS
NCCS (Correct answer)
DISS

Correct answer: NCCS

The NISP Contract Classification System (NCCS) is the DoD system for processing DD 254s electronically.

Question 145: What is the primary purpose of security policies in an organization?

To establish rules for protecting assets, personnel, and information (Correct answer)
To eliminate the need for employee training.
To monitor employee behavior.
To increase security costs.

Correct answer: To establish rules for protecting assets, personnel, and information

Security policies provide a foundational framework of guidelines and rules that dictate how an organization manages and protects its valuable resources, including assets, personnel, and information. They define acceptable behavior, responsibilities, and procedures for employees and systems. This ensures a consistent, comprehensive, and standardized approach to security across the entire organization.

Question 146: What is the role of incident response planning in security compliance?

To delay incident response.
To eliminate the need for security audits.
To ensure a coordinated response and compliance with regulations (Correct answer)
To reduce the number of incidents.

Correct answer: To ensure a coordinated response and compliance with regulations

Incident response planning outlines the structured steps an organization will take when a security incident occurs. In the context of compliance, it ensures that the response adheres to legal and regulatory mandates for reporting, data breach notification, and evidence preservation. A well-defined plan minimizes legal exposure, facilitates a structured recovery, and demonstrates due diligence to regulatory bodies.

Question 147: An air-gapped network in an industrial environment means:

The network uses wireless frequencies exclusively
The network uses encrypted tunnels to connect to the internet
The network is physically isolated with no connections to external or untrusted networks (Correct answer)
The network operates at lower bandwidth to reduce attack surface

Correct answer: The network is physically isolated with no connections to external or untrusted networks

An air gap is a physical security measure that prevents a network from connecting to external systems, limiting remote attack vectors.

Question 148: 'Gamification' in security training programs refers to:

Using game-like elements such as points, leaderboards, and rewards to increase engagement and knowledge retention (Correct answer)
Using virtual reality for physical security simulations only
Replacing security training with recreational activities
Allowing employees to skip training modules they find difficult

Correct answer: Using game-like elements such as points, leaderboards, and rewards to increase engagement and knowledge retention

Gamification applies motivational elements from game design to training, increasing participation and knowledge retention through competition and reward.

Question 149: Which body is created under SSA and Proxy agreements to oversee compliance with FOCI mitigation and is made up of outside directors, proxy holders, and cleared officers?

Government Security Committee (Correct answer)
National Disclosure Policy Committee
Configuration Control Board
Insider Threat Working Group

Correct answer: Government Security Committee

The Government Security Committee (GSC) is a permanent board committee that makes sure the company complies with its FOCI mitigation obligations.

Question 150: Which background investigation element is MOST critical when determining suitability for a sensitive industrial position?

All of the above combined (Correct answer)
Criminal record check
Employment verification
Credit history review

Correct answer: All of the above combined

A comprehensive personnel security determination requires combining criminal, credit, and employment checks rather than relying on any single element.

Question 151: Which program element is essential to a robust Insider Threat Program (InTP)?

Establishing a multidisciplinary hub that integrates HR, IT, security, and legal data (Correct answer)
Installing covert recording devices in break rooms
Reporting all suspicious behavior directly to law enforcement without internal review
Reviewing only IT access logs on an annual basis

Correct answer: Establishing a multidisciplinary hub that integrates HR, IT, security, and legal data

An effective InTP requires a cross-functional team that combines data from multiple departments to detect and deter insider threats.

Industrial Security Professional (ISP) Certification Exam

The ISP certification validates an individual's expertise in industrial security practices, demonstrating a comprehensive understanding of security principles, regulations, and risk management within industrial environments.

150

Questions

180 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

ncms-isp.org — Renewal, score validity, retake policy, test delivery, eligibility, fees, exam format, registration deadline, retake fee, test dates · verified Oct 2026