SFPC Information Systems Security and Cybersecurity Basics — Questions and Answers
Question 1: Which three principles make up the CIA triad of information security?
- Confidentiality, Integrity, Availability (Correct answer)
- Control, Inspection, Authorization
- Classification, Identification, Access
- Confidentiality, Identification, Authentication
Correct answer: Confidentiality, Integrity, Availability
The CIA triad is Confidentiality (prevent unauthorized disclosure), Integrity (prevent unauthorized modification), and Availability (ensure authorized users can access information when needed).
Question 2: What is a 'data spill' (spillage)?
- A power failure that erases data
- Classified information placed on an unclassified or lower-classification system (Correct answer)
- A normal backup process
- A routine software update
Correct answer: Classified information placed on an unclassified or lower-classification system
A spillage occurs when information is transferred to a system not authorized for its classification level. It must be reported immediately and the affected systems isolated for cleanup. Users should not delete the data themselves or continue working on the system.
Question 3: Which principle limits users to only the access needed to perform their duties?
- Least privilege (Correct answer)
- Separation of media
- Open access
- Maximum exposure
Correct answer: Least privilege
Least privilege restricts accounts to the minimum permissions required for the job, which reduces the damage from errors, misuse, or compromised accounts.
Question 4: Which practice best reduces the risk of unauthorized access when a password is stolen?
- Writing the password on a sticky note
- Using multi-factor authentication (Correct answer)
- Using the same password on all systems
- Sharing accounts within a team
Correct answer: Using multi-factor authentication
Multi-factor authentication requires additional proof beyond a password, such as a CAC/PIV and PIN, so a stolen password alone is not enough to gain access.
Question 5: You receive an unexpected email with a link asking you to verify your account. What should you do?
- Click the link to check if it is real
- Forward it to all coworkers
- Do not click; report it as suspected phishing through your organization's process (Correct answer)
- Reply with your password to confirm
Correct answer: Do not click; report it as suspected phishing through your organization's process
Unexpected links requesting credentials are classic phishing. Do not click or reply, and report the message to your security or help desk team following organization procedures.
Question 6: Which is a risk of connecting personal removable media (such as a USB drive) to a government or classified system?
- It improves system performance
- It can introduce malware or enable data exfiltration (Correct answer)
- It has no security implication
- It automatically encrypts the system
Correct answer: It can introduce malware or enable data exfiltration
Unauthorized removable media is a major vector for malware and data theft, and it is prohibited or tightly controlled on government systems. Only approved, properly handled media should be used.
