Security Fundamentals Professional Certification (SFPC) — Questions and Answers

Question 1: Which of the following is considered the FIRST step in the traditional five-step OPSEC process?

Apply Countermeasures
Analyze Threats
Assess Risks
Identify Critical Information (Correct answer)

Correct answer: Identify Critical Information

The foundational first step of the OPSEC process is to identify the critical information. An organization cannot protect its sensitive information if it does not first determine what information, if compromised, would cause the most harm to its mission or operations.

Question 2: What is a 'personnel security interview' conducted during a background investigation?

An interview with a subject's supervisor only
A formal interview with the security clearance applicant or subject to clarify potentially disqualifying or derogatory information (Correct answer)
A job interview for a security position
A standard annual performance review

Correct answer: A formal interview with the security clearance applicant or subject to clarify potentially disqualifying or derogatory information

A personnel security interview is conducted with the subject to clarify information identified during the investigation, particularly potentially disqualifying or derogatory information.

Question 3: An adjudicator is reviewing a case file for a security clearance. The individual has a history of significant, unresolved debt but is also a highly decorated veteran with numerous commendations for their service. Which principle should the adjudicator apply to make a final eligibility determination?

The Need-to-Know Principle
The Whole-Person Concept (Correct answer)
The Reciprocity Principle
The Least Privilege Principle

Correct answer: The Whole-Person Concept

The 'Whole-Person Concept' requires adjudicators to carefully weigh all available information, both favorable and unfavorable, past and present, to make an overall common-sense judgment about an individual's reliability, trustworthiness, and loyalty. This includes considering mitigating factors alongside potentially disqualifying information.

Question 4: What is a 'portion marking' on a classified document?

The declassification date or event instruction stamped on the document cover
The classification marking applied to each individual section, paragraph, or component (Correct answer)
The control markings indicating special dissemination or handling requirements
The overall classification banner displayed at the top of the document

Correct answer: The classification marking applied to each individual section, paragraph, or component

Portion markings identify the classification level of each specific section, paragraph, figure, or other component within a document, shown as abbreviations in parentheses such as (S) for Secret or (TS) for Top Secret.

Question 5: Which type of physical intrusion detection system (PIDS) sensor is specifically designed to detect an unauthorized entry through a door or window?

A passive infrared (PIR) sensor
A magnetic contact switch (Correct answer)
A glass-break detector
A microwave sensor

Correct answer: A magnetic contact switch

A magnetic contact switch consists of two parts: a magnet attached to a door or window and a switch on the frame. When the door or window is opened, the magnetic field is broken, which triggers the alarm. This makes it a direct detector of an opening, whereas other sensors detect motion (PIR, microwave) or the sound of breaking glass.

Question 6: What is 'opsec' as it applies to personal behavior?

Being mindful of what personal information you reveal that could be used against you (Correct answer)
Using encrypted communications only
Wearing disguises in public
Avoiding all electronic devices

Correct answer: Being mindful of what personal information you reveal that could be used against you

Personal OPSEC involves being conscious of what information about yourself you reveal, ensuring that sensitive personal information doesn't fall into the hands of adversaries.

Question 7: What is a 'closed area' in the context of industrial security?

An area closed due to a security incident
A facility that has been decommissioned
A specifically designated area where classified materials are stored and accessible only to authorized personnel (Correct answer)
A room that is permanently locked

Correct answer: A specifically designated area where classified materials are stored and accessible only to authorized personnel

A closed area is a formally designated and approved area where classified materials may be stored, used, or discussed, with access limited to authorized personnel.

Question 8: Which of the following physical security measures primarily serves as a deterrent by making it difficult for an intruder to see into a protected area from the outside?

Glare projection lighting (Correct answer)
Standby lighting
Perimeter fencing
Bollards

Correct answer: Glare projection lighting

Glare projection is a lighting technique where lights are directed outward from a protected area. This creates a wall of light that makes it difficult for outsiders to see inside the perimeter, serving as a strong deterrent. Standby lighting is activated by sensors, bollards are physical barriers against vehicles, and fencing is a physical barrier but does not inherently obstruct vision in this manner.

Question 9: What is the purpose of 'crime prevention through environmental design' (CPTED)?

Using security cameras in all areas (Correct answer)
Installing alarm systems in all locations
Designing or modifying the physical environment to reduce the opportunities for crime and unauthorized access
Placing security guards at every entrance

Correct answer: Using security cameras in all areas

CPTED uses environmental design principles to reduce opportunities for criminal activity, including natural surveillance, natural access control, territorial reinforcement, and maintenance.

Question 10: What is the primary purpose of conducting end-of-day security checks in a classified work area?

To record and count all classified documents accessed during the workday
To verify that all employees have logged their classified access for the day
To ensure all classified materials are properly secured and no violations exist (Correct answer)
To update security clearance records for all personnel assigned to the area

Correct answer: To ensure all classified materials are properly secured and no violations exist

End-of-day security checks ensure all classified materials are stored in approved containers, equipment is secured, and no classified materials have been inadvertently left accessible when the area is unoccupied.

Question 11: What is a 'Plan of Action and Milestones' (POA&M) in the RMF context?

A project management timeline
A document identifying security weaknesses in a system with planned remediation actions and target completion dates (Correct answer)
A system inventory document
A security authorization document

Correct answer: A document identifying security weaknesses in a system with planned remediation actions and target completion dates

A POA&M documents identified security weaknesses, the planned actions to address them, the resources required, and target completion dates for remediation.

Question 12: A facility uses a physical access control system (PACS) where employees present a key fob to a reader to unlock a door. Which components are essential for this system to function?

Surveillance camera, turnstile, and a visitor log.
Motion detector, alarm, and a keypad.
Biometric scanner, server, and a security guard.
Credential, reader, and a control panel. (Correct answer)

Correct answer: Credential, reader, and a control panel.

A basic electronic physical access control system requires a credential (the key fob), a reader to interpret the credential's data, and a control panel that makes the access decision and signals the lock to open. The server stores the access rules and logs, and the control panel communicates with it, but the core interaction at the access point involves the credential, reader, and controller.

Question 13: What is the purpose of a 'security classification guide' (SCG)?

To provide a list of cleared personnel
To identify specific items, elements, or categories of information that are classified and their required classification levels (Correct answer)
To describe facility security procedures
To outline employee security responsibilities

Correct answer: To identify specific items, elements, or categories of information that are classified and their required classification levels

A SCG identifies specific information elements related to a classified program and prescribes their classification levels, downgrading instructions, and declassification guidance.

Question 14: What is the 'continuous monitoring' step in the NIST RMF designed to accomplish?

Maintaining ongoing awareness of the security posture of a system to support risk management decisions (Correct answer)
Conducting annual security assessments
Continuously monitoring employee productivity
Monitoring system performance metrics only

Correct answer: Maintaining ongoing awareness of the security posture of a system to support risk management decisions

Continuous monitoring maintains ongoing situational awareness of system security, enabling rapid detection of changes that may introduce new risks and supporting informed authorization decisions.

Question 15: What is the purpose of 'access control lists' (ACLs) in information security?

To organize files alphabetically
To track employee attendance
To specify which users or system processes have permission to access specific resources (Correct answer)
To monitor network traffic volumes

Correct answer: To specify which users or system processes have permission to access specific resources

ACLs define the permissions and restrictions for users or system processes accessing specific resources, implementing the principle of least privilege.

Question 16: Under the NISPOM, who is responsible for ensuring that employees understand their security responsibilities?

The facility security officer (Correct answer)
The program manager
The contracting officer
The inspector general

Correct answer: The facility security officer

The FSO is responsible for ensuring that cleared employees receive initial and refresher security training and understand their security obligations.

Question 17: What is the purpose of the Personnel Security Investigation (PSI) process?

To investigate criminal activity
To assess job performance
To determine whether an individual is eligible for a security clearance (Correct answer)
To evaluate candidates for promotions

Correct answer: To determine whether an individual is eligible for a security clearance

A PSI is conducted to gather information about an individual's background to determine their eligibility and suitability for a security clearance.

Question 18: An organization is implementing a risk management program. After identifying potential threats and vulnerabilities, what is the logical next step in the risk management process?

Conduct a risk analysis. (Correct answer)
Create an incident response plan.
Monitor and review the risks.
Implement security controls.

Correct answer: Conduct a risk analysis.

The standard risk management process involves identifying assets, threats, and vulnerabilities, and then analyzing the risk. Risk analysis involves evaluating the likelihood of a threat exploiting a vulnerability and the potential impact it would have on the organization. This analysis is crucial before deciding which controls to implement.

Question 19: Which of the following describes the 'Availability' component of the CIA triad?

The assurance that information is not disclosed to unauthorized individuals.
The process of verifying the identity of a user.
The assurance that authorized users can access information and systems when required. (Correct answer)
The guarantee that data is accurate and has not been tampered with.

Correct answer: The assurance that authorized users can access information and systems when required.

Availability ensures that systems, applications, and data are accessible to authorized users when they need them. It involves protecting against downtime caused by hardware failures, software bugs, or malicious attacks like Denial of Service (DoS).

Question 20: Under Executive Order 13526, who is authorized to make original classification decisions?

The Director of National Intelligence exclusively
All cleared contractors working on classified programs
Any government employee holding an active security clearance
The President, Vice President, and officials designated by the President (Correct answer)

Correct answer: The President, Vice President, and officials designated by the President

EO 13526 designates the President, Vice President, and agency heads or officials specifically designated by the President as Original Classification Authorities (OCAs).

Question 21: According to the principle of least privilege, how should access to information and resources be granted?

Access should be granted to groups of users rather than individuals to simplify management.
All users should be granted administrator-level access to ensure they can perform their duties.
Users should be granted access based on their job title and seniority within the company.
Users should be granted the minimum level of access and permissions necessary to perform their job functions. (Correct answer)

Correct answer: Users should be granted the minimum level of access and permissions necessary to perform their job functions.

The principle of least privilege is a fundamental concept in information security that states a user should only have the minimum set of permissions required to perform their specific job responsibilities, and nothing more. This helps to limit the damage that can be caused by an accident, error, or a compromised user account.

Question 22: What does 'threat awareness' training for security professionals typically include?

Learning to fight off attackers
Historical analysis of past security incidents
Understanding the nature of threats, recognizing indicators of targeting, and knowing how to respond (Correct answer)
Only cybersecurity topics

Correct answer: Understanding the nature of threats, recognizing indicators of targeting, and knowing how to respond

Threat awareness training covers recognizing potential threats, understanding the tactics adversaries use, identifying indicators of surveillance or targeting, and knowing the appropriate response procedures.

Question 23: An employee at a defense contracting company frequently discusses specific project details, such as testing timelines and equipment capabilities, with friends at a local restaurant. While the information is not classified, a competitor could piece it together to gain a competitive advantage. This employee's behavior creates an OPSEC _______.

risk assessment
countermeasure
threat
vulnerability (Correct answer)

Correct answer: vulnerability

The employee's behavior creates a vulnerability, which is a weakness that can be exploited by a threat. Discussing sensitive details in a public, unsecured setting is a weakness in the company's security posture that an adversary (the threat) could exploit.

Question 24: What is a 'critical information list' (CIL) in OPSEC?

A list of critical infrastructure components
A prioritized compilation of information that must be protected from adversary collection (Correct answer)
A list of personnel with security clearances
A list of all classified documents

Correct answer: A prioritized compilation of information that must be protected from adversary collection

A CIL is a prioritized listing of the critical information that an organization must protect because its compromise would provide adversaries with a significant advantage.

Question 25: According to Executive Order 13556, which of the following is considered a type of controlled unclassified information (CUI)?

Declassified Information
Law Enforcement Sensitive (LES) Information (Correct answer)
North Atlantic Treaty Organization (NATO) Information
Communications Security (COMSEC) Information

Correct answer: Law Enforcement Sensitive (LES) Information

When a classified data spill occurs, the Activity Security Manager (ASM) is typically the primary individual responsible for ensuring that all policy requirements for addressing the unauthorized disclosure are met. The ASM oversees the incident response, investigation, mitigation, and reporting processes to contain the spill and prevent recurrence.

Question 26: What is an 'OPSEC indicator' as used in the five-step OPSEC process?

Observable actions or information that could allow an adversary to detect, identify, or derive critical information (Correct answer)
A security training certification
A security clearance level
A type of classified marking

Correct answer: Observable actions or information that could allow an adversary to detect, identify, or derive critical information

OPSEC indicators are observable data or activities that can be detected and analyzed by an adversary to deduce critical information about friendly operations.

Question 27: What is the principle of 'least privilege' in information security?

Granting users and systems only the minimum permissions necessary to perform their required functions (Correct answer)
Providing the least amount of security training to employees
Implementing the simplest security controls available
Giving all users the minimum possible system resources

Correct answer: Granting users and systems only the minimum permissions necessary to perform their required functions

The principle of least privilege limits user and system permissions to only what is necessary for their specific job functions, reducing the potential damage from account compromise or insider threats.

Question 28: Under what circumstances may classified information be discussed over a standard non-secure telephone line?

Never — classified information must not be discussed over non-secure telephone lines (Correct answer)
When the conversation is brief and no specific operational details are mentioned
When the call is made from within an approved government facility
When both parties hold appropriate clearances for the information being discussed

Correct answer: Never — classified information must not be discussed over non-secure telephone lines

Classified information must never be discussed over standard non-secure telephone lines regardless of the parties' clearance levels, because unsecured communications channels are vulnerable to interception.

Question 29: What is the 'whole person concept' in personnel security adjudication?

Only evaluating criminal background
Evaluating only the most recent behavior of an applicant
Focusing exclusively on financial history
Considering all available information about an individual's life, character, and circumstances to make a fair and accurate eligibility determination (Correct answer)

Correct answer: Considering all available information about an individual's life, character, and circumstances to make a fair and accurate eligibility determination

The whole person concept requires adjudicators to consider all available information about an individual — not just isolated incidents — to make a complete and accurate eligibility determination.

Question 30: What is the difference between a malicious and unintentional insider threat?

Malicious insiders deliberately cause harm while unintentional insiders cause harm through negligence or mistakes (Correct answer)
Only malicious insiders can cause damage
Unintentional insiders are never a real threat
There is no difference

Correct answer: Malicious insiders deliberately cause harm while unintentional insiders cause harm through negligence or mistakes

Malicious insiders deliberately exploit their access to cause harm, while unintentional insiders cause harm through careless actions, mistakes, or falling victim to social engineering.

Question 31: How can security professionals protect themselves from 'phishing' attacks?

Only using work email accounts
Verifying the sender's identity and being suspicious of unexpected requests for information (Correct answer)
Printing all emails before reading
Never using email

Correct answer: Verifying the sender's identity and being suspicious of unexpected requests for information

Phishing protection involves verifying the sender's identity, being cautious of unexpected requests, and not clicking suspicious links or providing sensitive information via email.

Question 32: What is the purpose of 'security containers' (safes) in industrial security?

To provide approved storage for classified materials, preventing unauthorized access (Correct answer)
To store personal items of value
To secure administrative records only
To store computer equipment

Correct answer: To provide approved storage for classified materials, preventing unauthorized access

GSA-approved security containers provide the required level of protection for classified materials, preventing unauthorized access while materials are not in use.

Question 33: What is a 'vehicle barrier system' and when is it used?

Physical barriers (bollards, walls, vehicle traps) designed to prevent vehicle-borne attacks against facilities (Correct answer)
Tire deflation devices for unauthorized vehicles
Vehicle registration checkpoints
Speed bumps for employee parking lots

Correct answer: Physical barriers (bollards, walls, vehicle traps) designed to prevent vehicle-borne attacks against facilities

Vehicle barrier systems prevent vehicle-borne threats (such as car bombs or ramming attacks) from reaching critical facilities by using passive or active physical barriers.

Question 34: A small company has developed a new proprietary manufacturing process. They are concerned about competitors stealing their trade secrets. Which of the following is the BEST control to mitigate this risk?

Implementing a firewall to block external network traffic.
Enforcing a strong password policy for all employees.
Installing antivirus software on all company computers.
Requiring all employees with access to the process documents to sign non-disclosure agreements (NDAs). (Correct answer)

Correct answer: Requiring all employees with access to the process documents to sign non-disclosure agreements (NDAs).

While technical controls like firewalls and passwords are important, the most direct control to protect trade secrets from being shared by authorized individuals (insiders) is a legal control like a non-disclosure agreement (NDA). It legally binds employees to protect the company's confidential information.

Question 35: What is the role of 'physical security surveys' in a security program?

Systematic assessments of a facility's physical security measures to identify vulnerabilities and recommend improvements (Correct answer)
Reviews of access badge issuance procedures
Interviewing employees about job satisfaction
Annual inspections of fire safety equipment only

Correct answer: Systematic assessments of a facility's physical security measures to identify vulnerabilities and recommend improvements

Physical security surveys systematically evaluate all aspects of a facility's physical security program to identify vulnerabilities and recommend countermeasures to reduce security risks.

Question 36: What is the first step in the OPSEC process?

Applying countermeasures
Assessing risk
Identifying critical information (Correct answer)
Analyzing threats

Correct answer: Identifying critical information

The first step in the OPSEC process is identifying critical information — determining what information, if obtained by adversaries, would be most harmful to the mission or operation.

Question 37: A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. This is an example of what type of attack?

Denial-of-Service (DoS)
Malware injection
Phishing (Correct answer)
Man-in-the-Middle (MitM)

Correct answer: Phishing

Phishing is a type of social engineering attack where an attacker sends fraudulent communications that appear to come from a reputable source, usually a financial institution or other service provider. The goal is to deceive the recipient into revealing sensitive information such as login credentials or credit card numbers.

Question 38: During an emergency, who typically has primary authority over evacuation decisions?

The facility security officer
The CEO of the organization
The incident commander (Correct answer)
The building maintenance supervisor

Correct answer: The incident commander

The Incident Commander has overall authority and responsibility for managing incident operations, including evacuation decisions.

Question 39: What is 'defense in depth' in information security?

Defending only the perimeter of a network
Using the most advanced security technology available
Encrypting only the most sensitive data
Using multiple layers of security controls so that if one fails, others still provide protection (Correct answer)

Correct answer: Using multiple layers of security controls so that if one fails, others still provide protection

Defense in depth is a security strategy that employs multiple layers of controls, ensuring that if one control fails, additional controls continue to provide protection.

Question 40: Assist in security; must always be back-up communication systems in addition to radios?

Handcuffs
Two-way radio (Correct answer)
Physical Security Plan (PSP)
Keys

Correct answer: Two-way radio

In the context of security, a 'threat' is defined as the intention and capability of an adversary to undertake detrimental actions. It represents a potential source of harm that could exploit vulnerabilities and cause damage to assets or operations. Identifying and assessing threats is a fundamental component of effective risk management.

Question 41: What does the 'MICE' acronym represent in the context of insider threat motivations?

Management, Investigation, Compliance, Enforcement
Methods, Indicators, Counterintelligence, Evidence
Money, Ideology, Coercion/Compromise, Ego (Correct answer)
Monitoring, Intelligence, Collection, Exploitation

Correct answer: Money, Ideology, Coercion/Compromise, Ego

MICE represents the four primary motivations for insider threats: Money (financial gain), Ideology (beliefs or grievances), Coercion/Compromise (being blackmailed or coerced), and Ego (pride or revenge).

Question 42: What is the purpose of 'security seals' on equipment and containers?

To identify ownership of equipment
To attach shipping labels
Decorative purposes only
To provide tamper evidence, indicating whether a container or piece of equipment has been accessed or modified without authorization (Correct answer)

Correct answer: To provide tamper evidence, indicating whether a container or piece of equipment has been accessed or modified without authorization

Security seals provide tamper evidence on equipment, containers, and access points, making it apparent if someone has accessed or modified what is sealed without authorization.

Question 43: What is the purpose of the industrial security inspection program?

To evaluate employee job performance
To review contract deliverables
To conduct financial audits of contractors
To verify compliance with NISPOM requirements and assess the effectiveness of security measures (Correct answer)

Correct answer: To verify compliance with NISPOM requirements and assess the effectiveness of security measures

Industrial security inspections are conducted by the cognizant security agency to verify contractor compliance with NISPOM requirements and the effectiveness of their security programs.

Question 44: Which of the following is an example of an 'adverse information' that must be reported to the FSO?

A cleared employee receives a promotion
An employee purchases a new home
A cleared employee changes their marital status
A cleared employee is arrested for driving under the influence (Correct answer)

Correct answer: A cleared employee is arrested for driving under the influence

An arrest is adverse information that cleared employees must report to the FSO because it may affect their continued eligibility for a security clearance.

Question 45: When a classified data spill occurs, who is responsible for ensuring that policy requirements for addressing an unauthorized disclosure are met?

Information Assurance Manager
Information Assurance Officer
Information Assurance Staff
Activity Security Manager (Correct answer)

Correct answer: Activity Security Manager

Security Classification Guides (SCGs) are authoritative documents that provide specific instructions on the classification levels, downgrading, declassification, and special handling requirements for programs, projects, or plans. They serve as the preferred method for communicating classification determinations, ensuring consistent and proper protection of classified information across an organization.

Question 46: What does 'mitigating information' mean in the context of security clearance adjudication?

Information that increases the severity of security concerns
Information that automatically approves a clearance
Information that addresses potentially disqualifying concerns by providing context, explanation, or evidence of rehabilitation (Correct answer)
A formal statement from the clearance applicant

Correct answer: Information that addresses potentially disqualifying concerns by providing context, explanation, or evidence of rehabilitation

Mitigating information is information that reduces the significance of potentially disqualifying concerns by providing context, demonstrating rehabilitation, or showing the concern is not likely to recur.

Question 47: Definition of BIOMETRIC: <br> "Measurable Physical characteristics or personal behavior traits used to recognize the identity, or verify the claimed identity. Fingerprints, Iris, handwriting, voice recognition."

True (Correct answer)
False

Correct answer: True

An accidental disclosure of classified information to a foreign entity, especially if facilitated by technology, falls under the broad guidelines governing the 'Use of Information Technology Systems.' These guidelines encompass policies and procedures for handling, processing, and transmitting classified data on IT systems, and any breach constitutes a violation of these protocols.

Question 48: What is derivative classification?

Incorporating or paraphrasing existing classified source material into new documents (Correct answer)
Reducing the classification level of previously classified information
Transferring original classification authority to a subordinate official
Independently determining that information warrants classification protection

Correct answer: Incorporating or paraphrasing existing classified source material into new documents

Derivative classification involves incorporating, paraphrasing, restating, or generating new material based on already-classified sources, carrying forward the classification markings from those sources.

Question 49: What is a 'defense-in-depth' approach to physical security?

Using multiple concentric layers of security controls so that an attacker must overcome multiple barriers to reach the protected area (Correct answer)
Deploying all security guards at the main entrance
Focusing all security resources on the outer perimeter
Installing the most advanced technology available at a single checkpoint

Correct answer: Using multiple concentric layers of security controls so that an attacker must overcome multiple barriers to reach the protected area

A layered approach to physical security uses multiple concentric security rings so that an adversary must overcome each layer successively, significantly increasing the difficulty of reaching the protected target.

Question 50: What is the purpose of a Continuity of Operations Plan (COOP)?

To ensure essential functions continue during emergencies (Correct answer)
To manage daily administrative tasks
To handle employee grievances
To document insurance claims

Correct answer: To ensure essential functions continue during emergencies

A COOP ensures that essential government or organizational functions can continue during a wide range of emergencies.

Question 51: What is 'identity theft' and why is it a personal security concern?

Assuming a false identity for undercover operations
Changing one's legal name
The fraudulent acquisition and use of another person's private identifying information (Correct answer)
Using a nickname professionally

Correct answer: The fraudulent acquisition and use of another person's private identifying information

Identity theft involves using another person's personal information without their consent, typically for financial gain, and can severely impact the victim's reputation and security clearance.

Question 52: What is the purpose of a security vulnerability assessment in industrial security?

To review supply chain logistics
To assess financial risks
To evaluate employee performance
To identify weaknesses that could allow unauthorized access to classified information (Correct answer)

Correct answer: To identify weaknesses that could allow unauthorized access to classified information

A security vulnerability assessment identifies gaps and weaknesses in security systems that could be exploited to gain unauthorized access to classified information.

Security Fundamentals Professional Certification (SFPC)

The SFPC exam validates foundational knowledge of DoD security disciplines including personnel security, information security, physical security, industrial security, and operations security.

Questions

120 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds