Mixed Deck — All SFPC Topics Flashcards

During an emergency, who typically has primary authority over evacuation decisions?

Answer: The incident commander

The Incident Commander has overall authority and responsibility for managing incident operations, including evacuation decisions.

An information system has been through the 'Assess' step of the Risk Management Framework (RMF). The assessment found several non-compliant security controls. What is the primary purpose of the Plan of Action and Milestones (POA&M) document created at this stage?

Answer: To track the tasks, resources, and timelines required to correct identified weaknesses.

The Plan of Action and Milestones (POA&M) is a corrective action plan used to track and manage the remediation of security weaknesses and vulnerabilities identified during a security control assessment. It details the specific tasks, necessary resources, milestones, and completion dates for addressing non-compliant controls.

What is 'workplace violence' as it relates to insider threat programs?

Answer: Physical or threatened harm by a current or former employee, aimed at coworkers or the organization

Workplace violence by a current or former employee is considered an insider threat because it involves someone with insider access or knowledge targeting the organization or its personnel.

Preferred method of classification determination communication. Contains classification levels, downgrading and declassification instructions, and special handling requirements for programs, projects, plans, etc.

Answer: Security Classification Guides (SCG)

In security operations, reliable communication is critical, especially during emergencies or when primary systems fail. Two-way radios serve as essential backup communication systems, providing immediate and direct contact between security personnel. This ensures continuous coordination and response capabilities even if other communication methods are compromised or unavailable.

What is the primary justification for establishing a Special Access Program (SAP)?

Answer: The program requires security measures and access controls that exceed those normally required for information at the same classification level.

A Special Access Program is established when it's determined that the normal safeguarding and access requirements for a given classification level (e.g., Confidential, Secret, or Top Secret) are insufficient to protect the information from exceptional threats or vulnerabilities. [4, 8, 13]

When a classified data spill occurs, who is responsible for ensuring that policy requirements for addressing an unauthorized disclosure are met?

Answer: Activity Security Manager

Security Classification Guides (SCGs) are authoritative documents that provide specific instructions on the classification levels, downgrading, declassification, and special handling requirements for programs, projects, or plans. They serve as the preferred method for communicating classification determinations, ensuring consistent and proper protection of classified information across an organization.

What is 'defense in depth' in information security?

Answer: Using multiple layers of security controls so that if one fails, others still provide protection

Defense in depth is a security strategy that employs multiple layers of controls, ensuring that if one control fails, additional controls continue to provide protection.

What does the acronym OPSEC stand for and what is its origin?

Answer: Operations Security, originating from Vietnam-era Operation Purple Dragon, designed to identify how the enemy was gaining advance knowledge of operations

OPSEC stands for Operations Security and originated from Operation Purple Dragon during the Vietnam War, which analyzed how adversaries were obtaining advance knowledge of friendly operations.

What is 'data exfiltration' in the context of insider threats?

Answer: The unauthorized transfer of sensitive data from an organization by an insider

Data exfiltration by an insider refers to the unauthorized transfer of sensitive organizational information to external parties, typically for financial gain, to benefit a foreign intelligence service, or for competitive advantage.

In the context of OPSEC, what is an 'indicator'?

Answer: Friendly, detectable actions that can be pieced together by an adversary to derive critical information.

Indicators are friendly activities, often unclassified and seemingly harmless on their own, that an adversary can observe and analyze to reveal or infer critical information. For example, a sudden increase in pizza deliveries to a command center late at night could indicate that a major operation is imminent.

What is the purpose of the personnel security program?

Answer: To assess whether individuals can be trusted with access to classified information and sensitive positions

The personnel security program assesses individuals' trustworthiness, reliability, and loyalty to determine whether they are suitable for access to classified information or sensitive positions.

Which of the following physical security measures primarily serves as a deterrent by making it difficult for an intruder to see into a protected area from the outside?

Answer: Glare projection lighting

Glare projection is a lighting technique where lights are directed outward from a protected area. This creates a wall of light that makes it difficult for outsiders to see inside the perimeter, serving as a strong deterrent. Standby lighting is activated by sensors, bollards are physical barriers against vehicles, and fencing is a physical barrier but does not inherently obstruct vision in this manner.

What is the purpose of 'SAP security training' beyond standard security education?

Answer: It provides program-specific security requirements, procedures, and responsibilities unique to the particular SAP

SAP security training goes beyond standard security education to provide program-specific requirements, procedures, and responsibilities applicable to the unique security measures of that particular program.

What is a 'Plan of Action and Milestones' (POA&M) in the RMF context?

Answer: A document identifying security weaknesses in a system with planned remediation actions and target completion dates

A POA&M documents identified security weaknesses, the planned actions to address them, the resources required, and target completion dates for remediation.

What is the purpose of 'security containers' (safes) in industrial security?

Answer: To provide approved storage for classified materials, preventing unauthorized access

GSA-approved security containers provide the required level of protection for classified materials, preventing unauthorized access while materials are not in use.

Which of the following is a key component of the Trusted Workforce 2.0 initiative, designed to modernize the personnel security process?

Answer: Continuous Vetting/Evaluation to monitor for new risk information in near real-time.

Continuous Vetting (CV) or Continuous Evaluation (CE) is a cornerstone of the Trusted Workforce 2.0 reform. It replaces the traditional periodic reinvestigation model with ongoing, automated checks of various data sources to identify potential security risks as they arise.

Why should security professionals be cautious about using public Wi-Fi networks?

Answer: Public Wi-Fi can be monitored or compromised, exposing sensitive information

Public Wi-Fi networks are often unsecured and can be monitored by adversaries, potentially exposing sensitive communications and login credentials.

What distinguishes a SAP from a standard classified program?

Answer: SAPs require additional access controls, need-to-know determinations, and formal indoctrination beyond standard classification requirements

SAPs impose additional layers of security controls beyond standard classification requirements, including formal indoctrination, stricter need-to-know criteria, and enhanced physical security.

An employee working in a SAP discusses multiple unclassified details about their project's timeline and testing locations with a colleague who is not indoctrinated into the program. Why does this represent a significant security risk?

Answer: The aggregation of unclassified indicators could reveal sensitive or classified program information.

A core principle of protecting SAPs is Operations Security (OPSEC). Seemingly harmless, unclassified pieces of information (indicators) can be collected and pieced together by an adversary to reveal sensitive or even classified aspects of a program. This is known as aggregation or the mosaic effect. [4]

A government agency is planning a major international conference. The planning team posts details about the event, including specific dates, times, and the names of high-profile attendees, on a public-facing website for attendee convenience. From an OPSEC standpoint, this action is a failure in which step of the OPSEC process?

Answer: Analysis of Vulnerabilities

This scenario represents a failure to analyze vulnerabilities. The vulnerability is the public-facing website, an unsecured channel, which adversaries could exploit to gain critical information (attendee lists, schedules) to plan an attack or disruption.