Security Fundamentals Professional Certification (SFPC) — Questions and Answers

Question 1: What is a 'perimeter intrusion detection system' (PIDS) used for?

Providing lighting for nighttime operations
Detecting unauthorized intrusions along a facility's perimeter using sensors, cameras, and alarms (Correct answer)
Managing vehicle access credentials
Monitoring employee attendance

Correct answer: Detecting unauthorized intrusions along a facility's perimeter using sensors, cameras, and alarms

A PIDS detects unauthorized access attempts along a facility's perimeter through various sensor technologies, triggering alerts that allow security personnel to respond.

Question 2: A contractor's classified contract has ended, and the GCA has given no disposition instructions. Under NISPOM retention rules, what may the contractor do with the classified material it received or generated under that contract?

It may keep the material for up to 5 years, after which DCSA must witness the destruction
It may keep the material for up to 2 years after contract completion unless the GCA says otherwise; keeping it longer requires written GCA authorization (Correct answer)
It must destroy or return all classified material within 30 days of contract completion
It may keep the material indefinitely, as long as the FCL stays valid and storage is approved

Correct answer: It may keep the material for up to 2 years after contract completion unless the GCA says otherwise; keeping it longer requires written GCA authorization

Contractors may keep classified material received or generated under a contract for 2 years after the contract is completed, as long as the GCA does not say otherwise. To keep it longer, the contractor needs written retention authority from the GCA. Otherwise the material must be returned or destroyed. Nothing requires immediate destruction or DCSA-witnessed destruction.

Question 3: A security manager is buying a replacement high-security electromechanical combination lock (for example, an X-10) for a GSA-approved security container. Which federal specification must the lock meet?

FF-P-110
FF-L-2740 (Correct answer)
MIL-DTL-43607
FF-L-2890

Correct answer: FF-L-2740

FF-L-2740 is the federal specification for high-security electromechanical combination locks (the X-07 through X-10 family) used on GSA-approved containers and vault doors. FF-L-2890 covers pedestrian door lock extensions and deadbolt systems, FF-P-110 covers changeable combination padlocks, and MIL-DTL-43607 covers high-security key-operated padlocks.

Question 4: In the context of OPSEC, what is an 'indicator'?

A security control, such as encryption or access control, designed to protect data.
A specific, known adversary who has the capability and intent to harm operations.
A formal declaration that an asset has been classified as secret or top secret.
Friendly, detectable actions that can be pieced together by an adversary to derive critical information. (Correct answer)

Correct answer: Friendly, detectable actions that can be pieced together by an adversary to derive critical information.

Indicators are friendly activities, often unclassified and seemingly harmless on their own, that an adversary can observe and analyze to reveal or infer critical information. For example, a sudden increase in pizza deliveries to a command center late at night could indicate that a major operation is imminent.

Question 5: A passive infrared (PIR) motion sensor is mounted at the far end of a long, narrow corridor, aimed straight down its length. A penetration test shows an intruder walking directly toward the sensor sets off the alarm late or not at all. What is the most likely reason?

PIR sensors only detect objects warmer than 40°C, so normal body heat is not enough at that distance
PIR sensors detect best when a heat source moves across their detection zones; moving straight at the sensor crosses few zones (Correct answer)
PIR sensors detect Doppler shift, which is weakest when a target moves straight toward the sensor
The corridor walls reflect the sensor's emitted infrared beam away from the intruder

Correct answer: PIR sensors detect best when a heat source moves across their detection zones; moving straight at the sensor crosses few zones

A PIR sensor is passive. It sends out nothing and detects changes in infrared (heat) energy as a warm body moves between its segmented detection zones. Movement across those zones gives the strongest signal. Walking straight toward the sensor keeps the intruder in roughly the same zone, so detection is weak. Doppler sensitivity describes microwave sensors, which are actually best at picking up movement toward or away from them. That is why dual-technology (PIR plus microwave) sensors are used to cover each other's blind spots.

Question 6: What is a 'defense-in-depth' approach to physical security?

Using multiple concentric layers of security controls so that an attacker must overcome multiple barriers to reach the protected area (Correct answer)
Installing the most advanced technology available at a single checkpoint
Deploying all security guards at the main entrance
Focusing all security resources on the outer perimeter

Correct answer: Using multiple concentric layers of security controls so that an attacker must overcome multiple barriers to reach the protected area

A layered approach to physical security uses multiple concentric security rings so that an adversary must overcome each layer successively, significantly increasing the difficulty of reaching the protected target.

Question 7: What is 'inherent risk' versus 'residual risk' in security risk management?

Inherent risk is the risk level before any controls are applied; residual risk is what remains after controls are implemented (Correct answer)
Inherent risk is financial; residual is operational
They are the same concept with different names
Residual risk is always higher than inherent risk

Correct answer: Inherent risk is the risk level before any controls are applied; residual risk is what remains after controls are implemented

Inherent risk is the raw, unmitigated risk before any controls are applied, while residual risk is the remaining risk level after all security controls and mitigations have been implemented.

Question 8: What is 'pretext calling' in the context of personal security threats?

Using a false scenario to manipulate a target into revealing information (Correct answer)
Making phone calls from a landline
Calling someone before an important meeting
Scheduling calls in advance

Correct answer: Using a false scenario to manipulate a target into revealing information

Pretext calling involves creating a fabricated scenario to manipulate a target into revealing confidential information or performing an action.

Question 9: A cleared employee who is a U.S. citizen and also a citizen of another country renews the foreign passport. They then use it, instead of the U.S. passport, to enter and leave the United States because the line is shorter. Under SEAD 4, which adjudicative guideline does this most directly raise?

Guideline E – Personal Conduct
Guideline K – Handling Protected Information
Guideline C – Foreign Preference (Correct answer)
Guideline B – Foreign Influence

Correct answer: Guideline C – Foreign Preference

Guideline C (Foreign Preference) is about acts that show a preference for another country over the United States. SEAD 4 specifically names failing to use a U.S. passport when entering or leaving the United States as a disqualifying condition under Guideline C. Guideline B covers foreign contacts, relatives, and interests that could be used for pressure or coercion. Personal Conduct and Handling Protected Information don't fit this situation as directly.

Question 10: SEAD 4, Appendix C lists three exceptions to the standard adjudication: Condition, Deviation, and Waiver. An investigation could not cover two years the applicant spent overseas, but the adjudicator still grants eligibility because the rest of the record is favorable. How should this be recorded?

Interim eligibility
Waiver
Condition
Deviation (Correct answer)

Correct answer: Deviation

Under SEAD 4 Appendix C, a Deviation means eligibility was granted even though the investigation had a significant gap in coverage or scope, such as missing years of overseas history. A Waiver means eligibility was granted even though the person did not fully meet the adjudicative standards, usually with restrictions. A Condition means eligibility was granted with specific requirements, such as monitoring or treatment. Interim eligibility is a temporary decision made before the investigation is finished, not an Appendix C exception.

Question 11: A single document contains Critical Infrastructure information (a CUI Basic category) and Export Controlled information (a CUI Specified category). Under the NARA CUI marking framework, which banner marking approach is required?

The banner must read only 'CUI', because category markings belong in portion markings and never in the banner
The banner must list the Basic category first and the Specified category second, and both are mandatory
Because Basic and Specified information are mixed, the whole document must be handled as CUI Basic, and 'CUI' alone is enough
The banner must include the Specified category (for example 'CUI//SP-EXPT'). Including the Basic category marking in the banner is optional unless agency policy requires it (Correct answer)

Correct answer: The banner must include the Specified category (for example 'CUI//SP-EXPT'). Including the Basic category marking in the banner is optional unless agency policy requires it

CUI Specified categories carry handling requirements beyond CUI Basic, so their markings, with the 'SP-' prefix, must appear in the banner. Agency policy decides whether CUI Basic category markings are included. Treating the document as Basic only, or leaving all categories out of the banner, would hide the extra Specified requirements from recipients.

Question 12: A covered individual with a Secret eligibility determination lives near the northern border. On a Saturday, with no advance plan, they drive into Canada for a few hours of shopping and return the same day. Under Security Executive Agent Directive 3 (SEAD 3), what are this person's reporting obligations?

The trip should have been reported before departure, so the person has already committed a reportable violation
Report the trip after returning, within five business days (Correct answer)
Report it only if the person had contact with a Canadian government official
Nothing has to be reported, because Canada is a close ally and same-day trips are exempt

Correct answer: Report the trip after returning, within five business days

SEAD 3 normally requires unofficial foreign travel to be reported before departure. It makes a specific exception for unplanned day trips to Canada or Mexico, which must be reported within five business days after returning. Canada is not exempt from reporting. The trip is not a violation because the exception covers unplanned day trips. Reporting does not depend on contact with foreign officials.

Question 13: Agency A legitimately holds Confidential information that came from Agency B. Agency C, whose personnel are properly cleared and have a valid need-to-know, asks Agency A for it. What does E.O. 13526 require of Agency A?

Release it to Agency C, since clearance and need-to-know are all that is required
Get Agency B's consent before sharing, unless an applicable exception or prior agreement allows it (Correct answer)
Refuse the request permanently; information from another agency can never be passed on
Release it only after downgrading it to CUI

Correct answer: Get Agency B's consent before sharing, unless an applicable exception or prior agreement allows it

Under E.O. 13526 Sec. 4.1(i), the "third agency rule" says classified information that came from another agency may not be disseminated outside the receiving agency without the originating agency's consent, subject to limited exceptions such as certain Intelligence Community provisions and prior agreements. Clearance and need-to-know alone are not enough. Agency A also has no authority to downgrade Agency B's information.

Question 14: A data center is located in an area prone to power outages. To ensure its physical security systems, including access controls and surveillance, remain operational at all times, which of the following is the MOST critical supporting measure?

Motion-activated security cameras.
A contract with a local security guard service.
An uninterruptible power supply (UPS) and backup generator. (Correct answer)
A loud, audible alarm system.

Correct answer: An uninterruptible power supply (UPS) and backup generator.

Physical security systems like access controls and surveillance cameras rely on electricity. During a power outage, these systems will fail. An uninterruptible power supply (UPS) provides immediate, short-term power, while a backup generator can sustain power for an extended period. This ensures continuous operation of critical security measures. The other options are valuable but do not address the fundamental issue of power loss.

Question 15: An activity must pick between a GSA Class 5 and a GSA Class 6 container to store classified documents in an area where forced entry is a realistic threat. Which statement correctly tells them apart?

Class 5 is approved only for weapons and Class 6 only for documents, so Class 6 is the only choice
Both classes give 30 minutes of surreptitious-entry protection, but only Class 5 also gives forced-entry protection (Correct answer)
Class 6 gives more surreptitious-entry protection than Class 5, so it is preferred in high-threat areas
Both classes give the same forced-entry protection and differ only in fire resistance

Correct answer: Both classes give 30 minutes of surreptitious-entry protection, but only Class 5 also gives forced-entry protection

Class 5 and Class 6 containers both resist surreptitious entry for 30 minutes. Class 5 also resists forced entry for a set time, while Class 6 has no forced-entry rating. Where forced entry is a realistic threat, a Class 5 container is the right choice. Class 6 does not offer more surreptitious-entry protection, both classes can hold documents, and fire resistance is not what separates them.

Question 16: During a background investigation, an investigator discovers that the applicant deliberately omitted information about a prior arrest on their SF-86, Questionnaire for National Security Positions. Under which adjudicative guideline would this be a primary concern?

Guideline B: Foreign Influence
Guideline F: Financial Considerations
Guideline E: Personal Conduct (Correct answer)
Guideline I: Psychological Conditions

Correct answer: Guideline E: Personal Conduct

Guideline E, Personal Conduct, addresses issues of questionable judgment, lack of candor, dishonesty, and unwillingness to comply with rules and regulations. Deliberately falsifying information on a security questionnaire is a significant issue under this guideline.

Question 17: What should a security professional do if they believe they are being surveilled?

Immediately confront the suspected surveiller
Post about it on social media
Follow established protocols, avoid revealing awareness, and report to security personnel (Correct answer)
Ignore the surveillance and continue normal activities

Correct answer: Follow established protocols, avoid revealing awareness, and report to security personnel

Established protocols typically include not revealing awareness of surveillance while covertly noting details and reporting to security personnel to assess the threat.

Question 18: A subsidiary needs a SECRET facility clearance (FCL) for a new classified contract. Its parent company holds no FCL and does not want to get one. Under 32 CFR Part 117, how can the subsidiary's FCL go forward?

The subsidiary may be cleared automatically as long as its own KMP hold SECRET PCLs, and no action by the parent is needed
The parent may be excluded from access to classified information through a formal exclusion action (such as a board resolution) acceptable to the CSA, and the subsidiary can then be cleared (Correct answer)
The subsidiary cannot receive an FCL unless the parent first obtains an FCL at the same or a higher level
The GCA may sponsor the parent for an interim FCL that expires when the contract ends

Correct answer: The parent may be excluded from access to classified information through a formal exclusion action (such as a board resolution) acceptable to the CSA, and the subsidiary can then be cleared

Normally a parent of a cleared subsidiary must hold an FCL at the same or higher level. If it does not, the parent (and its KMP) must be formally excluded from access to classified information, typically by a board resolution, and the CSA must find this acceptable. The exclusion must effectively stop the parent from accessing or influencing the subsidiary's classified work. It is not automatic just because the subsidiary's KMP are cleared.

Question 19: A SAP whose existence is protected and whose reporting to Congress is limited to oral briefings for select committee leaders is called what?

Waived SAP (Correct answer)
Acknowledged SAP
Controlled Access Program
Carve-out SAP

Correct answer: Waived SAP

Waived SAPs are unacknowledged programs exempt from standard reporting, briefed only orally to specific congressional leaders.

Question 20: A GSA-approved security container with an FF-L-2740 lock is being taken out of service and sent to excess property. What must be done with the combination?

Leave it unchanged so a GSA-certified locksmith can verify the last authorized setting
Reset it to a random combination and destroy the SF 700 record
Reset it to the factory standard combination 50-25-50 (Correct answer)
Change it, then send the new combination to the receiving activity on an SF 700

Correct answer: Reset it to the factory standard combination 50-25-50

When a container is taken out of service, its built-in combination lock must be reset to the factory standard combination of 50-25-50. Anyone who receives it can then open it without help, and no combination that once protected classified material stays on the lock. Leaving the old combination, choosing a random one, or sending a combination to the receiver all fail to neutralize the lock.

Question 21: An applicant filling out the SF-86 for a first-time clearance used marijuana several times during college, 8 years before signing the form. They have never held a clearance or a sensitive position, and they answer 'No' to the illegal drug use question. What does this omission mean for adjudication?

It is deliberate falsification under Guideline E (Personal Conduct), because all past drug use must be disclosed
It is not falsification, because the SF-86 drug-use question covers only the last 7 years unless the use happened while holding a clearance or sensitive position (Correct answer)
It is a minor omission that the investigator should fix, but it still must be reported as a Guideline H concern
It is a Bond Amendment disqualifier that automatically bars eligibility

Correct answer: It is not falsification, because the SF-86 drug-use question covers only the last 7 years unless the use happened while holding a clearance or sensitive position

Section 23 of the SF-86 asks about illegal drug use within the last seven years. It asks about use at any time only if the person held a clearance, held a sensitive position, or worked in law enforcement or prosecution when the use happened. Use 8 years ago, before any clearance, falls outside the question, so a truthful 'No' is not falsification. Guideline E applies only to deliberate omissions of information the form actually asks for. The Bond Amendment applies to current unlawful users, not past use.

Question 22: A GSA-approved security container is emptied and permanently taken out of service before being sent to another organization. What must happen to its combination lock?

Reset it to the standard combination 50-25-50 (Correct answer)
Remove and destroy the lock, because it cannot be reused
Leave the current combination and send the SF 700 with the container
Reset it to 10-20-30 so the receiving activity can identify it

Correct answer: Reset it to the standard combination 50-25-50

When a container is taken out of service, the combination lock is reset to the factory standard combination of 50-25-50. This keeps the old combination from being exposed and lets the next user set a new one. Sending the SF 700 with the container would hand over the combination, and the lock does not have to be destroyed.

Question 23: What is 'pattern analysis' in the context of OPSEC threats?

Statistical analysis of security incidents
Analyzing fabric patterns for security badges
The adversary technique of identifying regularities in behavior that can be used to predict activities or reveal critical information (Correct answer)
A method for creating security policies

Correct answer: The adversary technique of identifying regularities in behavior that can be used to predict activities or reveal critical information

Pattern analysis involves an adversary identifying recurring patterns in an organization's activities, schedules, or behaviors that can reveal sensitive information about planned operations.

Question 24: A cleared company wants to keep some key management personnel (KMP) from needing personnel clearances (PCLs) by using an exclusion resolution of the board. Which position CANNOT be excluded this way?

An outside member of the board of directors
The Vice President of Human Resources
The corporate Treasurer, who has no involvement in classified contracts
The Insider Threat Program Senior Official (ITPSO) (Correct answer)

Correct answer: The Insider Threat Program Senior Official (ITPSO)

Under 32 CFR 117.9, the senior management official, the FSO, and the ITPSO must always be cleared to the level of the facility clearance (FCL). Other officers, directors, and KMP may be excluded by a formal board action if they won't need access to classified information and can be kept from affecting the classified contracts.

Question 25: A user receives an email that appears to be from their bank, asking them to click a link and verify their account details. This is an example of what type of attack?

Denial-of-Service (DoS)
Malware injection
Phishing (Correct answer)
Man-in-the-Middle (MitM)

Correct answer: Phishing

Phishing is a type of social engineering attack where an attacker sends fraudulent communications that appear to come from a reputable source, usually a financial institution or other service provider. The goal is to deceive the recipient into revealing sensitive information such as login credentials or credit card numbers.

Question 26: Which of the following is a good practice for protecting personal information online?

Sharing your location on all social platforms
Accepting all friend requests
Regularly reviewing and adjusting privacy settings on social media (Correct answer)
Using the same password for all accounts

Correct answer: Regularly reviewing and adjusting privacy settings on social media

Regularly reviewing and adjusting privacy settings limits the amount of personal information accessible to potential adversaries or identity thieves.

Question 27: In the context of emergency management, what does 'shelter-in-place' mean?

Setting up temporary housing
Remaining in a building during an emergency (Correct answer)
Conducting drills in a specific location
Evacuating to a designated shelter

Correct answer: Remaining in a building during an emergency

Shelter-in-place means to take immediate shelter in the building you are already in rather than evacuating, often used during hazardous material incidents.

Question 28: How can security professionals protect themselves from 'phishing' attacks?

Printing all emails before reading
Only using work email accounts
Never using email
Verifying the sender's identity and being suspicious of unexpected requests for information (Correct answer)

Correct answer: Verifying the sender's identity and being suspicious of unexpected requests for information

Phishing protection involves verifying the sender's identity, being cautious of unexpected requests, and not clicking suspicious links or providing sensitive information via email.

Question 29: A facility wants to buy a new paper shredder for destroying classified material. Which requirement applies?

The shredder must be on the NSA/CSS Evaluated Products List (EPL) for paper shredders, and its final particle size must be 1 mm x 5 mm or smaller (Correct answer)
The shredder needs approval only from the facility security officer, with no outside product list
Any cross-cut shredder is fine if the shred is burned afterward
Any strip-cut shredder is fine if the strips are 1/4 inch or narrower

Correct answer: The shredder must be on the NSA/CSS Evaluated Products List (EPL) for paper shredders, and its final particle size must be 1 mm x 5 mm or smaller

Equipment used to destroy classified paper must be on the NSA/CSS EPL (NSA/CSS Policy Manual 9-12). Approved crosscut shredders must produce particles of 1 mm x 5 mm or smaller. Strip-cut shredders are not approved for classified destruction. Burning afterward does not fix an unapproved shredder, and an FSO cannot certify equipment that isn't on the EPL.

Question 30: Which of the following is considered the FIRST step in the traditional five-step OPSEC process?

Analyze Threats
Identify Critical Information (Correct answer)
Apply Countermeasures
Assess Risks

Correct answer: Identify Critical Information

The foundational first step of the OPSEC process is to identify the critical information. An organization cannot protect its sensitive information if it does not first determine what information, if compromised, would cause the most harm to its mission or operations.

Question 31: You find a classified document left unattended on a desk after hours. What should you do first?

Take custody and safeguard it, then immediately report to the security office (Correct answer)
Photograph it and email the photo to your supervisor
Take it home to secure it overnight
Leave it, since it is not your document

Correct answer: Take custody and safeguard it, then immediately report to the security office

Protect the material by keeping it under control until it can be secured, then report the discovery right away to security. Never leave it, copy it, or move it off-site. Reporting lets security begin the inquiry.

Question 32: Under SEAD 3, a covered individual with Top Secret eligibility takes an unplanned day trip across the border into Mexico while vacationing in San Diego. No pre-travel report was filed. What is the correct reporting action?

Report it at the next periodic reinvestigation on the SF-86
The trip was a violation because all foreign travel needs pre-approval, and it must be self-reported as a security infraction within 24 hours
No report is needed, because travel to contiguous countries is exempt from SEAD 3 reporting
Report the trip within 5 business days of returning (Correct answer)

Correct answer: Report the trip within 5 business days of returning

SEAD 3 normally requires unofficial foreign travel to be reported ahead of time. It makes one specific exception: unplanned day trips to Canada or Mexico can be reported within five business days after returning. These trips are not fully exempt. They are not an automatic infraction either, and waiting until reinvestigation is too late.

Question 33: Under the CUI program, who may generally be given access to CUI?

Anyone with a lawful government purpose, subject to any dissemination controls (Correct answer)
Only personnel holding a Secret clearance
Any U.S. citizen on request
Only federal employees

Correct answer: Anyone with a lawful government purpose, subject to any dissemination controls

CUI access is based on a lawful government purpose and need to know. No security clearance is required, and any dissemination controls on the specific CUI must still be followed.

Question 34: What is the purpose of SAP 'security education and training' programs?

To provide general security awareness only
To ensure that all personnel with SAP access understand their specific security responsibilities, the unique threats to the program, and how to respond to security incidents (Correct answer)
Only to meet legal compliance requirements
To train employees in basic computer skills

Correct answer: To ensure that all personnel with SAP access understand their specific security responsibilities, the unique threats to the program, and how to respond to security incidents

SAP security education ensures that cleared personnel understand the unique security requirements of the specific program, the threats it faces, their reporting obligations, and how to handle security incidents.

Question 35: Information falls under a CUI Specified category. The law that authorizes it imposes a specific dissemination restriction but says nothing about physical safeguarding or destruction. How should the holder handle safeguarding and destruction?

Ask the originating agency to reclassify the information as CUI Basic so that a single set of rules applies
Apply CUI Basic standards for safeguarding and destruction, since Specified controls apply only where the authority prescribes them (Correct answer)
No safeguarding or destruction controls apply because the authority is silent
Apply the safeguarding and destruction rules for Confidential classified information as the closest equivalent

Correct answer: Apply CUI Basic standards for safeguarding and destruction, since Specified controls apply only where the authority prescribes them

CUI Specified means the authorizing law, regulation, or government-wide policy sets specific handling controls that differ from CUI Basic. Where the authority is silent on an area, the holder applies the CUI Basic controls from 32 CFR Part 2002 for that area. The Specified controls add to the baseline for the areas they cover. A silent authority does not remove protection, and classified-information rules are never used as a substitute.

Question 36: A DoD activity wants to openly store SECRET material in a secure room that has no intrusion detection system (IDS). Under DoD Manual 5200.01, Volume 3, which supplemental control would allow this?

An end-of-day security check (SF 701) is completed and the door is fitted with an FF-L-2740 lock
Cleared security force personnel inspect the room at least once every 4 hours (Correct answer)
Cleared security force personnel inspect the room at least once every 8 hours
CCTV records the entrance continuously and the footage is reviewed the next business day

Correct answer: Cleared security force personnel inspect the room at least once every 4 hours

For open storage of SECRET in a secure room, the supplemental control is either an IDS with a response time of 30 minutes or less, or inspections by cleared security force personnel every 4 hours. An 8-hour interval is too long. An SF 701 check plus a compliant lock is a baseline requirement, not a supplemental control. CCTV that is reviewed later does not give timely detection and response.

Question 37: Which of the following should be reported as a suspicious contact?

An unsolicited request from a foreign national for information about your work, or a persistent inquiry from someone with unclear motives (Correct answer)
A vendor's standard catalog
A coworker's birthday invitation
A routine email from your supervisor

Correct answer: An unsolicited request from a foreign national for information about your work, or a persistent inquiry from someone with unclear motives

Unsolicited requests for sensitive or program information, particularly from foreign nationals or via unusual channels, are classic indicators of FIE collection and must be reported under NISP and agency rules.

Question 38: A SECRET document also contains several paragraphs of unclassified CUI. Which marking approach correctly shows both on the commingled document?

Mark the banner only 'SECRET'; the CUI is absorbed into the classified marking and needs no separate indicator
Mark the banner 'CUI//SECRET', because the CUI marking always comes first in the banner line
Split the CUI paragraphs into a separate attachment, because CUI and classified information can never appear in the same document
Use a banner such as 'SECRET//CUI' and portion mark the CUI paragraphs '(CUI)', alongside the classified portion markings (Correct answer)

Correct answer: Use a banner such as 'SECRET//CUI' and portion mark the CUI paragraphs '(CUI)', alongside the classified portion markings

When CUI is commingled with classified information, the CUI control marking goes into the banner after the classification (for example, 'SECRET//CUI'). Portion markings are mandatory in classified documents, so the CUI portions are marked '(CUI)' and the classified portions get their own classification markings. This lets CUI be correctly identified and decontrolled if the document is later declassified. The classification always comes first in the banner.

Question 39: An authorized holder formally challenges a classification. The agency gave no response within 60 days, and 120 days have now passed with still no response. What can the challenger do under 32 CFR 2001.14?

Forward the challenge directly to the Interagency Security Classification Appeals Panel (ISCAP) (Correct answer)
Declassify the information on their own, since the agency did not respond
Release the information to the public under the Freedom of Information Act
Nothing; the challenger must wait until the agency head issues a final decision

Correct answer: Forward the challenge directly to the Interagency Security Classification Appeals Panel (ISCAP)

Agencies must give an initial written response to a classification challenge within 60 days. If the agency has not responded within 120 days, the challenger may forward the challenge directly to ISCAP. The information stays classified until the challenge is resolved, so neither self-declassification nor public release is allowed. Challengers are also protected from retribution.

Question 40: What are 'courier cards' used for in industrial security?

Official documentation carried by authorized personnel to certify they are cleared to hand-carry classified materials (Correct answer)
Identification for security conference attendance
Business cards for security officers
Access badges for cleared facilities

Correct answer: Official documentation carried by authorized personnel to certify they are cleared to hand-carry classified materials

Courier cards are official documentation issued to cleared personnel who are authorized to hand-carry classified materials, certifying their clearance level and authorization to transport specific classified information.

Question 41: What is the purpose of a security vulnerability assessment in industrial security?

To assess financial risks
To identify weaknesses that could allow unauthorized access to classified information (Correct answer)
To review supply chain logistics
To evaluate employee performance

Correct answer: To identify weaknesses that could allow unauthorized access to classified information

A security vulnerability assessment identifies gaps and weaknesses in security systems that could be exploited to gain unauthorized access to classified information.

Question 42: A cleared employee sees a news website publish what looks like a classified document from a program their company supports. A coworker says it's 'public now,' so it can be discussed openly. What is the correct position?

The coworker is right. Unauthorized public release declassifies the information automatically.
The information can be discussed internally but not with outsiders, because its classification is downgraded one level.
The information stays classified. Employees should not confirm, deny, or spread it further, and the matter should be reported through the FSO to the CSA. (Correct answer)
The information becomes unclassified only for employees who were not briefed on the program.

Correct answer: The information stays classified. Employees should not confirm, deny, or spread it further, and the matter should be reported through the FSO to the CSA.

Under EO 13526 Sec. 1.1(c), classified information is not automatically declassified because of an unauthorized disclosure. Cleared personnel must keep protecting it: no confirming, denying, discussing, or downloading it on unclassified systems. The suspected compromise should be reported through the FSO to the CSA.

Question 43: A cleared contractor employee reports that a recent contact appears to be an attempt to recruit them to pass classified information to a foreign intelligence service. Under 32 CFR 117.8, where must the contractor report information about actual, probable, or possible espionage?

To the GCA's contracting officer, who forwards it to the CSA
Only to the CSA (DCSA), which then decides whether to involve law enforcement
To the FBI, with a copy to the CSA (Correct answer)
Only to the company's Insider Threat Program, which investigates before any outside report

Correct answer: To the FBI, with a copy to the CSA

Information about actual, probable, or possible espionage, sabotage, terrorism, or subversive activities must be reported promptly to the FBI, with a copy to the CSA (DCSA for most contractors). This is different from routine suspicious contact or adverse information reports, which go to the CSA. The Insider Threat Program may support the response, but it must not delay or replace the FBI report.

Question 44: What is an 'Authority to Operate' (ATO) in the RMF process?

An official management decision granting permission to operate an information system at an acceptable level of risk (Correct answer)
A general employee authorization form
A certificate of system functionality
A type of software license

Correct answer: An official management decision granting permission to operate an information system at an acceptable level of risk

An ATO is the official authorization from a senior official granting permission to operate an information system, based on an assessment that the risk to organizational operations is acceptable.

Question 45: Who holds the ultimate authority within a U.S. government department to establish a new Special Access Program?

The Director of the Defense Counterintelligence and Security Agency (DCSA)
The head of the department or agency (e.g., Secretary of Defense) (Correct answer)
The Program Security Officer (PSO)
The Chairman of the Joint Chiefs of Staff

Correct answer: The head of the department or agency (e.g., Secretary of Defense)

The authority to create a SAP rests at the highest level of a department or agency. For example, the Secretary of Defense, Secretary of State, or the Director of National Intelligence (or their principal deputies) are the officials who can establish a SAP. [2, 6, 23]

Question 46: Which of the following are the three recognized categories of Special Access Programs within the Department of Defense?

Operational, Technological, and Strategic
Acknowledged, Unacknowledged, and Waived
Counterintelligence, Counter-terrorism, and Counter-proliferation
Acquisition, Intelligence, and Operations & Support (Correct answer)

Correct answer: Acquisition, Intelligence, and Operations & Support

DoD policy categorizes SAPs based on their primary function. The three categories are Acquisition (AQ) for sensitive research and development; Intelligence (IN) for sensitive intelligence operations; and Operations and Support (OS) for sensitive military activities. [2, 5]

Question 47: A security manager is upgrading the pedestrian door of a vault so it uses a high-security combination lock with compatible exit and locking hardware. Which federal specification covers that pedestrian door lock extension hardware?

FF-L-2937
FF-P-110
FF-L-2890 (Correct answer)
FED-STD-832

Correct answer: FF-L-2890

FF-L-2890 covers pedestrian door locking devices, called lock extension hardware. It is used with an FF-L-2740 combination lock on doors to vaults and secure rooms. FF-P-110 covers high-security padlocks. FF-L-2937 covers mechanical combination locks for containers and filing cabinets. FED-STD-832 covers construction methods for vaults, not door lock hardware.

Question 48: What best distinguishes a security violation from a security infraction?

A violation is a knowing, willful, or negligent action that could cause or does cause compromise, while an infraction is a lesser rule breach without loss or compromise (Correct answer)
A violation involves unclassified material, an infraction involves classified material
There is no difference; the terms are interchangeable
A violation is reported only to the FBI, an infraction only to the supervisor

Correct answer: A violation is a knowing, willful, or negligent action that could cause or does cause compromise, while an infraction is a lesser rule breach without loss or compromise

Infractions are security rule failures that do not result in loss, compromise, or suspected compromise. Violations are knowing, willful, or negligent actions that could reasonably be expected to result in, or do result in, compromise of classified information.

Question 49: A security manager is implementing Crime Prevention Through Environmental Design (CPTED) principles for a new corporate campus. Which of the following measures BEST exemplifies the principle of 'Natural Surveillance'?

Using thorny bushes below ground-floor windows and ensuring building entrances are well-lit and visible from the street. (Correct answer)
Posting signs that clearly define the property line and designate private areas.
Issuing key cards to all employees to restrict access to specific buildings.
Installing a high-perimeter fence with a single, guarded entry point.

Correct answer: Using thorny bushes below ground-floor windows and ensuring building entrances are well-lit and visible from the street.

Natural Surveillance, a core principle of CPTED, focuses on designing the environment to maximize visibility and the perception that people can be seen. Placing thorny bushes makes it difficult for potential intruders to hide near windows, and ensuring entrances are well-lit and visible from public areas increases the chances that illicit activities will be observed by employees, visitors, or passersby.

Question 50: A company applying for a Facility Clearance wants to use an exclusion action for key management personnel (KMP) who will not need classified access. Which KMP position can NOT be excluded and must always be cleared to the level of the FCL?

The Senior Management Official (SMO) (Correct answer)
The corporate Treasurer
The Chairman of the Board
Outside directors who sit on the board

Correct answer: The Senior Management Official (SMO)

Under 32 CFR 117.9, the Senior Management Official, the FSO, and the ITPSO must always hold personnel clearances at the level of the facility clearance. Other officers, directors, and KMP, including the board chair and outside directors, can be excluded through a formal exclusion action. That action states they will not require, will not have, and can be effectively denied access to classified information, and that they cannot adversely affect the company's security program.

Question 51: Several items that are each UNCLASSIFIED are combined in a report. Together they reveal a classified relationship, so the report is classified by compilation. Under 32 CFR 2001.24, what marking requirement applies to this kind of document?

The document must be marked 'CLASSIFIED BY COMPILATION' in place of the normal banner line
No overall classification is needed, because the portions are unclassified and portion marks always control
The document must explain how the combined information justifies classification, while the portions keep their own (unclassified) markings (Correct answer)
Each portion must be marked at the overall classification level, since the classification applies to every paragraph

Correct answer: The document must explain how the combined information justifies classification, while the portions keep their own (unclassified) markings

When classification comes only from compilation, the individual portions are still unclassified and are marked that way. The document gets the overall classification of the compilation and must include a clear explanation of why combining the items warrants classification. This tells users which pieces can be released separately and which combination is protected. There is no 'CLASSIFIED BY COMPILATION' banner.

Question 52: During a subject interview, an investigator asks about a 2022 debt that went to collections. The applicant had deliberately left it off the SF-86, and only now admits the omission. A second applicant, who had also deliberately left a debt off, called the investigator before any interview to correct the form and supplied documents. Under SEAD 4 Guideline E (Personal Conduct), which statement best describes how the two cases differ?

Both cases are mitigated equally, because each applicant eventually gave accurate information before the final adjudication
The second applicant fits a specific mitigating condition because they made prompt, good-faith efforts to correct the omission before being confronted; the first applicant does not (Correct answer)
Neither case can be mitigated, because any deliberate falsification of the SF-86 disqualifies automatically under federal law
The first applicant has stronger mitigation, because admitting something under questioning shows more candor than correcting it voluntarily

Correct answer: The second applicant fits a specific mitigating condition because they made prompt, good-faith efforts to correct the omission before being confronted; the first applicant does not

SEAD 4 Guideline E names a mitigating condition for an applicant who made prompt, good-faith efforts to correct an omission, concealment or falsification before being confronted with the facts. The second applicant fits that condition. The first applicant corrected the record only after being confronted, so the condition doesn't apply. Their case would rest on other factors, such as how serious and how recent the omission was and the whole-person assessment. Deliberate falsification is a serious concern, but it does not disqualify automatically.

Security Fundamentals Professional Certification (SFPC)

The SFPC exam validates foundational knowledge of DoD security disciplines including personnel security, information security, physical security, industrial security, and operations security.

Questions

120 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cdse.edu — Test delivery, eligibility, exam format, passing score, retake policy, score release, score validity, exam information · verified Oct 2026