SFPC Counterintelligence and Foreign Intelligence Threats 2 — Questions and Answers
Question 1: Under 32 CFR Part 117 (NISPOM), to which organization must a cleared contractor report suspicious contacts?
- The National Security Agency
- The cognizant security agency (DCSA) (Correct answer)
- The Department of State
- The contractor's corporate legal office only
Correct answer: The cognizant security agency (DCSA)
NISPOM requires contractors to report suspicious contacts to their cognizant security agency, which for most DoD contractors is DCSA.
Question 2: Which federal agency has primary responsibility for counterintelligence investigations inside the United States?
- Central Intelligence Agency
- Defense Intelligence Agency
- Federal Bureau of Investigation (Correct answer)
- Department of Homeland Security
Correct answer: Federal Bureau of Investigation
The FBI leads domestic counterintelligence investigations, while the CIA's focus is abroad.
Question 3: What is the typical first phase of the foreign intelligence recruitment cycle?
- Spotting and assessing potential targets (Correct answer)
- Tasking the asset
- Paying the asset
- Terminating the relationship
Correct answer: Spotting and assessing potential targets
Intelligence officers first spot and assess people with access and exploitable vulnerabilities before developing and recruiting them.
Question 4: Under SEAD 3, when must a covered individual report planned unofficial foreign travel?
- Only after returning, if something suspicious happened
- Within 30 days after returning
- Only when traveling to a country on a sanctions list
- Before travel, submitting the itinerary to the security office (Correct answer)
Correct answer: Before travel, submitting the itinerary to the security office
SEAD 3 requires unofficial foreign travel to be reported and approved before departure, with deviations reported on return.
Question 5: An engineer at a conference is flattered by a stranger who then asks them to 'just confirm' a detail about their classified project. This technique is best described as:
- Phishing
- Elicitation (Correct answer)
- Social engineering via malware
- Tailgating
Correct answer: Elicitation
Elicitation draws out protected information through casual, non-threatening conversation, often using flattery.
Question 6: How does the National Insider Threat Task Force define an insider threat?
- Any foreign national employed by a cleared contractor
- Any employee who violates company policy
- A person who uses authorized access, wittingly or unwittingly, to harm U.S. national security (Correct answer)
- An outside hacker who gains network access
Correct answer: A person who uses authorized access, wittingly or unwittingly, to harm U.S. national security
An insider threat is someone with authorized access who uses it, wittingly or unwittingly, to cause harm to national security.
Question 7: According to EO 12333, counterintelligence includes information gathered and activities conducted to:
- Identify, deceive, exploit, disrupt, or protect against espionage and other intelligence activities by foreign powers (Correct answer)
- Collect foreign economic data for U.S. businesses
- Enforce export control licensing
- Classify national security information
Correct answer: Identify, deceive, exploit, disrupt, or protect against espionage and other intelligence activities by foreign powers
EO 12333 defines CI as activities to identify, deceive, exploit, disrupt, or protect against foreign intelligence activities, sabotage, and assassinations.
