Insider Threat Awareness Exam Part 1
This deck covers key concepts and scenarios related to insider threat awareness, including reporting procedures, risk indicators, and responsibilities.
Which of the following scenarios describe a potential insider threat?
-An employee takes a photo at their desk and posts it to social media. Documents marked CONFIDENTIAL are visible in the photo (Correct)
-An engineer regularly leaves their security badge in their desk and relies on others to let him in the building. (Correct)
-A project manager at a cleared facility accidentally takes home a document marked Controlled Unlassified Information (CUI). (Correct)
Key Terms
Which of the following scenarios describe a potential insider threat?
-An employee takes a photo at their desk and posts it to social media. Documents marked CONFIDENTIAL are visible in the photo (Correct)
-An ...
Johan is a janitor at a DOD facility. He does not have national security eligibility determination. When he is working near the building entrances, he often opens the door for everyone entering. Does this pose an insider threat as defined by the NITTF? Why or why not?
Yes, the incident does meet the definition because Johan is using his authorized access and may cause damage by violating security procedures. (Cor...
Julien is a DOD program manager. He recently accepted a friend request from a woman on social media. The messages started out unrelated to Julien's work. The woman's messages quickly shifted when she started complaining about her job and offering details about her work. Over time, Julien and the women started talking more and more about their work. The women is now sending messages asking increasingly direct questions about Julien's work. What should Julien do and why?
Report it, as the woman may be part of a broader effort to gather information about DOD programs. (Correct)
Sun works for a private cleared defense contractor. Her facility recently experienced suspicious network activity... Could the facility be the victim of adversarial targeting? Why or why not?
Yes, adversaries target both public and private organizations (Correct)
Consider the following scenarios. Which are required to be reported?
Leo was rushed to make a deadline and bypassed security rules to fininsh on time (Correct).
Carmen has been drinking a lot. She knows it's becoming a problem but she's having a hard time stopping on her own. What can Carmen do to help reach a positive outcome?
Contact the Employee Assistance Program (EAP) (Correct)
Related Flashcard Decks
Study Tips
- Press F to enter focus mode for distraction-free studying
- Review cards regularly to improve retention
- Try to recall the answer before flipping the card
- Share this deck with friends to study together
| Term | Definition |
|---|---|
Which of the following scenarios describe a potential insider threat? | -An employee takes a photo at their desk and posts it to social media. Documents marked CONFIDENTIAL are visible in the photo (Correct) |
Johan is a janitor at a DOD facility. He does not have national security eligibility determination. When he is working near the building entrances, he often opens the door for everyone entering. Does this pose an insider threat as defined by the NITTF? Why or why not? | Yes, the incident does meet the definition because Johan is using his authorized access and may cause damage by violating security procedures. (Correct) |
Julien is a DOD program manager. He recently accepted a friend request from a woman on social media. The messages started out unrelated to Julien's work. The woman's messages quickly shifted when she started complaining about her job and offering details about her work. Over time, Julien and the women started talking more and more about their work. The women is now sending messages asking increasingly direct questions about Julien's work. What should Julien do and why? | Report it, as the woman may be part of a broader effort to gather information about DOD programs. (Correct) |
Sun works for a private cleared defense contractor. Her facility recently experienced suspicious network activity... Could the facility be the victim of adversarial targeting? Why or why not? | Yes, adversaries target both public and private organizations (Correct) |
Consider the following scenarios. Which are required to be reported? | Leo was rushed to make a deadline and bypassed security rules to fininsh on time (Correct). |
Carmen has been drinking a lot. She knows it's becoming a problem but she's having a hard time stopping on her own. What can Carmen do to help reach a positive outcome? | Contact the Employee Assistance Program (EAP) (Correct) |
Patricia's facility conducted Insider Threat training for everyone in the facility. They stressed that everyone in an organization is responsible for security. Is everyone responsible for reporting concerning behavior and potential threats? Why or why not? | Yes, because Insider Threat programs rely on everyone to report concerning behavior to get a fuller picture of potential threats. (Correct) |
Rafael works for a cleared contractor. He was tarted by a foreign collection attempt. To whom should Rafael report a potential threat? | Insider Threat Program Senior Official (ITPSO) or Facility Security Officer (FSO) (Correct) |
Pauline works or a cleared defense contractor and has been granted Secret eligibility. Her coworkers observedher using a flash drive without authorization. She also sought classified data without the need-to-know. To whom should her coworkers report this behavior? | Insider Threat Program Senior Official (ITPSO) or Facility Security Officer (FSO) (Correct) |
Ross is a federal employee. He was targeted. at a conference and asked to contribute classified and proprietary information to a research project. To whom should he report the contact? | Insider threat program, security officer, or supervisor (Correct) |
Paul works for a cleared defense contractor and has been granted a Top Secret Security eligibility. His coworkers observe him speaking on his personal cell phone in a Sensitive Compartmented Information Facility (SCIF). To whom should his coworkers report this behavior? | Insider Threat Program Senior Official (ITPSO) or Facility Security Officer (FSO) (Correct) |
Julia is an engineer for a cleared defense contractor. She took files home from work and realized she accidently included a file marked SECRET. Does this incident pose an insider threat as defined by the National Insider Threat Task Force (NITTF)? Why or why not? | Yes, the incident meets the definition because Julia has authorized access, and her intention is irrelevant. (Correct) |
Mateo purchased a home with the intention of flipping it. The housing market shifted before he was able to sell putting him in significant debt. Based on this information, is Mateo at increased vulnerability of insider threat? Why or why not? (Select a that apply) | Yes, significant debt is a known stressor that may increase insider threat vulnerability. (Correct) |
Which of the following scenarios are considered a potential insider threat vulnerability? (Select all that apply) | John's disgruntlement with his employer is well known to his coworkers. He regularly displays negligence by ignoring his job responsibilities and not completing his work duties. (Correct) |
Farrah hears a co-worker, upset with his boss, sat, "If I had a gun, I would shoot her!" What should Farrah do and why? | Report it. Threatening violence is a reportable behavioral concern. (Correct) |
Justin is upset that he wasn't assigned the new radar project. He is very interested in the technology. He constantly asks his teammate Claire to share classified, project-related formation with him, though he is not on the project and doesn't have a need-to-know. What should Claire do? | Report it. Seeking classified information without a need-to-know is a reportable behavioral indicator. (Correct) |
Following a conference, Jacqueline, a DOD contractor, received repeated emails from another attendee requesting specific information about the technology that Jacqueline presented on. Jacqueline blocked the other attendee's communications. Should she report this? Why or why not? | Yes, she should report this to her Facility Security Officer (FSO) as a potential collection attempt. (Correct) |
Robb is a DOD employee. He was targeted by a foreign collection attempt. To whom should Robb report a potential threat? | Insider Threat Program (Correct) |
Robb is a DOD employee. He knows he must report potential threats. Which of the following must he report? (Select all that apply) | Unauthorized disclosure of classified information (Correct) |
Sarah is a scientist at a cleared defense contractor. She received a letter asking her to submit a paper related to research on satellite technology that has both military and civilian uses, Sarah reported the request. Why would she have done so? | This type of request could be an adversaries attempt to collect information. (Correct) |
Which of the following scenarios may be indicative of adversarial targeting? (Select all that apply) | During a conference overseas, a researcher's laptop is stolen. (Correct) |
Kathryn is an avid fanticy football fan and contributes $20 to a pool every week where the winner takes all. She drinks moderately on the weekends. Based on this information, must she be at increased risk of becoming an insider threat? | No, The information provided is not subjective enough to indicate a gamboling or alcohol addiction. (Correct) |
Consider the following scenarios. Which may indicate an insider threat vulnerability? | Hema is a DOD engineer. She asks her coworker to grant her access to classified systems though she does not have a need-to-know. (Correct) |
Jack works for a cleared defense contractor. He recently purchased a large, expensive home well outside the price range of his salary. It is a significant upgrade from his previous home, and it is unclear how he was able to make such a large purchase. What should his coworkers do? | Report it. Financial concerns are a potential risk indicator. (Correct) |
Several employees notice Pal exhibiting potential risk indicators. Who is responsible for reporting the potential threat? | Human Resources (Correct) |