Cyber Awareness Challenge Answers

Report the email to your security POC or help desk. This is a phishing attempt using urgency to trick you into clicking a malicious link.

Spear phishing is a type of phishing attack that targets particular individuals, groups of people, or organizations using personalized information to appear legitimate.

Whaling is a complex, targeted phishing attack aimed at senior officials. It uses personalized information such as the target's name, title, official email address, and sender names from personal contacts lists to create an individualized, believable message.

Smishing is a type of social engineering that uses Short Message Service (SMS) text messages to deceive you into providing personal information or gaining access to your device. Do not reply or click the link -- delete the message.

Vishing is a type of social engineering that uses voice calls to deceive you into giving up personal information or installing software that provides access to your devices or network. Let calls from unknown numbers go to voicemail.

B. Do not access sites by selecting links in emails or pop-up messages. Type the address or use bookmarks. Contact the organization using a phone number you know to be legitimate if suspicious.

Never give out organizational, personal, or financial information to anyone by email. Look for digital signatures. Report emails requesting personal information to your security POC or help desk. Delete the email.

This is likely a spear phishing attack. Be wary of suspicious emails that use your name and/or appear to come from inside your organization or a related organization. Report the email to your security POC.

Do not forward it. Email hoaxes clog networks, slow down internet and email services, and can be part of a distributed denial of service (DDoS) attack.

Assume all unsolicited information requests are phishing attempts and follow your organization's IT security policies and guidelines.

Compressed URLs convert a long URL into a short URL for convenience but may be used to mask malicious intent. Investigate the destination by using the preview feature to see where the link actually leads before clicking.

Do not give out personal or organizational information. Document the interaction -- verify the caller's identity, write down their phone number, and take detailed notes. Contact your security POC or help desk.

Social engineers use telephone surveys, email messages, websites, text messages, automated phone calls, and in-person interviews to trick targets into revealing information.

Do not participate in telephone surveys. Do not give out personal, computer, or network information. Do not follow instructions from unverified personnel. Document the interaction, verify their identity, and contact your security POC or help desk.

Report the contact to her security POC. If you work with classified or sensitive material, you must inform your security POC of all non-professional or non-routine contacts with foreign nationals.

Adversaries disseminate fake news and propaganda, share fake audio/video (deepfakes), and gather personal information shared on social media to devise social engineering attacks against military and national security targets.

Let calls from unknown numbers go to voicemail -- legitimate callers will leave a message. Never provide personal or organizational information to unverified callers. Document the interaction and report it to your security POC.

Delete the message. This is a smishing attack. Do not reply or click the link in the message.

Confidential (damage to national security), Secret (serious damage to national security), and Top Secret (exceptionally grave damage to national security).

The individual must have: (1) an appropriate security clearance, (2) a signed and approved non-disclosure agreement, and (3) a need-to-know for the specific information.

Store classified data appropriately in a GSA-approved vault or security container when not in use. Do not assume open storage in a secure facility is authorized.

Spillage occurs when information is 'spilled' from a higher classification or protection level to a lower classification or protection level. Spillage can be either inadvertent or intentional.

B. Label all files, removable media, and subject headers with appropriate classification markings. Also be aware of classification markings and all handling caveats.

Immediately notify your security POC. Do not delete the suspected files. Do not forward, read further, or manipulate the file. Secure the area.

Spillage, because classified data was moved to a lower classification level system without authorization.

Do not download the information (it may create a new spillage). Note any identifying information and the website's URL. Report the situation to your security POC. Refer any inquiries to your public affairs office. Remember it is still classified even if compromised.

It can unnecessarily consume mission-essential bandwidth, may illegally shield information from FOIA disclosure, and creates a danger of spillage when attempting to remove the information to unclassified media or hard copy.

CUI is Government information that must be handled using safeguarding or dissemination controls. It includes Controlled Technical Information (CTI), PII, PHI, financial information, personal/payroll information, and operational information. CUI is NOT classified information.

Controlled Unclassified Information (CUI), because it contains Personally Identifiable Information (PII) -- specifically names combined with passport numbers.

PII is information that can be used to distinguish or trace an individual's identity, either alone or when combined with other linked information. It includes Social Security Number, date and place of birth, mother's maiden name, biometric records, Protected Health Information, and passport number.

The most commonly reported cause of PII breaches is failure to encrypt email messages containing PII.

PHI is a subset of PII requiring additional protection. It is health information that identifies the individual, created or received by a healthcare provider, health plan, employer, or business associate, relating to physical/mental health, healthcare provision, or payment for healthcare.

Use Government-furnished or Government-approved equipment with extra protection and encryption, especially on mobile devices.

No. Never use personal email accounts for transmitting PII. PII may only be emailed between Government email accounts and must be encrypted and digitally signed when possible.

Yes. It contains several items of PII including mother's maiden name, home address, and birthday. Avoid posting PII on social media.

In locked containers, desks, or cabinets. If security is present, locked or unlocked containers are acceptable.

DoD Instruction 5200.48, 'Controlled Unclassified Information (CUI),' along with Defense Federal Acquisition Regulation Supplement (DFARS) for CUI and Controlled Technical Information (CTI) handling requirements.

Ensure the recipient is at the receiving end, use the correct cover sheet, and contact the recipient to confirm receipt.

Use your own security badge/key code, don't allow others to piggyback into secure areas, challenge people without proper badges, report suspicious activity, and protect access rosters from public view.

Remove your security badge after leaving your controlled area or office building to avoid being targeted by adversaries.

Piggybacking is when someone follows an authorized person through a secure entrance without badging in themselves. Do not allow others access or to piggyback into secure areas. Everyone must badge in individually.

Challenge people without proper badges. Report suspicious activity to your security POC. Ensure uncleared persons are escorted by a cleared person familiar with facility security procedures.

Remove your Common Access Card (CAC) from your workstation to lock it before walking away.

Badges must be visible and displayed above the waist at all times while in the facility. Badges must be removed when leaving the facility.

Introduction of malicious code, compromise of systems' confidentiality, availability, and/or integrity, and spillage of classified information. Potential consequences include shutdown of systems, compromise of information, loss of mission, and loss of life.

Their data storage and ability to connect to systems can lead to unintended transfers of information, such as introduction of malicious code or spillage of classified data.

No. Do not use any personally owned or non-organizational removable media on your organization's systems. Only use removable media approved by your organization.

Media shall display a label inclusive of maximum classification, date of creation, point of contact (POC), and Configuration Management (CM) Control Number.

Label all removable media regardless of classification or environment, and avoid inserting removable media with unknown content into your computer.

Do not plug it into any computer. Turn it in to your security office. Unattended removable media may contain malware or could be part of a baiting social engineering attack.

All personal portable electronic devices (PEDs) are forbidden in a SCIF -- including cell phones, smart watches, fitness trackers, tablets, and any device with Wi-Fi, Bluetooth, cellular, image capturing, video, or audio recording capabilities.

Personally-owned peripherals are permitted with GFE: monitors via VGA, DVI, HDMI, or DisplayPort (with nothing else connected to the monitor); wired keyboards, mice, and trackballs via USB; USB hubs; and headphones/headsets, with or without microphones, through a USB port. Not permitted: monitors connected via USB, peripherals from a prohibited source, Bluetooth or other wireless external peripherals, and installing drivers to support personally-owned peripherals. (The stricter government-issued-only rule applies inside DoD classified spaces, not to GFE generally.)

Two-factor authentication combines two of these three types: something you possess (such as a CAC), something you know (such as a PIN), and something you are (such as a fingerprint or biometrics).

C. Password and fingerprint -- these combine something you know (password) with something you are (biometrics). The others all use the same factor type (something you know).

The CAC/PIV implements DoD Public Key Infrastructure (PKI) and contains certificates for identification, encryption, and digital signature.

Maintain possession at all times. Remove it whenever leaving your workstation. Never surrender it for building access. Store in a shielded sleeve to prevent cloning. Do not write down or share your PIN. Report it immediately if lost.

Combine letters, numbers, and special characters. Do not use personal information, common phrases, or dictionary words in any language. Do not write it down -- memorize it. Change passwords at least every 3 months. Avoid using the same password across systems.

SIPRNet only. Never use a token approved for NIPRNet on a higher classification system, and never use a SIPRNet token on the NIPRNet. Only use a token within its designated classification level.

Only leave it in a system while actively using it for a PKI-required task. Never use on publicly accessible computers such as kiosks, internet cafes, or public libraries.

Information sent over public Wi-Fi connections may be exposed to theft, and the device may be exposed to malware. Fake Wi-Fi access points may be used for deception. Use public or free Wi-Fi only with the Government VPN.

Use caution -- if you are directed to a login page before you can connect by VPN, the risk of malware loading or data compromise is substantially increased.

Assume that any electronic transmission (voice or data) may be monitored. Mobile phones carried overseas are often compromised upon exiting the plane. Devices not in your custody or in secure U.S. Government facility storage should be assumed compromised.

Implement, at a minimum, Wi-Fi Protected Access 2 (WPA2) Personal encryption on your home wireless network.

No. DoD employees are prohibited from using a DoD CAC in card-reader-enabled public devices such as those found in public libraries and internet cafes.

Be careful of information visible on the screen (consider screen protection), maintain possession of the device at all times, use password or two-factor authentication, ensure all sensitive data is encrypted, and never discuss sensitive information in public.

Malicious code can corrupt files, encrypt or erase your hard drive, and allow hackers access. It includes viruses, Trojan horses, worms, macros, and scripts. It can spread via email attachments, downloading files, and visiting infected websites.

C. Look for digital signatures if your organization uses them. Digitally signed emails are more secure. Also view email in plain text, scan all attachments, and don't access links or graphics in emails.

Sudden flashing pop-ups warning of virus infection, sudden appearance of new apps or programs, strange pop-ups during startup/operation/shutdown, device slowing down, new browser extensions or tabs, and loss of control of mouse or keyboard.

Scan all external files before uploading. For personal devices, research apps before downloading. For Government devices, use only approved and authorized applications. Only allow mobile code from your organization's trusted sites to run.

View email in plain text (not Preview Pane), look for digital signatures, scan all attachments, delete emails from unknown senders if authenticity cannot be confirmed, and do not click links, buttons, or graphics in emails or email-generated pop-ups.

NFC is wireless technology enabling devices to communicate when placed next to each other (e.g., contactless payments). Risks include eavesdropping (adversary intercepts signal), data manipulation/corruption, and viruses targeting stored financial or mission information.

Set up a passcode to unlock it. Additionally, enable automatic screen locking, encrypt all sensitive data, and use two-factor authentication if possible.

Immediately report the loss to your security POC.

Many mobile devices and apps can track your location without your knowledge or consent. They can geolocate you, display your location, record location history, and activate tracking by default.

Ensure that it is an approved and authorized application. Only use applications authorized by your organization on Government devices.

Mobile devices may be hacked or infected with malware and can be used to track, record, photograph, or videotape the environment. Powering off or airplane mode is not sufficient to mitigate these risks and the threat to classified information.

An insider threat uses authorized access, wittingly or unwittingly, to harm national security through unauthorized disclosure, data modification, espionage, terrorism, or kinetic actions resulting in loss or degradation of resources or capabilities.

B. Untreated alcohol use disorder is a recognized insider threat indicator. Other indicators include financial difficulties, unexplained affluence, unreported foreign contact, hostile behavior, and inappropriate interest in classified information.

By exploiting their trusted status and authorized access to government information systems and resources.

Intervening early to help individuals with issues -- such as referring them to counseling or assistance to alleviate personal stressors, requiring security training, and developing protocols to secure information, resources, and personnel.

Three or more: alcohol misuse, mishandling of classified information, and bringing electronic devices into prohibited areas.

Attempting to access information without need-to-know, unauthorized removal of sensitive information, unusual requests for sensitive data, electronic devices in prohibited areas, sudden high-value purchases, unexplained overseas trips, substance problems, personality changes, and hostile statements.

80% demonstrated behaviors of security concern, 25% experienced a life crisis, and 70% volunteered their services (were not recruited).

Call your security point of contact (POC). Do not elaborate on sensitive/classified details until secure two-way communications (verbal or transmitted) can be achieved.

SCI is a program that segregates classified information into distinct compartments for added protection and dissemination control. It overlays Top Secret, Secret, and Confidential information. Access requires Top Secret clearance and indoctrination into the specific SCI program.

B. SCI may be printed using an authorized printer when retrieved promptly. Use appropriate classification cover sheets and ensure classified material is not mixed with unclassified material being removed from the SCIF.

The Director of National Intelligence has overarching authority concerning SCI policy.

An SCG provides precise, comprehensive guidance on classifying specific program, system, operation, or weapon system information -- including classification levels, reasons, and duration. It is approved by the Original Classification Authority (OCA) and is an authoritative source for derivative classification.

Immediately notify her security point of contact (POC). Do not delete, forward, read further, or manipulate the file.

Immediately notify your security POC or help desk. Do not delete suspected files. Do not forward or manipulate evidence. Secure the area. Document what happened and when.

Notify your security POC, analyze the media for viruses or malicious code, analyze other workstations in the SCIF, and if unintentional, the person may attend a refresher training course in security awareness.

Note any identifying information and the website's URL, then report it to your security POC. Do not download the information. Remember that leaked classified information is still classified even if it has been compromised.

Report cultivation contacts by foreign nationals to your security POC. Inform your security POC of all non-professional or non-routine contacts with foreign nationals.

CPCON levels established by USCYBERCOM set protection priorities during significant cyberspace events. CPCON 1 = Very High risk (Critical Functions only), CPCON 2 = High, CPCON 3 = Medium, CPCON 4 = Low, CPCON 5 = Very Low (All Functions).

Unclassified marks information that does not have potential to damage national security. It must be cleared before public release, may require CUI controls, and if aggregated, may be elevated to a higher sensitivity level or even become classified.

No. CUI may only be marked as CUI if it belongs to a category established in the DoD CUI Registry.

Use encryption when emailing PII or other types of CUI, as required by the DoD. The DoD requires use of two-factor authentication for access to systems processing CUI.

Oliver's apps and devices collect and share information about him. Online data aggregators collect and catalogue your information from apps, smart devices, and public records, which can be used to target you with tailored advertisements and scams.

Ask how information will be used before giving it out, pay attention to financial statements, avoid common names/dates for passwords, never share passwords, shred personal documents, refrain from carrying SSN card, and order your credit report annually.

A cookie is a text file stored on your hard drive by a web server. Cookies may pose a security threat when they save unencrypted personal information and may track your web activities. Only accept cookies from reputable, trusted websites using encrypted (HTTPS) links.

Avoid posting PII (SSN, date/place of birth, mother's maiden name, home address), GPS/location information, and any content that could reveal operational details. Do not connect with people you don't know, even if you share mutual connections.

No. TikTok is banned on all Government devices.

Make sure there are no identifiable landmarks or items visible. When establishing personal social networking accounts, use only personal contact information, never your Government contact information.

BYOAD allows use of personal devices per organization policy. You must read and sign a User Agreement, and the approved device will be provisioned to employ necessary security measures. Use depends on your organization's specific policies.

Do not: view/download pornography, gamble online, conduct private business, load unauthorized software (including DropBox or P2P), illegally download copyrighted material, make unauthorized configuration changes. Use GFE for official purposes only.

P2P software can compromise network configurations, spread viruses and spyware, and allow unauthorized access to data.

Yes. All DoD-owned devices are subject to monitoring. When you use these devices, you authorize the monitoring of your activity on them.

Do not use email to sell anything. Do not send chain letters, offensive letters, mass emails, jokes, or unnecessary pictures. Use digital signatures when sending attachments/hyperlinks. Do not use personal accounts for official DoD communication.

Ensure monitors do not provide unobstructed views of classified information. Monitors facing windows should be turned or window blinds should be closed.

All wireless headsets, microphones, and webcams are prohibited. As a general rule, there should be no Wi-Fi, Bluetooth, cellular, image capturing, video recording, or audio recording capabilities or wearable devices in a SCIF.

Only personally-owned wired headsets without a microphone are permitted. All other personally-owned external peripherals are prohibited in DoD classified spaces.

Ensure any embedded cameras, microphones, and Wi-Fi are physically disabled. Use only authorized external peripherals.

Never. Do not discuss classified information over smartphones, and do not view classified information via a device when not in a cleared space.

Research the source's credibility, read beyond the headline, check against known facts and other sources, consider if it's intended as a joke, and check your personal biases -- actively seek opposing or disconfirming content.

Online misconduct is inconsistent with DoD values. Do NOT use electronic communications for harassment, bullying, hazing, stalking, discrimination, or retaliation. Individuals who participate may face criminal, disciplinary, or administrative action. No one is truly anonymous online.

You can delete the post, but be aware that once content is posted, it may have already been shared, cached, or archived. Sites may own content you post, and it may not be fully removable.

All internet-connected devices in a telework environment pose risks, including smart speakers, fitness trackers, smart TVs, home security cameras, and personal digital assistants. These devices collect data and may be exploited.

Create separate user accounts for each user and have each user create their own password.

Encrypt data appropriately and in accordance with its classification or sensitivity level. Store according to the appropriate security classification in GSA-approved storage containers.

Do not download data from classified networks onto removable storage media. Follow your organization's strict policies on transferring data to/from outside agency and non-Government networks.

Destroy classified removable media in accordance with its classification level, following your organization's policy for sanitizing, purging, discarding, and destroying removable media.

Digital signatures verify the sender's identity and the integrity of the message. The DoD requires use of a digital signature when sending attachments or hyperlinks. Digitally signed emails are more secure and help protect against phishing.

Yes. Only use removable media when operationally necessary, Government-owned, and approved in accordance with policy

Markings that identify the compartment with which it is affiliated

Wear it visibly and above the waist

Look for an icon to indicate encryption is functioning

Set up a passcode to unlock

Intervening early to help individuals with issues

Turn on spyware protection

An individual's medical record maintained by a healthcare provider

All of these.

Forward it

Exploiting their trusted status and authorized access to government resources

SIPRNet.

Their connectivity can be exploited as an attack vector to any other device on the same network.

No. These email's generate unnecessary e-mail traffic.

Their data storage and ability to connect to systems can lead to unintended transfers of information, such as introduction of malicious code or spillage.

Use an encrypted device that requires a passcode or biometrics to unlock

Ensure that it is an approved and authorized application.

Immediately notify her security POC

A wired headset without a microphone

3+

Yes. He should be vigilant for "shoulder surfing," where others may be able to view the information on his screen.

Report the contact to her security POC.

It does not have the potential to damage national security.

Oliver's apps and devices collect and share information about him.

Each user should have their own account.

SCI may be printed using an authorized printer when retrieved promptly.

Spear phishing

Andrea verifies need-to-know and security eligibility before sharing classified information.

Label all files with appropriate classification markings

True

Report the e-mail to your security POC or help desk

untreated alcohol use disorder

Report potential terrorism behaviors