Question 1

What is unauthorized disclosure (UD)?

Accepted Answer

UD is the communication or physical transfer of classified national security information (CNSI) or controlled unclassified information (CUI) to an unauthorized recipient. [Source: CDSE IF130.16 Unauthorized Disclosure of Classified Information and CUI Student Guide (January 2025), Lesson 2, p. 2-2 — "UD is the communication or physical transfer of CNSI or CUI to an unauthorized recipient. An unauthorized recipient is anyone who does not meet the criteria to access the information, whether that is access requirements for CNSI or the requ" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 2

Who is an "unauthorized recipient"?

Accepted Answer

Anyone who does not meet the criteria to access the information — either the access requirements for CNSI, or the required lawful, government purpose to access CUI.

Question 3

What is an insider?

Accepted Answer

Someone who has, or had been, granted eligibility for access to CNSI or eligibility to hold a sensitive position. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-2 — "An insider is someone who has or had been granted eligibility for access to CNSI or eligibility to hold a sensitive position." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 4

What is a remote actor?

Accepted Answer

An individual outside of the organization who has gained unauthorized access to CNSI or CUI. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-2 — "UD can also be committed by a remote actor, which is an individual outside of the organization who has gained unauthorized access to CNSI or CUI." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 5

What three things must an individual have for authorized access to CNSI?

Accepted Answer

A signed Standard Form (SF) 312 Classified Information Non-Disclosure Agreement, eligibility at the appropriate level, and a confirmed need-to-know. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-2 — "For authorized access to CNSI, an individual must have: A signed Standard Form (SF) 312, Classified Information Non-Disclosure Agreement (NDA); Eligibility at the appropriate level; A confirmed need-to-know" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 6

What is the standard for authorized access to CUI?

Accepted Answer

A lawful, government purpose. Authorized holders of CUI are responsible for determining who has a lawful, government purpose. Unlike classified information, an individual generally does not need to demonstrate a need-to-know unless required by a specific law, regulation, or government-wide policy. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-2 — "For authorized access to CUI, an individual must have a lawful, government purpose to access the information. Authorized holders of CUI are responsible for determining who has a lawful, government purpose. Unlike classified information, an " https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 7

What are the three levels of intent that can cause unauthorized disclosure?

Accepted Answer

Willful, negligent, and inadvertent.

Question 8

When is a UD incident considered willful?

Accepted Answer

When the person purposefully disregards DOD security or information safeguarding policies or requirements — for example, intentionally bypassing a known security control or intentionally disclosing classified information in the public domain. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, pp. 2-2 to 2-3 — "An incident is considered willful if the person purposefully disregards DOD security or information safeguarding policies or requirements. An example of willful UD is an individual intentionally bypassing a known security control, such as a" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 9

When is a UD incident considered negligent?

Accepted Answer

When the person acted unreasonably, causing UD — for example, a careless act or reckless disregard for proper procedures, such as carelessly sharing classified information via an Unclassified network leading to spillage.

Question 10

When is a UD incident considered inadvertent?

Accepted Answer

When the person did not know, and had no reasonable basis to know, that the security violation or unauthorized disclosure was occurring — for example, reasonably relying on security classification markings in an authorized source document that was later determined to be improperly marked. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-3 — "An incident is inadvertent if the person did not know, and had no reasonable basis to know, that the security violation or unauthorized disclosure was occurring. An example of inadvertent UD would be an individual who reasonably relied on s" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 11

Regardless of intent, what does UD result in?

Accepted Answer

The loss or degradation of resources or capabilities; it undermines DOD's mission and security, damages public trust, and compromises sources and methods.

Question 12

What are the four types of unauthorized disclosure?

Accepted Answer

Public domain, spillage, espionage, and improper safeguarding of information. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-5 — "As we just mentioned, there are several types of UD. These include public domain, spillage, espionage, and improper safeguarding of information." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 13

What is a UD in the public domain?

Accepted Answer

It occurs when CNSI or CUI is released either intentionally or inadvertently to the public — through podcasts, print or web-based articles, books, journals, speeches, television broadcasts, blog postings, social media posts, instant messages, VOIP social platforms such as Discord, Zoom, or Skype, and protected or encrypted messaging apps such as WhatsApp or Signal.

Question 14

What is spillage?

Accepted Answer

A data spill, or spillage, is a willful, negligent, or inadvertent disclosure of CNSI or CUI transferred onto an information system not accredited at the appropriate security level to store, process, or transmit the information. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-5 — "A data spill, or spillage, is a willful, negligent, or inadvertent disclosure of CNSI or CUI transferred onto an information system not accredited at the appropriate security level to store, process, or transmit the information." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 15

When does classified spillage occur?

Accepted Answer

When classified data is introduced onto an Unclassified information system, an information system with a lower level of classification, or a system not accredited to process data of that restrictive category.

Question 16

What is espionage?

Accepted Answer

Espionage involves activities designed to obtain, deliver, communicate, or transmit CNSI or CUI intended to aid a foreign power. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-6 — "Espionage involves activities designed to obtain, deliver, communicate, or transmit CNSI or CUI intended to aid a foreign power." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 17

What is improper safeguarding of information?

Accepted Answer

It occurs when inappropriate measures, behaviors, or controls are used to protect CNSI or CUI.

Question 18

Lily has access to Top Secret information. During an interview about her DOD role she discloses Top Secret program information, and the journalist publishes it. What type of UD is this?

Accepted Answer

Public domain.

Question 19

Erin, a defense intelligence analyst, is persistently questioned about drone capabilities by an allied foreign analyst who has no need-to-know and works a different problem set. What type of UD is this?

Accepted Answer

Espionage.

Question 20

Marshall leaves Secret paper documents on a restroom counter, where an uncleared custodian later finds them. What type of UD is this?

Accepted Answer

Improper safeguarding.

Question 21

Which special circumstances of UD require unique handling or additional reporting?

Accepted Answer

UD involving Foreign Government Information (FGI) or NATO information requires further reporting; UD involving criminal activity requires coordination with the Deputy Chief Information Officer (DCIO) during the investigation; and UD involving special information such as SCI, Special Access Program (SAP) information, and Critical Program Information (CPI) has additional reporting requirements. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-6 — "For UD incidents related to Foreign Government Information (FGI) or North Atlantic Treaty Organization (NATO) information, further reporting is required. Any UDs involving criminal activity require coordination with the Deputy Chief Informa" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 22

Is it okay to read, discuss, and freely share CNSI or CUI that has been put in the public domain?

Accepted Answer

No — this is a misconception. Information that has been disclosed in the public domain remains protected and must not be freely read, discussed, or shared.

Question 23

Do you receive protection through "journalist privilege" if you disclose CNSI or CUI to a journalist?

Accepted Answer

No — this is a misconception. There is no "journalist privilege" protection for disclosing CNSI or CUI.

Question 24

Can manuscripts, books, and similar works be submitted to an editor or publisher before undergoing a security review?

Accepted Answer

No — this is a misconception. They must undergo the required security review first.

Question 25

Once you leave your organization, does the SF 312 non-disclosure agreement stop applying?

Accepted Answer

No — this is a misconception. The SF 312 NDA continues to apply after you leave the organization.

Question 26

Is it okay to share Unclassified DOD information on a "secure" messaging app?

Accepted Answer

No — this is a misconception. Sharing nonpublic DOD Unclassified information on a "secure" messaging app is not authorized.

Question 27

What must an individual do for a disclosure to qualify as whistleblowing?

Accepted Answer

Provide the right information to the right people while still protecting national security assets from unauthorized disclosure, by following the required procedures.

Question 28

Whistleblowing occurs when employees report information they reasonably believe provides evidence of what?

Accepted Answer

A violation of any law, rule, or regulation; gross mismanagement; a gross waste of funds; abuse of authority; or a substantial danger to public health and safety. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-10 — "It occurs when employees report information they reasonably believe provides evidence of: A violation of any law, rule, or regulation; Gross mismanagement; A gross waste of funds; Abuse of authority; A substantial danger to public health an" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 29

An insider believes the government poses a danger to the public and releases national security information on a social networking site to make the public aware. Is this whistleblowing or unauthorized disclosure?

Accepted Answer

Unauthorized disclosure. Posting protected national security information in the public domain is unauthorized disclosure, not whistleblowing. [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, p. A-2 — "Is this whistleblowing or unauthorized disclosure? ... Unauthorized Disclosure (correct response). Feedback: Posting protected national security information in the public domain is unauthorized disclosure." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 30

What did the Whistleblower Protection Enhancement Act (WPEA) of 2012 do?

Accepted Answer

It broadened the scope and strengthened the rights and protections of federal employees who blow the whistle on violations involving fraud, waste, and abuse. When reporting violations involving classified programs or information, employees must still follow established guidance for protecting classified information.

Question 31

Which issuances outline whistleblower guidance?

Accepted Answer

PPD 19 (protects employees in the intelligence community or with access to classified information); Title 5 U.S.C. Section 2302, "Prohibited Personnel Practices"; Title 10 U.S.C. Section 1034, "Military Whistleblower Protection Statute"; and Title 10 U.S.C. Section 2890, covering tenants of privatized military housing units.

Question 32

A coworker posts on private social media about an upcoming draft DOD policy they were asked to review. The information is not classified — can this disclosure cause damage?

Accepted Answer

Yes. Even disclosing nonpublic DOD Unclassified information and CUI can cause damage, and nonpublic Unclassified information and CUI can be aggregated to reveal classified information, damaging national security.

Question 33

Which two Executive Orders apply to CNSI and CUI?

Accepted Answer

E.O. 13526, Classified National Security Information, and E.O. 13556, Controlled Unclassified Information. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-3 — "E.O.s that apply to CNSI or CUI are: E.O. 13526, Classified National Security Information; E.O. 13556, Controlled Unclassified Information" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 34

Which Federal regulations apply to CNSI or CUI?

Accepted Answer

32 CFR Part 117 (NISPOM), 32 CFR Part 2002 (Controlled Unclassified Information), 32 CFR Parts 2001 and 2003 (Classified National Security Information), and 32 CFR Part 2004 (National Industrial Security Program).

Question 35

Which DOD Manual governs the DOD Information Security Program, and what do its three volumes cover?

Accepted Answer

DODM 5200.01 — Volume 1: Overview, Classification, and Declassification; Volume 2: Marking of Information; Volume 3: Protection of Classified Information.

Question 36

Which Intelligence Community Directive addresses unauthorized disclosure of classified national security information?

Accepted Answer

ICD 701, Unauthorized Disclosure of Classified National Security Information. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 2, p. 2-4 — "In addition, the Intelligence Community (IC) issued Intelligence Community Directive (ICD) 701, Unauthorized Disclosure of Classified National Security Information." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 37

Andrew holds eligibility at the appropriate level and has signed an SF 312. Should you give him access to the Secret CNSI you control?

Accepted Answer

No — he must also have a need-to-know to access classified information. Eligibility at the appropriate level and a signed SF 312 alone are not sufficient. [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, p. A-3 — "No, he must also have a "need-to-know" to access classified information. (correct response) Feedback: It is not simply eligibility at the appropriate level and signed SF 312 that allows an individual to access classified information. That i" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 38

You are hand-carrying paper copies of Top Secret information from your desk to a briefing room. How do you protect it in transit?

Accepted Answer

Use an SF 703 cover sheet. It is required to protect printed copies of Top Secret information with an SF 703 cover sheet. [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, p. A-4 — "Use an SF 703 cover sheet (correct response) ... Feedback: It is required to protect printed copies of Top Secret information by using an SF 703 cover sheet." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 39

How should you transmit Secret information to an authorized coworker located across the country?

Accepted Answer

Send it on a properly accredited system via secure, properly marked email, after ensuring the recipient has access to a system accredited at the Secret level.

Question 40

Your work location has no approved open storage area. How do you store Secret information at the end of the day?

Accepted Answer

Place it in a GSA-approved container or vault when not in use. [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, pp. A-4 to A-5 — "Place it in a GSA-approved container (correct response) ... Feedback: In order to safely store Secret information in an area that is not approved for open storage you must place it in a GSA-approved container or vault when not in use." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 41

Sandra shared a document containing Top Secret information with a colleague who lacks Top Secret eligibility. What could have prevented this UD?

Accepted Answer

Ensuring all proper markings were present on the document — a TOP SECRET marking in the header alerts the holder to the presence of CNSI.

Question 42

Jim creates a new document that paraphrases Secret information from an authorized source document. What type of classification has occurred?

Accepted Answer

Derivative classification — incorporating, paraphrasing, restating, or generating in a new form information that is already classified, and marking the newly developed material consistent with the classification markings that apply to the source information.

Question 43

As an HR professional, you are asked by a health plan provider for a roster of new personnel. Is the provider an authorized recipient of that CUI?

Accepted Answer

Yes — this is considered a lawful, government purpose, which is the standard for access to CUI.

Question 44

A coworker's new CUI document is marked UNCLASSIFIED//FOUO. Is it properly marked?

Accepted Answer

No. FOUO is a legacy marking. The document should be assessed against the DOD CUI Registry to see whether it meets the criteria for a CUI category and then marked appropriately. [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, p. A-7 — "No (correct response) Feedback: This document is marked FOUO, which is a legacy marking. This document should be assessed to see if it meets criteria for CUI and marked appropriately. Judy should review the DOD CUI Registry to determine if " https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 45

What does the Defense Office of Prepublication and Security Review (DOPSR) review submitted material for?

Accepted Answer

To ensure compliance with established national and DOD policies, and to ensure there is no information that may lead to unauthorized disclosure of classified information or compromise national or operational security. [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, pp. A-8 to A-9 — "Feedback: DOPSR reviews seek to ensure compliance with established national and DOD policies and that there is no information that may lead to unauthorized disclosure of classified information or compromise national or operational security." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 46

How does the Public Affairs Office (PAO) determine whether material can be released to the public?

Accepted Answer

PAO reviews ensure information that could discredit the military or federal government is avoided, that political views are not portrayed, and that offensive or controversial views are not portrayed. [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, p. A-9 — "Feedback: PAO reviews help ensure information is not included that could discredit the military or federal government. They also ensure political views or controversial views are not portrayed." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 47

Is it safe to post an image of the DOD installation where you are currently working?

Accepted Answer

No — delete it. Posting information related to the DOD that has not been cleared for public release on social media is prohibited, including specific information about a DOD installation where you are working.

Question 48

You just learned details about an upcoming deployment and want to tell friends and family on social media. Is this safe to post?

Accepted Answer

No — delete it. Posting details about an upcoming deployment on social media is prohibited in accordance with DODI 5400.17. [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, p. A-10 — "Delete (correct response) Feedback: Posting details about an upcoming deployment on social media is prohibited in accordance with DODI 5400.17." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 49

Is it safe to post pictures from a vacation you have already returned from?

Accepted Answer

Yes. While it is a best practice to wait until after a vacation to share details about it, it is safe to post about it after you return.

Question 50

A journalist emails you asking for comment about the range of a new missile. What should you do?

Accepted Answer

Report it to your Security Manager. Do not make any statement or comment that confirms or denies the accuracy of the information; follow your Component guidance. [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, p. A-10 — "Report to Security Manager (correct response) Feedback: When approached for comment from a journalist, do not make a statement or comment that confirms or denies the accuracy of the information; you should follow your Component guidance and" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 51

A coworker approaches you with Top Secret documents he found in the bathroom. What should you do next?

Accepted Answer

Safeguard it in the appropriate manner and report it to your Security Manager or Facility Security Officer (FSO). [Source: CDSE IF130.16 Student Guide (January 2025), Appendix A: Answer Key, p. A-11 — "Safeguard it and report it to your Security Manager (correct response) Feedback: When you recognize that CNSI is improperly safeguarded, you must ensure you safeguard it in the appropriate manner and notify your Security Manager or Facility" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 52

What are the eight steps of the UD reporting process, in order?

Accepted Answer

Safeguard, Report, Inquire, Investigate, Evaluate, Elevate, Correct, and Sanction. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 6, p. 6-6 — "You have now learned about the eight reporting steps when you encounter UD: Safeguard; Report; Inquire; Investigate; Evaluate; Elevate; Correct; Sanction" https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 53

Which of the eight reporting steps apply to everyone?

Accepted Answer

The first two — Safeguard and Report. They are the responsibility of anyone who believes they have witnessed, discovered, or have knowledge of an unauthorized disclosure. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 6, p. 6-6 — "The first two steps of the process apply to everyone. They are essential and the responsibility of anyone who believes they have witnessed, discovered, or have knowledge of an unauthorized disclosure." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 54

Who do you report a suspected UD to, and what happens next?

Accepted Answer

Report it to your Security Manager or Facility Security Officer (FSO) immediately after safeguarding. The FSO or Security Manager will report it to authorities at the next level.

Question 55

What happens during step five, Evaluate?

Accepted Answer

The results of the inquiry and, if necessary, the investigation are evaluated to determine whether the incident is a security infraction or a security violation, and to evaluate the severity of the UD where loss or compromise has occurred.

Question 56

When is step four, Investigate, conducted?

Accepted Answer

When an inquiry does not yield answers to all of the questions required. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 6, p. 6-4 — "Step four in the reporting process, Investigate, is conducted when an inquiry does not yield answers to all of the questions required." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 57

In step six, Elevate, who must be notified at minimum when classified information is lost or compromised?

Accepted Answer

The Original Classification Authority (OCA), so a damage assessment can be initiated. For spillage you would also notify the Information System Security Manager (ISSM), and in some situations results may need to be elevated to the UD Program Management Office (PMO) and the appropriate Military Department Counterintelligence Organizations (MDCOs).

Question 58

What is the purpose of step seven, Correct?

Accepted Answer

Corrective actions are implemented that focus on preventing future incidents and eliminating any conditions that might have contributed to the event. The cognizant DOD Component determines and implements the appropriate corrective actions based on the extent or severity of the incident.

Question 59

What administrative sanctions may be imposed for unauthorized disclosure?

Accepted Answer

Administrative sanctions outlined in DODM 5200.01, Volume 1 include a warning, a reprimand, and suspension without pay. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 6, p. 6-5 — "These include instituting any administrative actions as outlined in DODM 5200.01, Volume 1. Administrative sanctions include a warning, reprimand, and suspension without pay." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 60

When must criminal sanctions be undertaken for unauthorized disclosure?

Accepted Answer

Criminal sanctions must be undertaken when applicable, in accordance with the Uniform Code of Military Justice or sections 801 to 940 of Title 10, U.S.C. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 6, pp. 6-5 to 6-6 — "Criminal sanctions must be undertaken when applicable, in accordance with the Uniform Code of Military Justice or sections 801 to 940 of Title 10, U.S.C." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 61

If a UD involved CNSI, what must a Security Manager or FSO do?

Accepted Answer

Report it to the Original Classification Authority (OCA) to conduct a damage assessment. This may vary depending on whether you are an FSO or a DOD Security Manager, and UD of certain types of classified information requires unique handling or additional reporting per DODM 5200.01 Volume 3, enclosure 6. [Source: CDSE IF130.16 Student Guide (January 2025), Lesson 6, p. 6-7 — "If the unauthorized disclosure involved CNSI, you must report it to the Original Classification Authority (OCA) to conduct a damage assessment; this may vary depending on if you are an FSO or DOD Security Manager." https://www.cdse.edu/Portals/124/Documents/student-guides/IF130-guide.pdf]

Question 62

Which type of CUI carries additional reporting requirements when disclosed?

Accepted Answer

Personally identifiable information (PII), which is a type of CUI, has additional requirements.

unauthorized disclosure

Know questions we're missing?

Study these as flashcards