Download SAPPC (SECURITY ASSET PROTECTION PROFFESSIONAL CERTIFICATION) CERTIFICATION EXAM and more Exams Nursing in PDF only on Docsity!
SAPPC (SECURITY ASSET PROTECTION
PROFFESSIONAL CERTIFICATION)
CERTIFICATION EXAM | NEWEST
ACTUAL ACCURATE EXAM COMPLETE
QUESTIONS AND DETAILED VERIFIED
ANSWERS GRADED A+ | 100% VERIFIED
| 2024 UPDATE!!
What are at least three principle incidents/events required to be reported to DoD counterintelligence (CI) organizations? - โโโ Correct Answer > 1. Espionage
- Sabotage
- Terrorism
- Cyber
- Insider Threat What is the five-step OPSEC process? - โโโ Correct Answer > 1. Identify critical information 2. Analyze threats 3. Analyze vulnerabilities
- Assess risks 5. Apply OPSEC countermeasures
What are the 5 steps to RMF? - โโโ Correct Answer > 1. Identify the critical assets that require protection
- Identify undesirable events and expected impacts
- Value and prioritize assets based on the consequence of loss
- Assess the risks and
- Determine countermeasures Briefly describe the purpose of the DD Form 254 - โโโ Correct Answer > Convey security requirements and classification guidance, and provide handling procedures for classified materials received and/or generated under a classified contract List the three categories of Special Access Programs - โโโ Correct Answer > 1. Acquisition
- Intelligence
- Operations and support What the 5 categories of assets? - โโโ Correct Answer > 1. People
- Information
- Equipment
- Facilities and
- Activities and Operations
Identify the three core components of the Risk Assessment process - โโโ Correct Answer > 1. Asset criticality
- Threat Assessment
- Vulnerability Assessment List at least three (3) types of security briefings that help manage risks to DoD assets - โโโ Correct Answer > 1. Initial orientation
- Annual refresher
- Threat awareness
- Foreign Travel
- Derivative classification
- Debriefings
- Termination briefing
- Counterintelligence briefing Who determines or identifies when physical security surveys and inspections are required? - โโโ Correct Answer > 1. DoD Component Commanders.
- Program Managers
- Security Managers
- Physical Security Specialists/Officers
List three transmission and transportation requirements that help manage risks to DoD assets - โโโ Correct Answer > 1. Safeguarding
- Briefings
- Documentation
- Personal control
- Pre-coordination
- Preparing for transportation (packaging)
- Utilizing proper methods of transmission/transportation based on classification level
- Intended recipients have proper clearance/eligibility and need to know (or access)
- Capability to properly store classified information List three types of safeguarding procedures for classified information - โโโ Correct Answer > 1. Proper storage
- Proper handling
- Approved disposition
- Proper transmission/transportation methods
- Receipt use, when required
- Dissemination
- Physical security measures
- Technical, administrative, and personnel control measures (deleted access control as these measures constitute access control)
Role: implement and oversee an Industrial Security Program to safeguard classified information with cleared industry under the respective CSA's jurisdiction. What are the five steps in the DoD risk management model - โโโ Correct Answer > 1. Assess Assets
- Assess Threats
- Assess Vulnerabilities
- Assess Risks
- Determine Countermeasures What are 3 core components of the risk assessment process? - โโโ Correct Answer > 1. Asset criticality
- Threat assessment
- Vulnerability assessment What do SAPs aim to achieve? - โโโ Correct Answer > 1. Protect technological breakthroughs
- Cover exploitation of adversary vulnerabilities
- Protect sensitive operational plans
- Reduce intelligence on U.S. capabilities
What are the SAP Lifecycle - โโโ Correct Answer > 1. Establishment (is extra protection warranted?)
- Management and Administration (continued need? processed followed?)
- Apportionment (proper measures in place? approval received)
- Disestablishment (program no longer needed?)
- A High value indicates that a compromise to assets would have serious consequences resulting in the loss of classified or highly sensitive data that could impair operations affecting national interests for a limited period of time. The rating scale is from 13- 50
- An asset value of Medium indicates that a compromise to the assets would have moderate consequences resulting in the loss of confidential, sensitive data or costly equipment/property that would impair operations affecting national interests for a limited period of time. The rating scale is from 3- 13
- A Low value indicates that there is little or no impact on human life or the continuation of operations affecting national security or national interests. The rating scale is from 1- 3 Define the four threat criteria - โโโ Correct Answer > A Critical rating indicates that a definite threat exists against the assets and that the adversary has both the capability and intent to launch an attack,
What are the four levels of vulnerability? - โโโ Correct Answer >
- A Critical rating indicates that there are no effective countermeasures currently in place and all known adversaries would be capable of exploiting the asset. Critical is assigned a rating scale of 75- 100%.
- Assigning a High rating indicates that although there are some countermeasures in place, there are still multiple weaknesses through which many adversaries would be capable of exploiting the asset. The rating scale is set at 50-74%.
- A Medium rating indicates that there are effective countermeasures in place, however one weakness does exist which some known adversaries would be capable of exploiting. The rating scale is set at 25 - 49%.
- Assigning a Low rating indicates that multiple layers of effective countermeasures exist and few or no known adversaries would be capable of exploiting the asset. The low rating scale is set at 0 - 24%. 5 categories of vulnerability? - โโโ Correct Answer > 1. Human
- Operational
- Information
- Facility
- Equipment
What are the 8 categories of Classified Military Information (CMI)? - โโโ Correct Answer > Category 1 includes information related to the organization, training, and employment of U.S. military forces. Category 2 includes information on specific items of equipment already in production, or in service, and the information necessary for their operation, maintenance, and training. Items on the U.S. Munitions List, or USML, fall within this category. Category 3 includes information related to fundamental theories, design, and experimental investigation into possible military applications; it includes engineering data, operational requirements, concepts, and military characteristics required to adopt the item for production. Development ceases when the equipment has completed suitability testing and has been adopted for use or production. Category 4 includes information related to designs, specifications, manufacturing techniques, and such related information necessary to manufacture materiel and munitions. Category 5 includes information necessary to plan, ensure readiness for, and provide support to the achievement of mutual force development goals or participation in specific combined tactical operations and exercises. It does not include strategic plans and guidance or North American defense information.
(2) Foreign Intelligence entities (3) Cybersecurity Threat What is the security professionals' role in pursuing and meeting cyber security goals? - โโโ Correct Answer > The role of the cyberspace workforce is to "secure, defend, and preserve data, networks, net-centric capabilities, and other designated systems by ensuring appropriate security controls and measures are in place, and taking internal defense actions" (DoDD 8140.01). Per DoDI 8500.01, Cybersecurity (March 14, 2014), personnel occupying cybersecurity positions must be assigned in writing and trained / qualified in accordance with their role. Identify specific baseline administrative and/or physical security controls applicable to each system categorization - โโโ Correct Answer > Controls are identified by enumerating the common controls, identifying those relevant to the categorization level as defined in NIST SP 800-53, potentially tailored by the Authorizing Official, and overlays are applied based on the nature of the system. List three (3) factors for determining whether US companies are under Foreign Ownership Control of Influence (FOCI) - โโโ Correct Answer > 1. Record of economic and government espionage against the US targets.
- Record of enforcement/engagement in unauthorized technology transfer.
- Type and sensitivity of the information that shall be accessed.
- The source, nature and extent of FOCI.
- Record of compliance with pertinent US laws, regulations and contracts.
- Nature and bilateral and multilateral security and information exchange agreements.
- Ownership or control in whole or part, by a foreign government. How does lack of attention to the concept of compilation of information introduce risks to DoD assets? - โโโ Correct Answer >
- Unauthorized disclosure
- Misclassification
- Security Violation
- Improper safeguarding
- Improper dissemination
- Improper handling
- Improper destruction
- Data Spill List at least three indicators of insider threats - โโโ Correct Answer > 1. Failure to report overseas travel or contact with foreign nationals.
- Seeking to gain higher clearance or expand access outside the job scope.
- Engaging in classified conversations without a need to know.
List at least three individuals in the personnel security investigation (PSI) process and describe their roles - โโโ Correct Answer > Facility Security Officer/Security Manager/Security Officer/Security Coordinator/Security Assistant: initiates, reviews, forwards E-Qip investigation to investigation service provider (ISP) Subject: Completes forms and provides additional information if required Investigator: Conducts PSI Adjudicator: Determines security clearance eligibility Define Delegation of Disclosure Authority Letter (DDL) - โโโ Correct Answer > a document issued by the appropriate designated disclosure authority explaining classification levels, categories, scope, and limitations of information under a DoD Component's disclosure jurisdiction that may be disclosed to a foreign government or international organization Define Arms Export Control Act (AECA) - โโโ Correct Answer > Governs the export of defense articles and services and related technical data and is the legal basis for most international programs.
NDP- 1 (National Disclosure Policy) - โโโ Correct Answer > Contains the procedures for disclosure of U.S. classified military information to foreign governments and international organizations Define General Security of Military Information Agreement (GSOMIA) - โโโ Correct Answer > a government-to-government agreement negotiated through diplomatic channels. It states that each party to the agreement will afford to classified information provided by the other the degree of security protection afforded it by the releasing government. Describe the purpose, intent, and security professional's role in each step of the Command Cyber Readiness Inspections (CCRI) process - โโโ Correct Answer > Defining the scope, the inspection phase, documentation of observations, and reporting findings. A security professional would have responsibilities in defining the scope of the inspection, overseeing the self-inspection and remediation efforts, and coordinating with the CCRI team throughout the remainder of the process List two factors that should be considered when determining position sensitivity - โโโ Correct Answer > (1) Level of access to classified information (2) IT level needed (3) Duties associated with position Explain the process for responding to a "spillage" - โโโ Correct Answer > 1. Detection (implied)
