US Navy Cyber Awareness Challenge 2025 Part 2

Adam sees a coworker who does not have the required clearance with a printed document marked as Sensitive Compartmented Information (SCI). What should he do?
-Contact his security POC to report the incident.
-E-mail his security POC with detailed information about the information and person involved.
-Nothing. It is not his responsibility.
-Retrieve the document and verify that the coworker did not read it.

Which of the following is true for Controlled Unclassified Information (CUI)?
-It is another term for any Unclassified information that has not been cleared for public release.
-It is marked as CUI at the discretion of the information owner.
-It poses no risk to Government missions or interests.
-It belongs to a defined category established in the DoD CUI Registry.

You received an e-mail marked important from your agency head asking you to call them using a number you do not recognize. The e-mail was sent from a personal e-mail address that you do not recognize, but it addresses you by name. What action should you take?
-This may be a spear phishing attempt. Report it to your security POC or help desk.
-This is an important request that requires your immediate attention. You should call immediately.
-As it does not contain any hyperlinks or attachments, you should simply delete the e-mail.
-As the e-mail addresses you by name, you should test the number by sending a text message to it.

As you scroll through your social media feed, a news headline catches your eye. What should you consider before sharing it with your connections?
-How many times you have already posted today
-Whether your connection would find the information valuable
-There is nothing for you to consider before sharing
-Whether the source is credible and reliable

When linked to a specific individual, which of the following is NOT an example of Personally Identifiable Information (PII)?
-Smartphone brand and model
-Fingerprint records
-Mother's maiden name
-Payment for the provisions of healthcare

How can malicious code do damage?
-Corrupt files
-Encrypting or erasing your had drive
-Allowing hackers access
-All of these

Steve occasionally runs errands during virtual meetings. He joins the meetings using his approved government device. Does this pose a security concern?
-Maybe. It depends on whether Steve uses headphones and how loudly he talks.
-Yes. eavesdroppers may be listening to Steve's conversation.
-No. No one else is going to be paying attention to what Steve is doing, as phone calls in public places are common.
-No, because Steve is using a government-approved device.

Who designates whether information is classified and its classification level?
-Your organization or agency head
-National Security Agency (NSA)
-Original classification authority
-Your security point of contact

What is an insider threat?
-The risk that information systems and networks will fail due to inadequate internal maintenance.
-Someone who proactively identifies persons with authorized access to explain to gain access to U.S. government data.
-The risk posed by the loss of organizational knowledge when trusted personnel resign or retire.
-Someone who uses authorized access, either wittingly or unwittingly, to harm national security.

Does it pose a security risk to tap your smartwatch to pay for a purchase at a store?
-Only if you do not have the data on your linked phone encrypted.
-No, there is no security risk associated with this.
-Only if you do not have two-factor authentication enabled on your linked phone.
-Yes, there is a risk that the signal could be intercepted and altered.

How can you protect yourself from social networking sites?
-Assume that people are who they say they are on social networking sites
-Establish privacy settings and assume the available options will remain consistent
-Validate connection requests through another source if possible
-Turn on Global Positioning System (GPS) location geotagging

Which of the following is a potential insider threat indicator?
-Authorized handling of classified information
-Work-related foreign travel
-Financial windfall from an inheritance
-Death of a spouse

Which of the following is an appropriate use of a DoD Public Key Infrastructure (PKI) token?
-Use a SIPRNet token for NIPRNet access as well
-Only leave it in a system while actively using it for a PKI-required task
-Use a NIPRNet token for SIPRNet access as well
-Only use it on a publicly accessible computer with up-t-date antivirus software

Which of the following is a best practice for telework and remote work?
-Ensure others do not have access to your work area when processing classified information.
-Connect to your Government Virtual Private Network (VPN).
-Use personal equipment to avoid the risks associated with non-Government internet.
-Rotate the location in your home where you perform telework or remote work.

Under which Cyberspace Protection Condition (CPCON) is the priority focus limited to critical functions?
-CPCON 1
-CPCON 2
-CPCON 3
-CPCON 4

Which of the following uses of removable media is allowed?
-Alex uses personally owned removable media on an Unclassified government laptop to transfer personal music files.
-Nicky uses Unclassified government owned removable media to transfer work files to a personal laptop.
-Cameron connects a personal phone to an Unclassified government laptop to charge.
-Sam uses approved Government owned removable media to transfer files between government systems as authorized.

John receives an e-mail about a potential shutdown of a major social service unless a petition receives enough signatures. Which of the following actions should John NOT take with the e-mail?
-Research the claim
-Delete it
-Forward it
-Mark it as junk

Which of the following is a best practice for using government e-mail?
-Do not solicit sales
-Use "Reply All" when responding to e-mails
-Copy your personal e-mail on your outgoing-emails
-Do not use a digital signature when sending attachments

When is the safest time to post on social media about your work-related travel?
-During the trip
-Before the trip
-After the trip

As you browse a social media site, you come across photos of information with classification markings. What should you do?
-You are authorized to response to inquiries about it.
-Notify your security point of contact.
-You may forward the URL to the information to interested parties.
-Download the information to your computer.

Matt is a government employee who needs to share a document containing source selection data with his supervisor. Which of the following describes the most appropriate way for Matt to do this?
-Sent it via chat in a collaboration app.
-Leave a printed copy on his supervisor's desk after working hours.
-Encrypt it and send it via digitally signed Government e-mail.
-Save it to a shared folder accessible to their team.

Which of the following is best practice when browsing the Internet?
-Set your browser to accept all cookies
-Look for the h-t-t-p-s in the URL name
-Confirm that the site uses an unencrypted link
-Save your credit card information on e-commerce sites

Based on the description provided, how many insider threat indicators are present?
Edward has worked for a DoD agency for 2 years. He is an analyst who takes a great deal of interest in his work. He occasionally takes a somewhat aggressive interest in others' work as well, including asking for classified detail of their projects. He otherwise gets along well with his colleagues.
-0
-1
-2
-3+

Which of the following in NOT an appropriate use of your Common Access Card (CAC)?
-Reporting it immediately if lost of misplaced
-Exchanging it for a visitor pass in another building
-Using it on systems with up-to-date security
-Storing it in a shielded sleeve

*Unclassified Information
Your meeting notes are unclassified. This means that your notes:
-May be released to the public.
-Do not have the potential to damage national security.
-Do not have the potential to affect the safety of personnel, missions, or systems.
-Do not require any markings

*Unclassified Information
What type of information does this personnel roster represent?
-Unclassified Information
-Controlled Unclassified Information (CUI)
-For Official Use Only (FOUO) information

*Unclassified Information
When e-mailing this personnel roster, which of the following should you do?
-Encrypt the PII
-Digitally sign the e-mail
-Use your Government e-mail account

*Classified Information
Select an area in which to edit an electronic report that is classified.
-Your Office
-Common Area
-Conference Room
-Designated Secure Area

*Sensitive Compartmented Information
Select an action to take in response to compromised Sensitive Compartmented Information (SCI).
-Gather more information
-Call your security point of contact (POC)
-Do nothing

*Sensitive Compartmented Information
Printer
Dr. Dove printed a classified document and retrieved it promptly from the printer.
Does this behavior represent a security concern?
-Yes
-No

*Sensitive Compartmented Information
Workstation
Col. Cockatiel stores an unmarked document on the classified network.
Does this behavior represent a security concern?
-Yes
-No

*Sensitive Compartmented Information
Conversation Area
Mr. Macaw and a colleague had a conversation about a shared project in the SCIF after verifying no one was nearby.
Does this behavior represent a security concern?
-Yes
-No

*Sensitive Compartmented Information
Which of these individuals demonstrated behavior that could lead to the compromise of SCI?
-Dr. Dove
-Col. Cockatiel
-Mr. Macaw

*Physical Facilities
Open Office Area
Which of the following poses a physical security risk?
-Posting an access roster in public view
-Using your Common Access Card (CAC) for facility access
-Challenging people without proper badges

*Physical Facilities
Collateral Classified Space
Which of the following must you do when using an unclassified laptop in a collateral classified environment?
-Use a wireless headset
-Disable the embedded camera, microphone, and Wi-Fi
-Use government-issued wired peripherals

*Physical Facilities
Sensitive Compartmented Information Facility (SCIF)
Which of the following must you do when working in a SCIF?
-Verify that all personnel in listening distance have a need-to-know
-Ensure that monitors do not provide unobstructed views
-Escort uncleared personnel and warn others in the SCIF

*Government Resources
Is this an appropriate use of government-furnished equipment (GFE)?
-Yes
-No

*Government Resources
This is not an appropriate use of GFE. Why?
-You should not use government e-mail to sell anything.
-You should use a digital signature when sending hyperlinks.
-You should not use unauthorized services, such as fileshare services, on GFE.

*Identity Authentication
Alex
How do you secure your account?
I receive a text message code when logging in with a password.
-Yes
-Maybe
-No

*Identity Authentication
Bailey
What kind of passwords do you use?
I use Password1 as one of my passwords.
-Yes
-Maybe
-No