DoD Certified Counter‑Insider Threat Professional (CCITP) Fundamentals Practice Exam

These questions are part of the practice quiz. Start practicing

• What is the primary purpose of the Freedom of Information Act (FOIA) enacted in 1966?
• What role does HR play in counter insider threat assessments?
• What does E.O. 12333 aim to accomplish for the United States intelligence efforts?
• What is a consequence of humans compulsively creating explanations for events?
• What does the National Industrial Security Program Operating Manual (NISPOM) require?
• Which behavior must be reported to the appropriate CI office according to DoD requirements?
• What is the focus of the 'Problem Restatement' method?
• Which of the following data types is relevant in HR information for Insider Threat Programs?
• What is a major focus of multi-disciplinary insider threat working groups?
• Who typically holds privileged user accounts within an organization?
• Which of the following is an example of personal predispositions that may indicate potential risk?
• What is a fundamental requirement for conducting thorough analysis?
• What is required for an individual to understand their health information rights under HIPAA?
• What is the purpose of a Systems of Records Notice (SORN)?
• What is the primary mission of the National Personnel Records Center (NPRC)?
• What should analytic products clearly describe according to analytic tradecraft?
• Which of the following aspects is NOT part of Behavioral Science mitigation responses?
• Which standard ensures the analysis includes complexities and interrelationships?
• What is a potential negative impact of aggressive responses to insider threats?
• Which of the following is a potential effect of untreated medical conditions?
• What kind of information is cataloged in the TECS database?
• What is the function of a Probability Tree?
• What does the CASC aim to provide with its personnel file systems?
• What do PAR capabilities aim to achieve in the context of insider threats?
• What is the primary focus of the Health Insurance Portability and Accountability Act (HIPAA)?
• What is a characteristic of intellectual standards in analysis?
• What is the primary responsibility outlined in NISPOM, Section 1-301?
• What type of judgments are included in public records provided by commercial databases?
• What does Weighted Ranking assist in?
• What must happen when an insider threat program is involved concerning E.O. 12333?
• What is the primary purpose of analyzing UAM (User Activity Monitoring) data?
• Which of the following actions is important for protecting cyber data against unauthorized disclosures?
• How can Mental Shortcuts lead to problems in decision-making?
• What does the Defense Manpower Data Center (DMDC) primarily contain?
• What is a key aspect of the analytic standards regarding bias and viewpoint?
• How should visual information be used in analytic products?
• In what way does Hypothesis Testing contribute to decision-making?
• Which practice is established by E.O. 13587 concerning insider threats?
• What is defined by a System of Records Notice (SORN)?
• What is one of the mitigation capabilities of Behavioral Science?
• What does Behavioral Science primarily study?
• What does the DoD 5400.11-R regulation establish?
• What is one of the primary goals of insider threat programs?
• What is the primary reporting channel for DoD and Federal agencies concerning potential insider threats?
• Which statement best represents Occam's Razor?
• Why are 'Chronologies/Timelines' important in analysis?
• What defines personally identifiable information (PII)?
• According to the First Amendment, what right do individuals have regarding expression?
• Under which executive order was the Fundamental Classification Guidance Review program established?
• What is a consequence of insider threats according to cybersecurity mitigation responses?
• What kind of information must be reported to the FBI regarding unauthorized disclosures?
• What is the primary mission of the DoD Insider Threat Management and Analysis Center?
• What type of information is designated under the classification of Controlled Unclassified Information (CUI)?
• What is the Continuous Evaluation (CE) Process?
• What do the Adjudicative Guidelines primarily assess?
• Who shares responsibility in the Continuous Evaluation (CE) Process?
• Which of the following reflects an assumption in the analysis of competing hypotheses?
• Which factor can escalate concerning behaviors in individuals?
• Which of the following is a minimum standard outlined in E.O. 13587?
• What does security auditing primarily involve?
• Which type of bias can cause people to only seek evidence that supports their preconceived notions?
• Which assumption is critical to forming a diagnostic analysis?
• Which of the following actions can HR take in response to performance issues?
• What essential training does E.O. 13587 mandate for the workforce?
• According to CNSSD 504, which of the following is NOT a required capability for UAM?
• What type of records are considered pertinent in law enforcement's role in Insider Threat Programs?
• Which option is NOT considered a reason for reporting insider threats according to DITMAC?
• What is the primary relationship between the HUB Analyst and DoD DITMAC Analyst?
• Which record type might be included in basic employment records?
• How can cybersecurity respond to an insider threat incident?
• Which term refers to the new material generated from already classified information?
• What is an essential aspect of imaginative thinking in addressing complex problems?
• Why is protecting individual privacy and civil liberties essential in Insider Threat programs?
• What does the Privacy Act of 1974 establish regarding personally identifiable information?
• In what way does the 'Pros-Cons-Fixes' method assist analysts?
• Which constitutional amendment protects citizens from unreasonable searches and seizures?
• What aspect does the Security Clearance Adjudicative process analyze?
• What type of referral might be included in response options for HR addressing insider threats?
• Which of the following best describes 'analytic tradecraft'?
• What is the primary purpose of DoD 5200.08-R?
• What type of information do commercial databases typically provide?
• Which type of incidents must be reported to the FBI and DCSA under the NISPOM?
• Which of the following situations should be reported under insider threat reporting standards?
• What key aspect must be preserved during incident response to ensure investigations proceed smoothly?
• What does the Intelligence Community Whistleblower Act of 1998 primarily allow CIA employees to do?
• What is the primary purpose of a Causal Flow Diagram?
• Which of the following is considered an anomalous behavior within the Cyber pillar?
• What system replaced JPAS for personnel security actions and determinations?
• Which of the following is one of the 13 National Security Adjudicative Guidelines?
• The Matrix is mainly used to achieve what objective?
• Which is a key responsibility assigned to the Secretary of Defense under NDAA FY17?
• What does a Utility Tree/Matrix help to determine?
• What action is prohibited against a member of the Armed Forces for making lawful communications?
• What does 'Divergent/Convergent Thinking' promote in the analytical process?
• Which technique promotes objectivity by examining opposing viewpoints?
• What is the role of the non-profit organization related to insider threats?
• How does organizational culture influence employees?
• What is the primary function of the DITMAC System-of-Systems (DSOS)?
• Which of the following is a possible indicator for reporting under DITMAC thresholds?
• What can law enforcement provide in terms of Mitigation Responses?
• What does the CI approach involve when looking into an individual's behavior?
• What is one of the primary capabilities of law enforcement related to insider threats?
• When should interaction with a Behavioral Science professional occur?
• What does the Insider Threat Security Classification Guide provide?
• Which of the following is a method used for ensuring secure information delivery in the Global Information Grid (GIG)?
• A Scenario/Decision Tree helps in mapping out what?
• What does unauthorized disclosure of information generally pertain to under DITMAC guidelines?
• What is a key part of legal guidance in responding to insider threats?
• Which of the following is NOT considered a protected class under EEO laws?
• Goal 3 of the PAR Memo is focused on what aspect?
• What is a requirement placed on the Inspector General of the CIA regarding the handling of complaints?
• What is a common factor that human reasoning struggles with according to biases?
• What behavior is prohibited among armed forces members concerning protests?
• Which act does the DoDD 5400.07 promote uniformity for within the DoD?
• What is a primary focus of organizational psychology as related to insider threats?
• What must be reported in the case of criminal activity related to insider threats?
• Which of these is not reported through information systems to the FBI?
• What does the evaluation of emotional thinking ultimately aim to enhance?
• In TTPs, what does the term 'tactic' refer to?
• Which method is best for examining conflicting viewpoints in discussions?
• What type of threats does an Insider Threat program primarily address?
• What is the primary role of the U.S. Equal Employment Opportunity Commission?
• What are Potential Risk Indications (PRIs) concerned with?
• Under DoDD 7050.06, what right does a military member have regarding communications with Congress?
• What does the Defense Central Index of Investigations (DCII) provide information about?
• Which is NOT considered a CI mitigation response?
• What do Equal Employment Opportunity (EEO) laws primarily address?
• Which of the following is considered a primary source in data collection?
• According to NISPOM, which of the following must be included in automated audit trails?
• How does legal support the Insider Threat Program's actions?
• Under HIPAA, what term is used for health information that is protected?
• What does the DoD 6025.18-R regulation implement in relation to health care?
• According to the information provided, which behavior should raise alarms as part of insider threat detection?
• What is required under DoD reporting requirements when classified information may be disclosed to unauthorized entities?
• Which is considered a proactive measure within the Insider Threat program?
• What does High Impact/Low Probability analysis help identify?
• Which guideline assesses potential foreign influence on a personnel security investigation?
• What risk does emotional influence pose according to the content?
• What is the primary purpose of federal agencies establishing insider threat programs as per E.O. 13587?
• How does the Defense Biometric Identification System (DBIDS) function?
• What is one method of security ITP mitigation response?
• What is a crucial reason for securing privileged user accounts?
• What starts the Security Clearance Adjudicative Process?
• What does the Americans with Disabilities Act (ADA) prohibit?
• What does DoDD 5240.06 establish in relation to CI?
• What integration aim is specified by NDAA FY18 concerning insider threat data?
• What does the Real-Time Automated Personnel Identification System (RAPIDS) primarily support?
• Which of the following is NOT a general indicator of potential insider threats?
• Which action is NOT part of counterintelligence inquiries?
• What aspect of analytic judgments should be explained according to analytic standards?
• What component of health information does PHI include?
• Which of the following activities might indicate a potential insider threat?
• Which sequence correctly describes the critical pathway related to concerning behavior?
• What does DoDI 8500.01 dictate regarding cybersecurity?
• Which right is NOT granted to individuals under the Privacy Act policy?
• To whom should federal contractors report potential insider threats?
• What does the Financial Crimes Enforcement Network (FINCEN) primarily handle?
• Which incident falls under the category of insider threats according to reporting standards?
• Which of the following outlines the coordination of counterintelligence activities?
• What is defined by the Committee on National Security Systems Directive (CNSSD) 504 regarding User Activity Monitoring (UAM)?
• Which of the following ensures that analytic assessments are free from political influence?
• What type of evidence must be properly handled according to chain of custody rules after an incident?
• Which of the following responses might be part of security-based mitigation?
• What characteristic is essential for analytic products, according to the analytic standards?
• What role does counterintelligence (CI) data play in assessing insider threats?
• What aspect of cybersecurity does DoD aim to protect as stated in DoDI 8500.01?
• What type of behaviors does the Behavioral Science pillar identify as anomalous?
• What is the primary instinctive challenge humans face when applying reasoning skills?
• What is the primary function of the legal team in an Insider Threat Program?
• What is the function of the Defense Enrollment Eligibility Reporting System (DEERS)?
• What is the focus of the Fourth Amendment protections?
• What should information collection be based on according to regulations?
• Which standard ensures that arguments presented in analysis are coherent and logical?
• What might reliance on mental shortcuts prevent?
• What is the main purpose of the Common Access Card (CAC)?
• What does DoD 5200.02-M outline?
• Which component is critical when analyzing concerning behaviors in employees?
• What is the primary purpose of the National Intelligence Priorities Framework (NIPF)?
• Which indication reflects a concerning behavior linked to financial issues?
• PII protection is considered whose responsibility?
• What is the primary role of an Insider Threat program's analyst?
• What should be monitored to determine if risks associated with insider threats have been minimized?
• What type of card does RAPIDS issue to eligible individuals?
• What information is contained in the National Crime Information Center (NCIC)?
• In diagnostic techniques, what is the purpose of the Analysis of Competing Hypothesis?
• What level of classification should items be classified at?
• What type of protection does the Whistleblower Act of 1989 provide?
• Which of the following is a role of Behavioral Science in counter insider threat assessments?
• What type of behavior can law enforcement spot that relates to insider threats?
• What does Continuous Monitoring in the risk management framework aim to ensure?
• Which behavior could be considered anomalous within the Security pillar?
• What kind of data does DEERS serve as a repository for?
• What is a concept underpinning the behavior of an adversary in TTPs?
• How important is timeliness in analytic standards?
• What is the primary obligation for the FBI when classified information is disclosed unauthorized to a foreign power?
• Why is it important to implement a process of response monitoring?
• What is one requirement for audit trails as stated by NISPOM?
• Which organization is tasked with monitoring insider behavior indicative of a threat?
• What type of information is protected under one of the FOIA exemptions?
• What mandate is specified by the National Defense Authorization Act (NDAA) FY17 Section 951?
• What does DoDD 5205.16 require from DoD components regarding insider threat programs?
• What can happen if privacy and civil liberties are not protected?
• What is the goal of Devil's Advocacy in discussions?
• Which factor is emphasized in Emotional Thinking challenges?
• What is a focus area for effective programs countering Foreign Intelligence Entity (FIE) threats?
• How does the security discipline help in counter insider threat assessments?
• What is the purpose of DoDI 5205.83 in relation to insider threats?
• What is the purpose of the EO 13526 in the context of DoD Information Security?