SAPPC ALL COMPREHENSIVE QUESTIONS AND
ANSWERS SURE A+
✔✔The five-step OPSEC process - ✔✔1. Identify critical information 2. Analyze threats
3.Analyze vulnerabilities 4. Assess risks 5.Apply OPSEC countermeasures
✔✔Ways to protect critical information - ✔✔Disclose information about your mission and
organization judiciously and on a need-to-know basis. 1. Do not discuss your work in
public places or where others can overhear your conversation 2. Do not discuss critical
information on unencrypted telephones 3. Do not include critical information in
unencrypted e-mail messages 4. Do not reveal critical information, indicators, or
personal information on the Internet 5. Shred paper documents before placing them in
the trash 6. Refer all inquiries from the press to your organization's public affairs office
✔✔OPSEC countermeasures - ✔✔1. Minimize predictable patterns 2. Conceal
indicators that may point to critical information 3. Make indicators seem unimportant 4.
May be as simple as choosing not to talk about something 5. Protect critical information
✔✔Five categories of risk process assets - ✔✔1. Assess assets (identify value of asset
and degree of impact if asset is damaged or lost) 2. Assess threats (type and degree of
threat) 3. Assess vulnerabilities (identification and extent of vulnerabilities) 4. Assess
risks (calculation of risks) 5. Determine countermeasures (security countermeasure
options that can reduce or mitigate risks cost effectively
✔✔Five categories of assets - ✔✔1. People 2. Information 3. Equipment 4. Facilities 5.
Activities & Operations
✔✔Risk vulnerability ratings - ✔✔Critical - no effective countermeasure 75-100; High -
some countermeasures but multiple weaknesses 50-74; Medium - countermeasures in
place with one weakness 25-49; Low effective countermeasures are in place 0-14
✔✔Risk management formula - ✔✔Risk = Impact x (Threat x Vulnerability) or (R = I [T x
V])
,✔✔Risk management countermeasures - ✔✔Manpower, Equipment, Procedures
✔✔Security Infraction - ✔✔This event cannot reasonably be expected to and does not
result in the loss, compromise, or suspected compromise of classified information
✔✔DoD Manual 5200.01, Volumes 1-4 - ✔✔The manual that governs the DoD
Information Security Program
✔✔E.O. 13526 - ✔✔The executive order that governs the DoD Information Security
Program
✔✔32 CFR Parts 2001 & 2003, "Classified National Security Information; Final Rule" -
✔✔The Information Security Oversight Office (ISOO) document that governs the DoD
Information Security Program
✔✔Security Violation - ✔✔An event that results in or could be expected to result in the
loss or compromise of classified information
✔✔Unauthorized Disclosure - ✔✔Communication or physical transfer of classified or
controlled unclassified information to an unauthorized recipient
✔✔Termination Briefing - ✔✔This briefing is given when an individual's employment is
terminated, clearance eligibility is withdrawn, or if the individual will be absent from duty
for 60 days or more. It is also given to those who have been inadvertently exposed to
classified information.
✔✔Foreign Travel Briefing - ✔✔This briefing that applies to cleared personnel who plan
to travel in or through foreign countries, or attend meetings attended by representatives
of other countries.
✔✔Refresher Briefing - ✔✔This briefing is presented annually to personnel who have
access to classified information or assignment to sensitive duties.
✔✔Secret - ✔✔Unauthorized disclosure of this information could reasonably be
expected to cause serious damage to our national security.
✔✔Top Secret - ✔✔Unauthorized disclosure of this information could reasonably be
expected to cause exceptionally grave damage to our national security.
✔✔Confidential - ✔✔Unauthorized disclosure of this information could reasonably be
expected to cause damage to our national security.
, ✔✔Freedom of Information Act (FOIA) - ✔✔The act regarding the withholding
information from public release; framework and guidance for evaluation for public
release for info to be exempt are from the 9 distro statements
✔✔Derivative Classification - ✔✔This is defined as the incorporating, paraphrasing,
restating, or generating in new form any information that is already classified.
✔✔Derivative classification process - ✔✔1. Observe and respect the OCA original
classification determination
2. Apply required markings
3. Use only authorized sources
4. Use caution when paraphrasing or restating classified information extracted form a
classified source document
5. Always take the appropriate steps to resolve any doubts you have
✔✔Original Classification - ✔✔This is defined as an initial determination that information
requires, in the interest of national security, protection against unauthorized disclosure.
✔✔Compilation - ✔✔This is defined as unclassified information or classified information
(at a lower level) that when the information is combined or associated reveals additional
factors that qualifies for classification.
✔✔Original Classification Authority - ✔✔The term used to identify individuals specifically
authorized in writing to make initial classification decisions.
✔✔Security Classification Guides (SCG) - ✔✔This contains classification levels, special
requirements and duration instructions for programs, projects, plans, etc.
✔✔Original Classification Process - ✔✔The six step process an OCA applies in making
classification determinations. 1. Determine if the information is official government
information 2. Determine if the information is eligible to be classified 3. Determine if
there is a potential for damage to national security if unauthorized release occurs 4.
Assign a level of classification 5. Make a decision about the duration of classification 6.
Communicate the decision
✔✔Declassification - ✔✔The authorized change in the status of information goes from
classified information to unclassified information
✔✔Declassification systems - ✔✔Scheduled, Automatic, Mandatory, Systematic
ANSWERS SURE A+
✔✔The five-step OPSEC process - ✔✔1. Identify critical information 2. Analyze threats
3.Analyze vulnerabilities 4. Assess risks 5.Apply OPSEC countermeasures
✔✔Ways to protect critical information - ✔✔Disclose information about your mission and
organization judiciously and on a need-to-know basis. 1. Do not discuss your work in
public places or where others can overhear your conversation 2. Do not discuss critical
information on unencrypted telephones 3. Do not include critical information in
unencrypted e-mail messages 4. Do not reveal critical information, indicators, or
personal information on the Internet 5. Shred paper documents before placing them in
the trash 6. Refer all inquiries from the press to your organization's public affairs office
✔✔OPSEC countermeasures - ✔✔1. Minimize predictable patterns 2. Conceal
indicators that may point to critical information 3. Make indicators seem unimportant 4.
May be as simple as choosing not to talk about something 5. Protect critical information
✔✔Five categories of risk process assets - ✔✔1. Assess assets (identify value of asset
and degree of impact if asset is damaged or lost) 2. Assess threats (type and degree of
threat) 3. Assess vulnerabilities (identification and extent of vulnerabilities) 4. Assess
risks (calculation of risks) 5. Determine countermeasures (security countermeasure
options that can reduce or mitigate risks cost effectively
✔✔Five categories of assets - ✔✔1. People 2. Information 3. Equipment 4. Facilities 5.
Activities & Operations
✔✔Risk vulnerability ratings - ✔✔Critical - no effective countermeasure 75-100; High -
some countermeasures but multiple weaknesses 50-74; Medium - countermeasures in
place with one weakness 25-49; Low effective countermeasures are in place 0-14
✔✔Risk management formula - ✔✔Risk = Impact x (Threat x Vulnerability) or (R = I [T x
V])
,✔✔Risk management countermeasures - ✔✔Manpower, Equipment, Procedures
✔✔Security Infraction - ✔✔This event cannot reasonably be expected to and does not
result in the loss, compromise, or suspected compromise of classified information
✔✔DoD Manual 5200.01, Volumes 1-4 - ✔✔The manual that governs the DoD
Information Security Program
✔✔E.O. 13526 - ✔✔The executive order that governs the DoD Information Security
Program
✔✔32 CFR Parts 2001 & 2003, "Classified National Security Information; Final Rule" -
✔✔The Information Security Oversight Office (ISOO) document that governs the DoD
Information Security Program
✔✔Security Violation - ✔✔An event that results in or could be expected to result in the
loss or compromise of classified information
✔✔Unauthorized Disclosure - ✔✔Communication or physical transfer of classified or
controlled unclassified information to an unauthorized recipient
✔✔Termination Briefing - ✔✔This briefing is given when an individual's employment is
terminated, clearance eligibility is withdrawn, or if the individual will be absent from duty
for 60 days or more. It is also given to those who have been inadvertently exposed to
classified information.
✔✔Foreign Travel Briefing - ✔✔This briefing that applies to cleared personnel who plan
to travel in or through foreign countries, or attend meetings attended by representatives
of other countries.
✔✔Refresher Briefing - ✔✔This briefing is presented annually to personnel who have
access to classified information or assignment to sensitive duties.
✔✔Secret - ✔✔Unauthorized disclosure of this information could reasonably be
expected to cause serious damage to our national security.
✔✔Top Secret - ✔✔Unauthorized disclosure of this information could reasonably be
expected to cause exceptionally grave damage to our national security.
✔✔Confidential - ✔✔Unauthorized disclosure of this information could reasonably be
expected to cause damage to our national security.
, ✔✔Freedom of Information Act (FOIA) - ✔✔The act regarding the withholding
information from public release; framework and guidance for evaluation for public
release for info to be exempt are from the 9 distro statements
✔✔Derivative Classification - ✔✔This is defined as the incorporating, paraphrasing,
restating, or generating in new form any information that is already classified.
✔✔Derivative classification process - ✔✔1. Observe and respect the OCA original
classification determination
2. Apply required markings
3. Use only authorized sources
4. Use caution when paraphrasing or restating classified information extracted form a
classified source document
5. Always take the appropriate steps to resolve any doubts you have
✔✔Original Classification - ✔✔This is defined as an initial determination that information
requires, in the interest of national security, protection against unauthorized disclosure.
✔✔Compilation - ✔✔This is defined as unclassified information or classified information
(at a lower level) that when the information is combined or associated reveals additional
factors that qualifies for classification.
✔✔Original Classification Authority - ✔✔The term used to identify individuals specifically
authorized in writing to make initial classification decisions.
✔✔Security Classification Guides (SCG) - ✔✔This contains classification levels, special
requirements and duration instructions for programs, projects, plans, etc.
✔✔Original Classification Process - ✔✔The six step process an OCA applies in making
classification determinations. 1. Determine if the information is official government
information 2. Determine if the information is eligible to be classified 3. Determine if
there is a potential for damage to national security if unauthorized release occurs 4.
Assign a level of classification 5. Make a decision about the duration of classification 6.
Communicate the decision
✔✔Declassification - ✔✔The authorized change in the status of information goes from
classified information to unclassified information
✔✔Declassification systems - ✔✔Scheduled, Automatic, Mandatory, Systematic
