SFPC EXAM 2026/2027
WITH ACTUAL EXAM QUESTIONS AND CORRECT ANSWERS
(Verified Answers)
SECURITY FUNDAMENTALS PROFESSIONAL CERTIFICATION (SFPC)
REAL EXAM TEST BANK (BRAND NEW!!)
250 Comprehensive Questions with Detailed Rationales
Aligned with 2026-2027 CDSE SFPC Exam Blueprint & DoD Security Competency Framework
Total Questions 250 (Verified)
Info Security | Personnel Security | Physical Security | Industrial Security | General Security |
Sections
Cybersecurity | Integrated Scenarios
DoD Policy Refs DODM 5200.01 series | CJCS Instructions | EO 13526 | NISPOM | SEAD 4 | ICD 705
Question Style 70% scenario-based, 25% direct recall, 5% analysis
Passing Standard 70% (A+ graded content)
Comprehensive Coverage of DoD Security Doctrine, Policy Application, and SFPC Competency Framework
SFPC Exam 2026/2027 - Page 1
,SFPC 2026/2027 | DoD Security Fundamentals | CDSE Aligned
Section 1: Information Security - Questions 1-55
Classification, Declassification, Markings & Safeguarding | E.O. 13526, 32 CFR Parts 2001 & 2003, DoD Manual
5200.01 Volumes 1-4
Q1: An Original Classification Authority (OCA) is determining whether to classify a new intelligence
report. Under E.O. 13526, which of the following is the FIRST requirement that must be met before
information can be classified?
A. The information must be owned by, produced by, or under the control of the U.S. Government
[CORRECT]
B. The information must relate to military plans or weapons systems
C. The information must be reviewed by the Information Security Oversight Office (ISOO)
D. The information must have a classification duration of at least 10 years
Correct Answer: A
Rationale: Per E.O. 13526, information may only be classified if it is owned by, produced by, or under the control of
the U.S. Government AND falls within one or more of the eight classification categories. The other options describe
specific categories or procedures, but the government control requirement is the foundational prerequisite.
Q2: When an OCA classifies information, which of the following is NOT one of the eight categories
under which information may be classified?
A. Military plans, weapons systems, or operations
B. Foreign government information
C. Personal financial information of federal employees [CORRECT]
D. Vulnerabilities or capabilities of systems, installations, infrastructures, or projects
Correct Answer: C
Rationale: The eight categories in Section 1.4 of E.O. 13526 include military plans, foreign government information,
intelligence activities, foreign relations, scientific/technological/economic matters, U.S. Government programs for
safeguarding nuclear materials/facilities, vulnerabilities/capabilities of systems, and weapons of mass destruction.
Personal financial information of federal employees is not a valid classification category.
Q3: A DoD component creates a new document that paraphrases content from three previously
classified source documents. Who is authorized to mark this new document?
A. Any cleared employee who handles the new document
B. A derivative classifier applying the markings from authorized source documents [CORRECT]
C. Only the OCA who originally classified the source documents
D. The Information Security Oversight Office (ISOO)
Correct Answer: B
Rationale: Per DoD Manual 5200.01, Volume 2, derivative classifiers are authorized to incorporate, paraphrase,
restate, or generate new forms of classified information from authorized sources. Authorized sources include Security
Classification Guides (SCGs), properly marked source documents, and DD Form 254. The derivative classifier carries
the same legal responsibility as the OCA for proper classification markings.
SFPC Exam 2026/2027 - Page 2
,SFPC 2026/2027 | DoD Security Fundamentals | CDSE Aligned
Q4: Which of the following is NOT an authorized source for derivative classification?
A. Security Classification Guide (SCG)
B. Properly marked source document
C. Contract Security Classification Specification (DD Form 254)
D. A classified email received from a colleague discussing a classified program [CORRECT]
Correct Answer: D
Rationale: Authorized sources for derivative classification are limited to: (1) Security Classification Guides (SCGs),
(2) properly marked source documents, and (3) Contract Security Classification Specifications (DD Form 254). A
casual email from a colleague, even if classified, is not a properly marked source document in the formal regulatory
sense and may not be used as a derivative classification authority.
Q5: An OCA classifies a document under 25X1 (reveal information that would assist in development of
weapons of mass destruction). What is the maximum duration for which this information can remain
classified?
A. 10 years from the date of the original decision
B. 25 years from the date of the original decision
C. 50 years from the date of the original decision
D. Indefinitely, with review at 25-year intervals [CORRECT]
Correct Answer: D
Rationale: The 25X1 exemption (WMD-related) allows information to remain classified for up to 50 years from the date
of original classification, but in practice, when marked 25X1 with no date or event, the information requires review at
25-year intervals and may be extended. The 50X1-HUM and 50X2-WMD exemptions specifically exempt information
from automatic declassification at 25 years and require continued protection.
Q6: Under E.O. 13526, what is the default classification duration if the OCA cannot determine a specific
date or event for declassification?
A. 5 years from the date of original classification
B. 10 years from the date of original classification [CORRECT]
C. 25 years from the date of original classification
D. 50 years from the date of original classification
Correct Answer: B
Rationale: Per E.O. 13526 Section 1.6(a), if the OCA cannot determine a specific date or event for declassification, the
information shall be marked for declassification 10 years from the date of the original decision, unless the OCA
determines that sensitivity requires a longer duration of up to 25 years under 25X exemptions.
Q7: Which declassification option requires the information to remain classified without a specific date or
event because its release would reveal the identity of a confidential human intelligence source?
A. 50X1-HUM [CORRECT]
B. 50X2-WMD
C. 25X1-human
D. 10X2-source
Correct Answer: A
Rationale: The 50X1-HUM exemption specifically protects information that would reveal the identity of a confidential
human intelligence source. This exemption applies to information 50 years or older and requires no date or event for
declassification. 50X2-WMD applies to weapons of mass destruction information.
SFPC Exam 2026/2027 - Page 3
, SFPC 2026/2027 | DoD Security Fundamentals | CDSE Aligned
Q8: A document is marked 'Declassify X years from date of creation, but in no event beyond 25 years.'
Which declassification exemption was most likely applied?
A. 10-year rule
B. 25X exemption with a date or event [CORRECT]
C. 50X1-HUM exemption
D. Automatic declassification exemption
Correct Answer: B
Rationale: The 25X exemption permits classification up to 25 years from the date of original classification when
specific criteria apply (such as revealing military plans, intelligence sources/methods, or foreign relations). 25X
requires a specific date or event for declassification. 50X1-HUM and 50X2-WMD have no date or event requirement.
Q9: What is the difference between scheduled declassification and automatic declassification?
A. Scheduled declassification occurs at a specific date set by the OCA; automatic declassification occurs
at 25 years unless exempted [CORRECT]
B. Scheduled declassification applies only to TOP SECRET; automatic declassification applies only to
CONFIDENTIAL
C. There is no difference; both terms describe the same process
D. Automatic declassification occurs after 10 years; scheduled declassification occurs after 25 years
Correct Answer: A
Rationale: Scheduled declassification occurs when information reaches the date or event specified by the OCA at the
time of original classification. Automatic declassification, established by E.O. 13526, occurs 25 years after the original
classification date unless specifically exempted under 50X1-HUM, 50X2-WMD, or 25X with a specific exemption that
requires continued protection.
Q10: Which classified coversheet is used to protect CONFIDENTIAL information?
A. SF-703
B. SF-704
C. SF-705 [CORRECT]
D. SF-706
Correct Answer: C
Rationale: SF-705 is the coversheet for CONFIDENTIAL information. SF-703 covers TOP SECRET, and SF-704
covers SECRET. The numeric sequence reflects the level of sensitivity (lower number = higher classification). SF-706 is
not a standard coversheet designation.
Q11: A cleared employee inadvertently leaves a SECRET document on an unsecured desk overnight in a
controlled area, but the document is recovered the next morning without evidence of compromise. How
should this incident be characterized?
A. Security violation requiring formal investigation
B. Security infraction because it could not reasonably be expected to result in compromise [CORRECT]
C. Unauthorized disclosure requiring mandatory reporting to Congress
D. Classified data spill requiring cyber incident response
Correct Answer: B
Rationale: Per DoD Manual 5200.01, Volume 3, a security infraction is an act that cannot reasonably be expected to
result in loss, compromise, or suspected compromise. A violation, by contrast, does result in or could reasonably be
expected to result in loss or compromise. Since the document was in a controlled area and recovered without evidence
of compromise, this is an infraction requiring documentation but not a formal violation investigation.
SFPC Exam 2026/2027 - Page 4
WITH ACTUAL EXAM QUESTIONS AND CORRECT ANSWERS
(Verified Answers)
SECURITY FUNDAMENTALS PROFESSIONAL CERTIFICATION (SFPC)
REAL EXAM TEST BANK (BRAND NEW!!)
250 Comprehensive Questions with Detailed Rationales
Aligned with 2026-2027 CDSE SFPC Exam Blueprint & DoD Security Competency Framework
Total Questions 250 (Verified)
Info Security | Personnel Security | Physical Security | Industrial Security | General Security |
Sections
Cybersecurity | Integrated Scenarios
DoD Policy Refs DODM 5200.01 series | CJCS Instructions | EO 13526 | NISPOM | SEAD 4 | ICD 705
Question Style 70% scenario-based, 25% direct recall, 5% analysis
Passing Standard 70% (A+ graded content)
Comprehensive Coverage of DoD Security Doctrine, Policy Application, and SFPC Competency Framework
SFPC Exam 2026/2027 - Page 1
,SFPC 2026/2027 | DoD Security Fundamentals | CDSE Aligned
Section 1: Information Security - Questions 1-55
Classification, Declassification, Markings & Safeguarding | E.O. 13526, 32 CFR Parts 2001 & 2003, DoD Manual
5200.01 Volumes 1-4
Q1: An Original Classification Authority (OCA) is determining whether to classify a new intelligence
report. Under E.O. 13526, which of the following is the FIRST requirement that must be met before
information can be classified?
A. The information must be owned by, produced by, or under the control of the U.S. Government
[CORRECT]
B. The information must relate to military plans or weapons systems
C. The information must be reviewed by the Information Security Oversight Office (ISOO)
D. The information must have a classification duration of at least 10 years
Correct Answer: A
Rationale: Per E.O. 13526, information may only be classified if it is owned by, produced by, or under the control of
the U.S. Government AND falls within one or more of the eight classification categories. The other options describe
specific categories or procedures, but the government control requirement is the foundational prerequisite.
Q2: When an OCA classifies information, which of the following is NOT one of the eight categories
under which information may be classified?
A. Military plans, weapons systems, or operations
B. Foreign government information
C. Personal financial information of federal employees [CORRECT]
D. Vulnerabilities or capabilities of systems, installations, infrastructures, or projects
Correct Answer: C
Rationale: The eight categories in Section 1.4 of E.O. 13526 include military plans, foreign government information,
intelligence activities, foreign relations, scientific/technological/economic matters, U.S. Government programs for
safeguarding nuclear materials/facilities, vulnerabilities/capabilities of systems, and weapons of mass destruction.
Personal financial information of federal employees is not a valid classification category.
Q3: A DoD component creates a new document that paraphrases content from three previously
classified source documents. Who is authorized to mark this new document?
A. Any cleared employee who handles the new document
B. A derivative classifier applying the markings from authorized source documents [CORRECT]
C. Only the OCA who originally classified the source documents
D. The Information Security Oversight Office (ISOO)
Correct Answer: B
Rationale: Per DoD Manual 5200.01, Volume 2, derivative classifiers are authorized to incorporate, paraphrase,
restate, or generate new forms of classified information from authorized sources. Authorized sources include Security
Classification Guides (SCGs), properly marked source documents, and DD Form 254. The derivative classifier carries
the same legal responsibility as the OCA for proper classification markings.
SFPC Exam 2026/2027 - Page 2
,SFPC 2026/2027 | DoD Security Fundamentals | CDSE Aligned
Q4: Which of the following is NOT an authorized source for derivative classification?
A. Security Classification Guide (SCG)
B. Properly marked source document
C. Contract Security Classification Specification (DD Form 254)
D. A classified email received from a colleague discussing a classified program [CORRECT]
Correct Answer: D
Rationale: Authorized sources for derivative classification are limited to: (1) Security Classification Guides (SCGs),
(2) properly marked source documents, and (3) Contract Security Classification Specifications (DD Form 254). A
casual email from a colleague, even if classified, is not a properly marked source document in the formal regulatory
sense and may not be used as a derivative classification authority.
Q5: An OCA classifies a document under 25X1 (reveal information that would assist in development of
weapons of mass destruction). What is the maximum duration for which this information can remain
classified?
A. 10 years from the date of the original decision
B. 25 years from the date of the original decision
C. 50 years from the date of the original decision
D. Indefinitely, with review at 25-year intervals [CORRECT]
Correct Answer: D
Rationale: The 25X1 exemption (WMD-related) allows information to remain classified for up to 50 years from the date
of original classification, but in practice, when marked 25X1 with no date or event, the information requires review at
25-year intervals and may be extended. The 50X1-HUM and 50X2-WMD exemptions specifically exempt information
from automatic declassification at 25 years and require continued protection.
Q6: Under E.O. 13526, what is the default classification duration if the OCA cannot determine a specific
date or event for declassification?
A. 5 years from the date of original classification
B. 10 years from the date of original classification [CORRECT]
C. 25 years from the date of original classification
D. 50 years from the date of original classification
Correct Answer: B
Rationale: Per E.O. 13526 Section 1.6(a), if the OCA cannot determine a specific date or event for declassification, the
information shall be marked for declassification 10 years from the date of the original decision, unless the OCA
determines that sensitivity requires a longer duration of up to 25 years under 25X exemptions.
Q7: Which declassification option requires the information to remain classified without a specific date or
event because its release would reveal the identity of a confidential human intelligence source?
A. 50X1-HUM [CORRECT]
B. 50X2-WMD
C. 25X1-human
D. 10X2-source
Correct Answer: A
Rationale: The 50X1-HUM exemption specifically protects information that would reveal the identity of a confidential
human intelligence source. This exemption applies to information 50 years or older and requires no date or event for
declassification. 50X2-WMD applies to weapons of mass destruction information.
SFPC Exam 2026/2027 - Page 3
, SFPC 2026/2027 | DoD Security Fundamentals | CDSE Aligned
Q8: A document is marked 'Declassify X years from date of creation, but in no event beyond 25 years.'
Which declassification exemption was most likely applied?
A. 10-year rule
B. 25X exemption with a date or event [CORRECT]
C. 50X1-HUM exemption
D. Automatic declassification exemption
Correct Answer: B
Rationale: The 25X exemption permits classification up to 25 years from the date of original classification when
specific criteria apply (such as revealing military plans, intelligence sources/methods, or foreign relations). 25X
requires a specific date or event for declassification. 50X1-HUM and 50X2-WMD have no date or event requirement.
Q9: What is the difference between scheduled declassification and automatic declassification?
A. Scheduled declassification occurs at a specific date set by the OCA; automatic declassification occurs
at 25 years unless exempted [CORRECT]
B. Scheduled declassification applies only to TOP SECRET; automatic declassification applies only to
CONFIDENTIAL
C. There is no difference; both terms describe the same process
D. Automatic declassification occurs after 10 years; scheduled declassification occurs after 25 years
Correct Answer: A
Rationale: Scheduled declassification occurs when information reaches the date or event specified by the OCA at the
time of original classification. Automatic declassification, established by E.O. 13526, occurs 25 years after the original
classification date unless specifically exempted under 50X1-HUM, 50X2-WMD, or 25X with a specific exemption that
requires continued protection.
Q10: Which classified coversheet is used to protect CONFIDENTIAL information?
A. SF-703
B. SF-704
C. SF-705 [CORRECT]
D. SF-706
Correct Answer: C
Rationale: SF-705 is the coversheet for CONFIDENTIAL information. SF-703 covers TOP SECRET, and SF-704
covers SECRET. The numeric sequence reflects the level of sensitivity (lower number = higher classification). SF-706 is
not a standard coversheet designation.
Q11: A cleared employee inadvertently leaves a SECRET document on an unsecured desk overnight in a
controlled area, but the document is recovered the next morning without evidence of compromise. How
should this incident be characterized?
A. Security violation requiring formal investigation
B. Security infraction because it could not reasonably be expected to result in compromise [CORRECT]
C. Unauthorized disclosure requiring mandatory reporting to Congress
D. Classified data spill requiring cyber incident response
Correct Answer: B
Rationale: Per DoD Manual 5200.01, Volume 3, a security infraction is an act that cannot reasonably be expected to
result in loss, compromise, or suspected compromise. A violation, by contrast, does result in or could reasonably be
expected to result in loss or compromise. Since the document was in a controlled area and recovered without evidence
of compromise, this is an infraction requiring documentation but not a formal violation investigation.
SFPC Exam 2026/2027 - Page 4
