FY 2026 Cyber Awareness Challenge Knowledge Check with Correct Answers
Based on the description provided, how many insider threat indicators are present? Jean is a long-term
government employee who recently transferred from one agency to another to take a supervisory role. As part
of her transition, Jean requires a higher level of access to sensitive information. - ans2
Evelyn is a system administrator at her agency. As part of her duties, she occasionally uses a thumb drive to
perform necessary system tasks, as outlined in her agency's procedures. The thumb drive is provided by the
Government for this purpose. Is this an appropriate use of removable media? - ansYes. Only use removable
media when operationally necessary, Government-owned, and approved in accordance with policy
How can you identify the separation of Sensitive Compartmented Information (SCI) classified material from
collateral classified material? - ansMarkings that identify the compartment with which it is affiliated.
How can you protect your home computer? - ansScan files for viruses.
How do Insider Threat Programs defend against insider threats? - ansIntervening early to help individuals with
issues
How should you approach a compressed URL, such as Tiny URL? - ansPreview where the link leads before
opening it.
In what level of system can you use a SIPRNet public key infrastructure (PKI) token? - ansSIPRNet
On a Government-owned mobile device, what should you do before installing an application? - ansEnsure that
it is an approved and authorized application.
Oscar is on official Government travel with a Government-issued laptop. While at the airport he uses the laptop
to work on a report containing controlled unclassified information (CUI). For connectivity, he uses his personal
phone as a mobile hotspot. Are there any security concerns? - ansYes. He should be vigilant for "shoulder
surfing," where others may be able to view the information on his screen.
,Paula is compiling statistics on healthcare provided to Service members over the last fiscal year. Some of her
source data includes Protected Health Information (PHI). How can she properly process this data? - ansUse an
encrypted device that requires a passcode or biometrics to unlock
Sara is a government employee with a high degree of expertise in her field. She receives an e-mail from a
foreign national that is complimentary of Sara's expertise and seeks to make a connection with her to learn
more about her work. What should Sara do? - ansReport the contact to her security POC
Trisha receives an e-mail with a sensational rumor about a celebrity's personal life. Which of the following
actions should Trisha NOT take with the e-mail? - ansForward it
Under which Cyberspace Protection Condition (CPCON) is the priority focuse limited to critical and essential
functions? - ansCPCON 1
Walter shares a link to a news article about the Department of Defense on his social media. Along with the link,
he states that he disagrees with the reporting in the article as a DoD employee. Does this pose a security
concern? - ansYes. Walter should avoid appearing to speak on behalf of the Government
What is a risk to Government systems posed by removable media? - ansTheir data storage and ability to
connect to systems can lead to unintended transfers of information, such as introduction of malicious code or
spillage.
What is Controlled Unclassified Information (CUI)? - ansInformation that belongs to a category established in
the DoD CUI Registry
What risk is posed by Internet of Things (IoT) devices? - ansTheir connectivity can be exploited as an attack
vector to any other device on the same network.
What should you do with your badge within a Sensitive Compartmented Information Facility (SCIF)? - ansWear
it visibly and above the waist
Which of the following is a best practice to protect your identity? - ansMonitor your financial statements and
,credit reports.
Which of the following is an allowed use of a government-furnished smartphone? - ansResponding to e-mails
on your government e-mail account
Which of the following is an example of a correct way to protect classified data? - ansAndrea verifies need-to-
know and security eligibility before sharing classified information.
Which of the following is an example of Protected Health Information (PHI)? - ansAn individual's medical
records maintained by a healthcare provider.
While scrolling your social media feed, you are presented with a news article with an incendiary headline
accompanied by a video. What should you consider before sharing this article? - ansYou should consider the
source and whether this information appears elsewhere.
You receive a suspicious e-mail that appears to have come from an organization that partners with your
agency. Your co-workers have received a similar e-mail. What might this be? - ansSpear phishing
You receive an e-mail with a link to verify that your account is active. It says you must click the link within 2
days. Your IT department has not sent links like this in the past. The e-mail is not digitally signed. What action
should you take? - ansReport the e-mail to your security POC or help deskA PHR is an ___ record of health and
medical information, which ___ be maintained by the client? - anselectronic, can
Access - ansclients have the right to access their personal health information
Accuracy - ansclients have the right to correct or amend health information
Because of ePrescribing, pharmacy staff can spend more time? - anshelping clients with their medical needs
Benefits of using a PHR include - ansClients information is stored in one place
, Clients PHR can be incorporated with a client's healthcare providers records
Check to make sure all information is ___ and ______ - ansaccurate, complete
Clients privacy rights include: access, disclosure, accuracy, notice and complaint? - ansTrue
Compliant - ansclients have the right to file a complaint a Health Insurance Portability Act violations
Disclosure - ansclients have the right to know who their personal health information has been shared with
Doctor's Referral- Referral requests and instructions are easily accessible when handled electronically. -
ansTrue
ePrescribing is - anselectronic prescribing
ePrescribing reduces errors due to hard to read prescriptions? - ansTrue
Explain what an EHR System is - ansa digitial version of paper
Have their medical history ______ in case they change doctors or visit a specialist - ansavailable
Health Info Tech - ansIs the application of technology in the healthcare industry.
HITECH stands for - ansHealth Information Technology for Economic and Clinical Health
Keep track of all______ and dosages - ansmedications
Based on the description provided, how many insider threat indicators are present? Jean is a long-term
government employee who recently transferred from one agency to another to take a supervisory role. As part
of her transition, Jean requires a higher level of access to sensitive information. - ans2
Evelyn is a system administrator at her agency. As part of her duties, she occasionally uses a thumb drive to
perform necessary system tasks, as outlined in her agency's procedures. The thumb drive is provided by the
Government for this purpose. Is this an appropriate use of removable media? - ansYes. Only use removable
media when operationally necessary, Government-owned, and approved in accordance with policy
How can you identify the separation of Sensitive Compartmented Information (SCI) classified material from
collateral classified material? - ansMarkings that identify the compartment with which it is affiliated.
How can you protect your home computer? - ansScan files for viruses.
How do Insider Threat Programs defend against insider threats? - ansIntervening early to help individuals with
issues
How should you approach a compressed URL, such as Tiny URL? - ansPreview where the link leads before
opening it.
In what level of system can you use a SIPRNet public key infrastructure (PKI) token? - ansSIPRNet
On a Government-owned mobile device, what should you do before installing an application? - ansEnsure that
it is an approved and authorized application.
Oscar is on official Government travel with a Government-issued laptop. While at the airport he uses the laptop
to work on a report containing controlled unclassified information (CUI). For connectivity, he uses his personal
phone as a mobile hotspot. Are there any security concerns? - ansYes. He should be vigilant for "shoulder
surfing," where others may be able to view the information on his screen.
,Paula is compiling statistics on healthcare provided to Service members over the last fiscal year. Some of her
source data includes Protected Health Information (PHI). How can she properly process this data? - ansUse an
encrypted device that requires a passcode or biometrics to unlock
Sara is a government employee with a high degree of expertise in her field. She receives an e-mail from a
foreign national that is complimentary of Sara's expertise and seeks to make a connection with her to learn
more about her work. What should Sara do? - ansReport the contact to her security POC
Trisha receives an e-mail with a sensational rumor about a celebrity's personal life. Which of the following
actions should Trisha NOT take with the e-mail? - ansForward it
Under which Cyberspace Protection Condition (CPCON) is the priority focuse limited to critical and essential
functions? - ansCPCON 1
Walter shares a link to a news article about the Department of Defense on his social media. Along with the link,
he states that he disagrees with the reporting in the article as a DoD employee. Does this pose a security
concern? - ansYes. Walter should avoid appearing to speak on behalf of the Government
What is a risk to Government systems posed by removable media? - ansTheir data storage and ability to
connect to systems can lead to unintended transfers of information, such as introduction of malicious code or
spillage.
What is Controlled Unclassified Information (CUI)? - ansInformation that belongs to a category established in
the DoD CUI Registry
What risk is posed by Internet of Things (IoT) devices? - ansTheir connectivity can be exploited as an attack
vector to any other device on the same network.
What should you do with your badge within a Sensitive Compartmented Information Facility (SCIF)? - ansWear
it visibly and above the waist
Which of the following is a best practice to protect your identity? - ansMonitor your financial statements and
,credit reports.
Which of the following is an allowed use of a government-furnished smartphone? - ansResponding to e-mails
on your government e-mail account
Which of the following is an example of a correct way to protect classified data? - ansAndrea verifies need-to-
know and security eligibility before sharing classified information.
Which of the following is an example of Protected Health Information (PHI)? - ansAn individual's medical
records maintained by a healthcare provider.
While scrolling your social media feed, you are presented with a news article with an incendiary headline
accompanied by a video. What should you consider before sharing this article? - ansYou should consider the
source and whether this information appears elsewhere.
You receive a suspicious e-mail that appears to have come from an organization that partners with your
agency. Your co-workers have received a similar e-mail. What might this be? - ansSpear phishing
You receive an e-mail with a link to verify that your account is active. It says you must click the link within 2
days. Your IT department has not sent links like this in the past. The e-mail is not digitally signed. What action
should you take? - ansReport the e-mail to your security POC or help deskA PHR is an ___ record of health and
medical information, which ___ be maintained by the client? - anselectronic, can
Access - ansclients have the right to access their personal health information
Accuracy - ansclients have the right to correct or amend health information
Because of ePrescribing, pharmacy staff can spend more time? - anshelping clients with their medical needs
Benefits of using a PHR include - ansClients information is stored in one place
, Clients PHR can be incorporated with a client's healthcare providers records
Check to make sure all information is ___ and ______ - ansaccurate, complete
Clients privacy rights include: access, disclosure, accuracy, notice and complaint? - ansTrue
Compliant - ansclients have the right to file a complaint a Health Insurance Portability Act violations
Disclosure - ansclients have the right to know who their personal health information has been shared with
Doctor's Referral- Referral requests and instructions are easily accessible when handled electronically. -
ansTrue
ePrescribing is - anselectronic prescribing
ePrescribing reduces errors due to hard to read prescriptions? - ansTrue
Explain what an EHR System is - ansa digitial version of paper
Have their medical history ______ in case they change doctors or visit a specialist - ansavailable
Health Info Tech - ansIs the application of technology in the healthcare industry.
HITECH stands for - ansHealth Information Technology for Economic and Clinical Health
Keep track of all______ and dosages - ansmedications
