SECURITY FUNDAMENTALS
PROFESSIONAL CERTIFICATION (SFPC)
EXAM 300 ACTUAL QUESTIONS AND
CORRECT ANSWERS WITH RATIONALE
LATEST UPDATE
Section 1: Information Security (1–90)
1. What is the definition of non-repudiation in information security?
A. Protection against an individual falsely denying having performed a particular
action
B. Preserving authorized restrictions on information access and disclosure
C. The process of determining the potential impact of a security breach
D. The unauthorized disclosure of classified information
Answer: A
Rationale: Non-repudiation provides the capability to determine whether a given
individual took a particular action such as creating information, sending a message,
approving information, or receiving a message. B describes confidentiality. C
describes system categorization. D describes a data spill.
2. Which of the following best describes the impact of a cybersecurity lapse on
non-repudiation?
A. The sender could deny the message was sent
B. Unauthorized persons could gain access to classified information
C. Information could be modified without detection
D. The system could become unavailable to users
Answer: A
,Rationale: Without non-repudiation, a sender could deny that a message was sent,
and a recipient could change a message and contest that the altered version was the
original. B describes a confidentiality breach. C relates to integrity. D relates to
availability.
3. What is the definition of confidentiality in information security?
A. Preserving authorized restrictions on information access and disclosure
B. Protection against an individual falsely denying an action
C. The process of categorizing information systems
D. The unauthorized transmission of classified information
Answer: A
Rationale: Confidentiality means preserving authorized restrictions on information
access and disclosure, including means for protecting personal privacy and
proprietary information. B describes non-repudiation. C describes system
categorization. D describes a data spill.
4. Which of the following is a negative impact of a cybersecurity lapse on
confidentiality?
A. Persons could be granted access to information beyond their need-to-know
B. The sender could deny sending a message
C. Data could be altered without detection
D. The system could crash
Answer: A
Rationale: A confidentiality breach means unauthorized persons gain access to
information they should not see, violating need-to-know principles.
5. What is the definition of integrity in information security?
A. Guarding against improper information modification or destruction
B. Preserving authorized restrictions on access
C. Protection against false denial of an action
D. Ensuring timely and reliable access to information
Answer: A
,Rationale: Integrity means guarding against improper information modification or
destruction and includes ensuring information non-repudiation and authenticity.
6. What is the definition of availability in information security?
A. Ensuring timely and reliable access to and use of information
B. Preserving authorized restrictions on access
C. Guarding against improper modification
D. Protection against false denial of an action
Answer: A
Rationale: Availability ensures that information and systems are accessible to
authorized users when needed.
7. What is system categorization?
A. The process of determining the potential impact of a security breach on
confidentiality, integrity, and availability
B. The process of assigning security clearances
C. The process of destroying classified information
D. The process of encrypting data
Answer: A
Rationale: System categorization is the process by which the Information Owner
identifies the potential impact (low, moderate, or high) that would result from the
loss of confidentiality, integrity, and availability should a security breach occur.
8. What is a data spill?
A. The unauthorized transfer of classified information to an information system not
accredited for that level
B. The accidental deletion of data
C. The encryption of sensitive data
D. The backup of critical files
Answer: A
, Rationale: A data spill occurs when classified information is transferred to a
system not authorized to process it at that classification level. Examples include
classified email sent to an unclassified network or classified documents uploaded
to an unclassified system.
9. What is an Original Classification Authority (OCA)?
A. An individual authorized to make initial classification determinations
B. An individual who declassifies information
C. An individual who destroys classified information
D. An individual who encrypts classified information
Answer: A
Rationale: An OCA is an individual authorized in writing to make initial
classification determinations on behalf of the U.S. Government.
10. Which of the following is a derivative classification action?
A. Incorporating, paraphrasing, restating, or generating information already
classified
B. Making an initial classification decision
C. Declassifying information
D. Destroying classified information
Answer: A
Rationale: Derivative classification involves incorporating, paraphrasing, restating,
or generating in a new form information that is already classified and marking the
newly developed material consistent with the source information.
11. What is a Security Classification Guide (SCG)?
A. A document that specifies classification levels, special requirements, and
declassification instructions for classified programs
B. A document that lists all classified documents
C. A document that authorizes security clearances
D. A document that describes encryption algorithms
Answer: A
PROFESSIONAL CERTIFICATION (SFPC)
EXAM 300 ACTUAL QUESTIONS AND
CORRECT ANSWERS WITH RATIONALE
LATEST UPDATE
Section 1: Information Security (1–90)
1. What is the definition of non-repudiation in information security?
A. Protection against an individual falsely denying having performed a particular
action
B. Preserving authorized restrictions on information access and disclosure
C. The process of determining the potential impact of a security breach
D. The unauthorized disclosure of classified information
Answer: A
Rationale: Non-repudiation provides the capability to determine whether a given
individual took a particular action such as creating information, sending a message,
approving information, or receiving a message. B describes confidentiality. C
describes system categorization. D describes a data spill.
2. Which of the following best describes the impact of a cybersecurity lapse on
non-repudiation?
A. The sender could deny the message was sent
B. Unauthorized persons could gain access to classified information
C. Information could be modified without detection
D. The system could become unavailable to users
Answer: A
,Rationale: Without non-repudiation, a sender could deny that a message was sent,
and a recipient could change a message and contest that the altered version was the
original. B describes a confidentiality breach. C relates to integrity. D relates to
availability.
3. What is the definition of confidentiality in information security?
A. Preserving authorized restrictions on information access and disclosure
B. Protection against an individual falsely denying an action
C. The process of categorizing information systems
D. The unauthorized transmission of classified information
Answer: A
Rationale: Confidentiality means preserving authorized restrictions on information
access and disclosure, including means for protecting personal privacy and
proprietary information. B describes non-repudiation. C describes system
categorization. D describes a data spill.
4. Which of the following is a negative impact of a cybersecurity lapse on
confidentiality?
A. Persons could be granted access to information beyond their need-to-know
B. The sender could deny sending a message
C. Data could be altered without detection
D. The system could crash
Answer: A
Rationale: A confidentiality breach means unauthorized persons gain access to
information they should not see, violating need-to-know principles.
5. What is the definition of integrity in information security?
A. Guarding against improper information modification or destruction
B. Preserving authorized restrictions on access
C. Protection against false denial of an action
D. Ensuring timely and reliable access to information
Answer: A
,Rationale: Integrity means guarding against improper information modification or
destruction and includes ensuring information non-repudiation and authenticity.
6. What is the definition of availability in information security?
A. Ensuring timely and reliable access to and use of information
B. Preserving authorized restrictions on access
C. Guarding against improper modification
D. Protection against false denial of an action
Answer: A
Rationale: Availability ensures that information and systems are accessible to
authorized users when needed.
7. What is system categorization?
A. The process of determining the potential impact of a security breach on
confidentiality, integrity, and availability
B. The process of assigning security clearances
C. The process of destroying classified information
D. The process of encrypting data
Answer: A
Rationale: System categorization is the process by which the Information Owner
identifies the potential impact (low, moderate, or high) that would result from the
loss of confidentiality, integrity, and availability should a security breach occur.
8. What is a data spill?
A. The unauthorized transfer of classified information to an information system not
accredited for that level
B. The accidental deletion of data
C. The encryption of sensitive data
D. The backup of critical files
Answer: A
, Rationale: A data spill occurs when classified information is transferred to a
system not authorized to process it at that classification level. Examples include
classified email sent to an unclassified network or classified documents uploaded
to an unclassified system.
9. What is an Original Classification Authority (OCA)?
A. An individual authorized to make initial classification determinations
B. An individual who declassifies information
C. An individual who destroys classified information
D. An individual who encrypts classified information
Answer: A
Rationale: An OCA is an individual authorized in writing to make initial
classification determinations on behalf of the U.S. Government.
10. Which of the following is a derivative classification action?
A. Incorporating, paraphrasing, restating, or generating information already
classified
B. Making an initial classification decision
C. Declassifying information
D. Destroying classified information
Answer: A
Rationale: Derivative classification involves incorporating, paraphrasing, restating,
or generating in a new form information that is already classified and marking the
newly developed material consistent with the source information.
11. What is a Security Classification Guide (SCG)?
A. A document that specifies classification levels, special requirements, and
declassification instructions for classified programs
B. A document that lists all classified documents
C. A document that authorizes security clearances
D. A document that describes encryption algorithms
Answer: A
