CYBER AWARENESS
CHALLENGE EXAM QUESTIONS
AND ANSWERS 2026 - 2027
Which is a risk associated with removable media? - ANSWERS-
Spillage of classified information.
What can malicious code do? - ANSWERS-it can cause damage by
corrupting files, erasing your hard drive, and/or allowing hackers
access.
What is a valid response when identity theft occurs? - ANSWERS-
Report the crime to local law enforcement.
Which may be a security issue with compressed URLs? - ANSWERS-
They may be used to mask malicious intent.
What helps protect from spear phishing? - ANSWERS-Be wary of
suspicious e-mails that use your name and/or appear to come from
inside your organization.
What is whaling? - ANSWERS-A type of phishing targeted at high-
end personnel such as senior officials.
,Upon connecting your Government-issued laptop to a public wireless
connection, what should you immediately do? - ANSWERS-Connect
to the Government Virtual Private Network (VPN).
Under what circumstances is it acceptable to use your Government-
furnished computer to check personal e-mail and do other non-work
related activities? - ANSWERS-If allowed by organizational policy.
Which is a wireless technology that enables your electronic devices to
establish communications and exchange information when placed
next to each other called? - ANSWERS-Near field communication
(NFC).
Which is a rule for removable media, other portable electronic devices
(PEDs), and mobile computing devices to protect Government
systems? - ANSWERS-Do not use any personally owned/non-
organizational removable media on your organization's systems.
What is a good practice to protect data on your home wireless
systems? - ANSWERS-Ensure that the wireless security features are
properly configured.
Which of the following is a good practice to aid in preventing
spillage? - ANSWERS-Be aware of classification markings and all
handling caveats.
,What is the best response if you find classified government data on
the internet? - ANSWERS-Note any identifying information, such as
the website's URL, and report the situation to your security POC.
What is required for an individual to access classified data? -
ANSWERS-Appropriate clearance; signed and approved non-
disclosure agreement; and need-to-know
When classified data is not in use, how can you protect it? -
ANSWERS-store classified data appropriately in a GSA- approved
vault/container when not in use.
which of the following practices reduces the chance of becoming a
target by adversaries seeking information? - ANSWERS-Don't talk
about work outside your workspace unless it is a specifically
designated public meeting environment and is controlled by the event
planners.
Why might "insiders' be able to cause damage to their organizations
more easily than others? - ANSWERS-Insiders are given a level of
trust and have authorized access to government information systems.
Which scenario might indicate a reportable insider threat security
incident? - ANSWERS-A coworker is observed using a personal
electronic device in an area where their use is prohibited.
, which represents a security best practice when using social
networking? - ANSWERS-Understanding and using all available
privacy settings.
When is the best time to post details of your vacation activities on
your social networking website? - ANSWERS-When your vacation is
over, and you have returned home.
What must you do when e-mailing Personally Identifiable
Information (PII) or Protected Health Information (PHI)? -
ANSWERS-Encrypt the e-mail and use your Government e-mail
account.
What is the best example of Protected Health information (PHI)? -
ANSWERS-Your health insurance explanation of benefits (EOB).
Under what circumstances could unclassified information be
considered a threat to national security? - ANSWERS-If aggregated,
the information could become classified.
What is a good practice for physical security? - ANSWERS-
Challenge people without proper badges.
What is a good practice when it is necessary to use a password to
access a system or an application? - ANSWERS-Avoid using the same
password between systems or applications.
CHALLENGE EXAM QUESTIONS
AND ANSWERS 2026 - 2027
Which is a risk associated with removable media? - ANSWERS-
Spillage of classified information.
What can malicious code do? - ANSWERS-it can cause damage by
corrupting files, erasing your hard drive, and/or allowing hackers
access.
What is a valid response when identity theft occurs? - ANSWERS-
Report the crime to local law enforcement.
Which may be a security issue with compressed URLs? - ANSWERS-
They may be used to mask malicious intent.
What helps protect from spear phishing? - ANSWERS-Be wary of
suspicious e-mails that use your name and/or appear to come from
inside your organization.
What is whaling? - ANSWERS-A type of phishing targeted at high-
end personnel such as senior officials.
,Upon connecting your Government-issued laptop to a public wireless
connection, what should you immediately do? - ANSWERS-Connect
to the Government Virtual Private Network (VPN).
Under what circumstances is it acceptable to use your Government-
furnished computer to check personal e-mail and do other non-work
related activities? - ANSWERS-If allowed by organizational policy.
Which is a wireless technology that enables your electronic devices to
establish communications and exchange information when placed
next to each other called? - ANSWERS-Near field communication
(NFC).
Which is a rule for removable media, other portable electronic devices
(PEDs), and mobile computing devices to protect Government
systems? - ANSWERS-Do not use any personally owned/non-
organizational removable media on your organization's systems.
What is a good practice to protect data on your home wireless
systems? - ANSWERS-Ensure that the wireless security features are
properly configured.
Which of the following is a good practice to aid in preventing
spillage? - ANSWERS-Be aware of classification markings and all
handling caveats.
,What is the best response if you find classified government data on
the internet? - ANSWERS-Note any identifying information, such as
the website's URL, and report the situation to your security POC.
What is required for an individual to access classified data? -
ANSWERS-Appropriate clearance; signed and approved non-
disclosure agreement; and need-to-know
When classified data is not in use, how can you protect it? -
ANSWERS-store classified data appropriately in a GSA- approved
vault/container when not in use.
which of the following practices reduces the chance of becoming a
target by adversaries seeking information? - ANSWERS-Don't talk
about work outside your workspace unless it is a specifically
designated public meeting environment and is controlled by the event
planners.
Why might "insiders' be able to cause damage to their organizations
more easily than others? - ANSWERS-Insiders are given a level of
trust and have authorized access to government information systems.
Which scenario might indicate a reportable insider threat security
incident? - ANSWERS-A coworker is observed using a personal
electronic device in an area where their use is prohibited.
, which represents a security best practice when using social
networking? - ANSWERS-Understanding and using all available
privacy settings.
When is the best time to post details of your vacation activities on
your social networking website? - ANSWERS-When your vacation is
over, and you have returned home.
What must you do when e-mailing Personally Identifiable
Information (PII) or Protected Health Information (PHI)? -
ANSWERS-Encrypt the e-mail and use your Government e-mail
account.
What is the best example of Protected Health information (PHI)? -
ANSWERS-Your health insurance explanation of benefits (EOB).
Under what circumstances could unclassified information be
considered a threat to national security? - ANSWERS-If aggregated,
the information could become classified.
What is a good practice for physical security? - ANSWERS-
Challenge people without proper badges.
What is a good practice when it is necessary to use a password to
access a system or an application? - ANSWERS-Avoid using the same
password between systems or applications.
