SECURITY FUNDAMENTALS PROFESSIONAL MAIN EXAM 2025/2026
QUESTIONS WITH SOLUTIONS GRADED A+
✔✔Steps of the OPSEC process - ✔✔1. Identify critical information
2. Analyze threats and adversaries
3. Analyze vulnerabilities
4. Conduct risk assessment
5. Choose/apply countermeasures
✔✔Operational and logistical countermeasures (OPSEC) - ✔✔Randomize the
performance of functions and operational missions
✔✔Technical countermeasures (OPSEC) - ✔✔Limit nonsecure computer e-mail
messages to nonmilitary activities. Do not provide operational information in nonsecure
e-mail messages.
✔✔Criteria for OPSEC survey assessment - ✔✔1. Purpose
2. Scale
3. Frequency
4. Resources
5. Design
✔✔Information Assurance (IA) - ✔✔Measures that protect and defend information and
information systems by ensuring their availability, integrity, authentication,
confidentiality, and non-repudiation
✔✔Information Owner (IO) responsibilities during the categorize system step of RMF -
✔✔Identifies the potential impact (low, moderate, or high) resulting from loss of
confidentiality, integrity, and availability if a security breach occurs
✔✔Categories of information technology in RMF - ✔✔1. Platform Information
Technology (PIT)
2. PIT Systems
3. Information Technology Services
4. Information Technology Products
5. Information systems
✔✔Security Authorization package - ✔✔1. Security Assessment Report
2. Plan of Action and Milestones (POA&M)
3. Security Plan
✔✔Loss of availability - ✔✔The IS, network, and/or data are unavailable to authorized
users, and missions or operations cannot be performed
, ✔✔Loss of confidentiality - ✔✔The data may be available in an electronic form to users
who are not authorized to receive it
✔✔Loss of integrity - ✔✔The data can no longer be trusted to be reliable or accurate
✔✔Authorizing Official (AO) - ✔✔A designated senior manager who reviews a
certification report and makes the decision to approve the system for implementation
✔✔Classification by compilation - ✔✔Combining or associating unclassified individual
elements of information with one classification level to reveal additional association or
relationship that warrants a classified level of protection
✔✔Derivative classification - ✔✔Incorporating, paraphrasing, restating, or generating in
a new form any information that is already classified and then marking the newly
developed material consistent with guidance from the SCG
✔✔DD Form 254 - ✔✔Contract Security Classification Specification - specifies security
requirements of the contract, covers clearance and access requirements, authorizes
contractor to generate classified information
✔✔Statement of Work (SOW) - ✔✔A document that is provided by the government to
the contractor which outlines in detail what will be required to complete a contract
✔✔DD Form 441 - ✔✔DoD Security Agreement - a legally binding document between
the government and the cleared contract that performs the work
✔✔SF 328 - ✔✔Certificate pertaining to Foreign Influence
✔✔Elements to obtaining a facility clearance - ✔✔1. Sponsorship
2. Security Agreement
3. Organization
4. A certificate pertaining to foreign interests
5. Key management personnel clearances
✔✔Systems of declassification - ✔✔1. Scheduled
2. Automatic
3. Mandatory
4. Systematic
✔✔PSI reports destruction timeline - ✔✔Must be destroyed by DoD recipient
organizations within 90 days following completion of the necessary security
determination
QUESTIONS WITH SOLUTIONS GRADED A+
✔✔Steps of the OPSEC process - ✔✔1. Identify critical information
2. Analyze threats and adversaries
3. Analyze vulnerabilities
4. Conduct risk assessment
5. Choose/apply countermeasures
✔✔Operational and logistical countermeasures (OPSEC) - ✔✔Randomize the
performance of functions and operational missions
✔✔Technical countermeasures (OPSEC) - ✔✔Limit nonsecure computer e-mail
messages to nonmilitary activities. Do not provide operational information in nonsecure
e-mail messages.
✔✔Criteria for OPSEC survey assessment - ✔✔1. Purpose
2. Scale
3. Frequency
4. Resources
5. Design
✔✔Information Assurance (IA) - ✔✔Measures that protect and defend information and
information systems by ensuring their availability, integrity, authentication,
confidentiality, and non-repudiation
✔✔Information Owner (IO) responsibilities during the categorize system step of RMF -
✔✔Identifies the potential impact (low, moderate, or high) resulting from loss of
confidentiality, integrity, and availability if a security breach occurs
✔✔Categories of information technology in RMF - ✔✔1. Platform Information
Technology (PIT)
2. PIT Systems
3. Information Technology Services
4. Information Technology Products
5. Information systems
✔✔Security Authorization package - ✔✔1. Security Assessment Report
2. Plan of Action and Milestones (POA&M)
3. Security Plan
✔✔Loss of availability - ✔✔The IS, network, and/or data are unavailable to authorized
users, and missions or operations cannot be performed
, ✔✔Loss of confidentiality - ✔✔The data may be available in an electronic form to users
who are not authorized to receive it
✔✔Loss of integrity - ✔✔The data can no longer be trusted to be reliable or accurate
✔✔Authorizing Official (AO) - ✔✔A designated senior manager who reviews a
certification report and makes the decision to approve the system for implementation
✔✔Classification by compilation - ✔✔Combining or associating unclassified individual
elements of information with one classification level to reveal additional association or
relationship that warrants a classified level of protection
✔✔Derivative classification - ✔✔Incorporating, paraphrasing, restating, or generating in
a new form any information that is already classified and then marking the newly
developed material consistent with guidance from the SCG
✔✔DD Form 254 - ✔✔Contract Security Classification Specification - specifies security
requirements of the contract, covers clearance and access requirements, authorizes
contractor to generate classified information
✔✔Statement of Work (SOW) - ✔✔A document that is provided by the government to
the contractor which outlines in detail what will be required to complete a contract
✔✔DD Form 441 - ✔✔DoD Security Agreement - a legally binding document between
the government and the cleared contract that performs the work
✔✔SF 328 - ✔✔Certificate pertaining to Foreign Influence
✔✔Elements to obtaining a facility clearance - ✔✔1. Sponsorship
2. Security Agreement
3. Organization
4. A certificate pertaining to foreign interests
5. Key management personnel clearances
✔✔Systems of declassification - ✔✔1. Scheduled
2. Automatic
3. Mandatory
4. Systematic
✔✔PSI reports destruction timeline - ✔✔Must be destroyed by DoD recipient
organizations within 90 days following completion of the necessary security
determination
