Introduction to Industrial Security Practice Test

These questions are part of the practice quiz. Start practicing

• Why is network segmentation important in an ICS environment?
• The National Industrial Security Program (NISP) is an optional industry-run program with policy established by cleared contractor facilities. True or False?
• What is a key benefit of network segmentation in an industrial control system environment?
• Which offices have ISFO Headquarters functions according to the material?
• Which of the following is NOT a consideration when classifying data?
• What is the purpose of the least privilege principle in an industrial security context?
• What is the first step of the contracting process?
• Which statement aligns with the material about PCLs and program management?
• To issue a Facility Clearance (FCL), DCSA reviews which of the following?
• Which risk assessment methodology offers a generic framework for risk management and is widely applicable across industries?
• When an employee no longer needs access to classified information, the Facility Security Officer (FSO) needs to do all of the below EXCEPT:
• Which threat source category includes actions like vandalism or terrorism directed at a facility?
• Which step is essential in a security due diligence process for vendors?
• What is one primary function of signage in an industrial security program?
• Which of the following is NOT a common insider threat indicator?
• Which role is staffed by Industrial Security Reps?
• The Defense Counterintelligence and Security Agency (DCSA) does NOT oversee which of the following?
• The National Industrial Security Program (NISP) is described as optional in the material. True or False?
• Which term is used to designate an organization's eligibility to access classified information?
• Which entity administers the National Industrial Security Program on behalf of a Cognizant Security Agency?
• Which agency would perform initial investigations for PCL eligibility in the industrial security context?
• Which of the following is NOT a COR responsibility?
• When an employee no longer needs access to classified information, who is responsible for removing access and debriefing the employee?
• Which of the following describes the outcome of security awareness training?
• When contractors work on a government installation or agency sites, what must they follow?
• PCL stands for which term?
• In the contracting process, which step involves the GCA publishing a Request for Proposal (RFP)?
• Which of the following is a responsibility of an ISSP/SCA?
• In policy lifecycle management, which stage focuses on ensuring ongoing adherence to the policy?
• Which topic is NOT included in the National Industrial Security Program Operating Manual (NISPOM)?
• Who establishes, documents, and monitors classified Information System programs and procedures?
• The policy for NISP is established by cleared contractor facilities. True or False?
• Which contracting document contains security requirements and classification guidance?
• How do passive security measures differ from active measures?
• What is the primary function of DoD 5220.22-M NISPOM?
• Which of the following is a primary responsibility of the DSS?
• What is CPTED primarily concerned with?
• Which of the following trio of roles is typically found on an incident response team?
• DoD 5220.22-M Vol 3, NISP focuses on which topic?
• Who determines the need for a Personnel Security Clearance (PCL)?
• The Statement of Work (SOW) contains which of the following?
• Which of the following is a responsibility of the Insider Threat Program Senior Official (ITPSO)?
• The Contracting Officer's Representative (COR) is authorized to make changes to the contract, even if those changes affect price or quality.
• Which option is NOT a CPTED principle?
• The need for a PCL is determined by the program manager.
• Which regulations ensure security clauses are included in classified contracts?
• What best describes Contracting Officer's Representative (COR)?
• What is the primary purpose of the Statement of Work (SOW)?
• Which agency is responsible for issuing Facility Clearance (FCL) by reviewing information?
• In business continuity planning, what is considered a critical process?
• Identify three primary threat sources to industrial facilities.
• Who provides advice, assistance, and guidance regarding counterintelligence best practices?
• Which role is responsible for receiving reports of security violations and conducting administrative inquiries?
• What is a crisis communication plan, and what does it typically define?
• Who conducts security reviews to ensure a program is in compliance with the NISPOM?
• According to terminated access procedures, what action is the FSO explicitly required to perform with regards to the employee?
• In a crisis, which statement best captures the purpose of a crisis communication plan's defined messaging and channels?
• Who administers and oversees the contractor security program?
• In the industrial context, which statement best differentiates security from privacy?
• The ITPSO determines the PCL clearance level.
• Which of the following roles are filled by contractor employees?
• Which statement accurately describes the roles described in the material?
• Which document explains the classification guidance and security requirements used in DoD contracts?
• Who is typically responsible for approving the information security policy in an organization?
• Which of the following is a security consideration for transporting sensitive materials?
• IS Reps serve as the contractor's primary point of contact for what?
• Which of the following best describes the National Industrial Security Program's primary audience?
• Which organization conducts periodic security reviews of contractor facilities as the CSO for the Department of Defense?
• After a need is identified, the Government Contracting Activity (GCA) __________.
• What is the purpose of a post-incident debrief or after-action review?
• Which entity ensures that cleared industry safeguards classified information in its possession?
• What is the role of the incident commander in emergency response?
• Which entity establishes industrial security programs and oversees security requirements?
• In addition to a need-to-know (NTK), an individual must be granted a ___________ in order to access classified information.
• Which step in contracting process corresponds to GCA defining initial requirements for the product or service?
• How can cyber threats translate into physical security risks in an industrial setting?
• What is a security policy and why is it essential?
• Which statement best describes the principle of least privilege in access control?
• Which of the following is NOT typically used as a security metric?
• An employee's need for a Personnel Security Clearance (PCL) is determined by the program manager, but the clearance level is determined by the __________.
• When cleared contractors visit a cleared facility or government installation, whose security requirements take precedence?
• The DoD security agreement legally binding the U.S. Government and the contractor is which form?
• In risk management for industrial security, what is the role of insurance?
• Which practice helps monitor performance, detect trends, and drive continuous improvement of controls?
• The Cognizant Security Office (CSO) administers the National Industrial Security Program and provides security guidance, oversight, and policy clarifications.
• NISP stands for:
• During classified visits, visitors may supply clearance information via ______________.
• What is the purpose of a security metrics dashboard?
• What is a key consideration for remote access to industrial environments?
• Which statement best reflects the role of the Insider Threat Program Senior Official (ITPSO) in relation to the FSO?
• Which contracting document contains information such as project background, scope, deadlines, and steps for project completion?
• Where are the National Industrial Security Program (NISP) requirements, restrictions, and safeguards that cleared industry must follow outlined?
• What are the four phases of the incident response lifecycle?
• DoD Instruction 5220.22 primarily establishes policy and assigns responsibilities for what?
• If access is removed by the Facility Security Officer (FSO), does the individual's Personnel Security Clearance (PCL) eligibility remain in the Department of Defense personnel security system of record?
• What are the functions of the Cognizant Security Office (CSO)?
• What is the general purpose of regulatory compliance in industrial security?
• The National Industrial Security Program (NISP) is:
• How does human factors engineering contribute to security?
• Which statement best describes RBAC and ABAC?
• Which document governs the security program for contractors under the National Industrial Security Program?
• What is the primary role of a security operations center (SOC) in an industrial environment?
• What does FCL stand for?
• Which of the following best describes the typical layers of fire protection in a facility?
• Which official is primarily responsible for granting initial access to classified information within a facility?
• FSO has ultimate responsibility for what?
• In an industrial security exam, which of the following describes a common incident scenario?
• What form must employees complete in order to initiate the Personnel Security Clearance (PCL) process?
• Access to classified information requires which of the following?
• Which role works with IS Reps and contractor personnel on all matters related to the authorization and maintenance of authorized contractor information systems?
• Before the Government Contracting Activity (GCA) publishes a Request for Proposal (RFP), it must define the initial requirements for the product/service, as well as the acquisition strategy for the contract.
• The Insider Threat Program Senior Official (ITPSO) is responsible for establishing and maintaining what?
• Which metric measures the time from incident onset to detection?
• Which option best describes a layered access control approach in a facility?
• Which of the following roles is filled by a government employee, not a contractor?
• What best describes the purpose of a security vulnerability assessment (SVA)?
• In industrial security, what does Need-to-know refer to?
• Which statement best distinguishes physical security from cybersecurity in an industrial setting?
• Name and briefly describe two common risk assessment methodologies used in industrial security.
• Which statement correctly describes the primary goal of a security vulnerability assessment (SVA)?
• What is the relationship between a Cognizant Security Agency (CSA) and a Cognizant Security Office (CSO)?
• Which document provides the operating manual for National Industrial Security Program requirements?
• Which statement best describes the difference between business continuity planning and disaster recovery?
• By signing the DD Form 441, Department of Defense Security Agreement, the contractor agrees to which of the following? (best single option)
• What describes the purpose of data handling requirements in data classification?
• Which role is responsible for establishing, documenting, maintaining, and monitoring IS security programs and procedures?
• Which agencies are designated as Cognizant Security Agencies (CSAs)?
• During classified visits, which system is used to supply clearance information?
• How does a security risk register support governance?
• A key goal of the NISPOM is to ensure uniform implementation of industrial security requirements across what?
• Which document includes instructions about public disclosure and other security regulations beyond NISPOM?
• What document defines the end-product objectives used in a contract?
• What are three common perimeter security measures for a manufacturing facility?
• What describes the principle of least privilege in access control?
• Who determines an employee's need for a Personnel Security Clearance (PCL)?
• In the contracting process, what does the GCA define in the second step?
• Which organization handles changes in ownership, management, or foreign involvement in cleared facilities?
• The DoD 5220.22-R ISR primarily addresses what aspect?
• Which entity processes facility clearances and monitors FCLs?
• Which form or acronym stands for a government clearance required to access classified information?
• Which role maintains and initiates PCLS and FCLs, provides security education, and conducts self-inspections?
• When processing a Facility Clearance (FCL), the Defense Counterintelligence and Security Agency (DCSA) will:
• Which role serves as the point of contact for security matters within a contractor facility and ensures compliance with the NISPOM?
• The abbreviation FSO stands for which role?
• Why is securing ICS/SCADA networks more challenging than general IT networks?
• Which is a stage in policy lifecycle management?
• Which document provides detailed operating instructions on a number of specific industrial security areas?
• A contractor facility may store classified material as soon as the Facility Clearance (FCL) is granted.
• On an incident response team, which role is primarily responsible for communications?
• Which office carries out DSS assessment and authorization determinations for contractor information systems to process classified information?
• What is the primary role of Cognizant Security Agencies (CSAs)?
• What is the primary function of the Industrial Security Field Office (ISFO)?
• Which of the following is a Facility Security Officer (FSO) responsibility?
• What does the 32 CFR 2004 NISP Implementing Directive primarily provide?
• In remote access security, what is the primary reason for implementing monitoring?
• Which entity is explicitly negated as the determiner of the PCL clearance level in the material?
• Which contracting document records a contractor's commitment to comply with the NISPOM?
• What does DD Form 254 provide?
• What does SOW stand for in contracting?
• What is DD Form 441?
• Differentiate between DAC, MAC, and RBAC.
• What is the purpose of E.O. 12829 in the context of industrial security?
• The abbreviation ISSM stands for which role?
• What does the NISPOM specify for industry?
• The National Industrial Security Program Operating Manual (NISPOM) does which of the following?
• Which statement best describes Personnel Security Clearance (PCL) in relation to the DoD system of record?
• In order to access classified information, an individual must be granted a Personnel Security Clearance (PCL) and have a Need-to-know (NTK).
• Which organization is designated as the CSO for the Department of Defense?
• Cognizant Security Agencies (CSA) have Cognizant Security Offices (CSOs) that administer the National Industrial Security Program on their behalf.
• DD Form 254 does NOT contain which item?
• In order to receive and store classified information, facilities must be granted a Facility Clearance (FCL) and have _________________.
• CISAs provide what kind of support?
• Which agency administers the program that records PCL eligibility for DoD personnel security?
• DD Form 254 is primarily associated with which specification?
• The FCL is an administrative determination of what?
• Which certification is commonly pursued in industrial security to validate knowledge and advance career opportunities?
• In the context of access control, what does RBAC stand for and how does it determine access?
• What is the first step in the PCL process?
• The PSMO-I is responsible for which function?
• What is data classification?
• ISSM must be appointed when there is a contractor-owned classified IS, or a government-owned classified IS at a contractor facility. Which is another duty?
• What does FCL stand for?
• Which responsibility is associated with Counterintelligence Special Agent (CISA) in the material?
• Which of the following describes the purpose of the National Industrial Security Program (NISP)?
• Which activity is performed by the ISSP/SCA?
• Which role is described as overseeing insider threat program activities within cleared facilities?
• Which organization oversees compliance with reporting requirements?
• The DoD personnel security system of record is used to store which type of information?
• Employees must possess a Personnel Security Clearance (PCL) if they:
• Which statement about the NISP is true?
• The administrative determination that, from a security viewpoint, an entity is eligible for access to classified information is called a
• What is the primary purpose of the NISP?
• What is the Industrial Security Field Operations (IFSO) primarily responsible for?
• What is the principle of 'defense in depth' and how is it applied in facility security?
• Which of the following is a Contracting Officer (CO) responsibility?
• Which of the following roles is filled by a government employee?
• Where does an individual's PCL eligibility reside after access is removed?
• What is a Contracting Officer (CO)?
• The fourth step of contracting process involves what action by GCA?
• Why might a professional pursue CPP or PSP certifications in industrial security?
• Which statement accurately reflects COR responsibilities?
• Which form relates to contract security classification?
• Which office coordinates with DoD components and administers the National Industrial Security Program?
• Which agency is responsible for overseeing the National Industrial Security Program and related security activities?
• The Facility Clearance (FCL) will not be granted until the following individuals are granted a Personnel Security Clearance (PCL). Which of the following are included?
• What does the acronym GCA stand for in this context?
• Why is maintaining security incident documentation important?
• Which item is NOT a typical component of a crisis communication plan?
• What is one primary role of the Government Contracting Activity (GCA)?
• Which sequence correctly represents the PCL process steps?
• What is an appropriate response to suspected access control violations?
• Who records the Personnel Security Clearance (PCL) eligibility level in the DoD personnel security system of record?
• Which statement best describes the primary function of risk transfer through insurance in industrial security?
• The Cognizant Security Office (CSO) does NOT do which of the following?
• The National Industrial Security Program Operating Manual (NISPOM) outlines the requirements, restrictions, and safeguards for cleared industry.
• Which phase of incident response involves learning from the incident and improving security to prevent recurrence?
• In business continuity planning, which analysis identifies critical functions and recovery objectives?
• Who performs classified Information System assessments?
• Which document would you reference as the primary source of background information including objective, scope, deadlines, and steps for a contract?
• What information should be included in an initial incident report?
• In the PCL process, which entity grants and records the PCC?
• What is the primary function of the ITPSO?
• Which agency oversees Personnel Security Clearances (PCLs)?
• Which statement describes ABAC decision making?
• What describes a layered access control approach in a facility?
• Which statement best describes a well-implemented security policy's scope?
• The Facility Clearance (FCL) will not be granted until which individuals are granted a Personnel Security Clearance (PCL)?
• Which document guides safeguarding of classified information in government-industry relations?
• What is the difference between backups and disaster recovery in an industrial setting?
• Which of the following is a responsibility of the Defense Counterintelligence and Security Agency (DCSA) in the NISP framework?
• What is the first step in the National Industrial Security Program (NISP) contracting process?
• Which body is responsible for overseeing and administering security requirements within its purview?
• What is the principle of dual-use security in industrial contexts?
• Enforcing the principle of least privilege primarily reduces which risk?
• Which role is NOT described as providing counterintelligence best-practices guidance to IS Reps?
• Which statement correctly contrasts a vulnerability assessment with a penetration test?
• What is the purpose of chain of custody during transport of sensitive materials?
• Who holds security cognizance when contract work is performed at a contractor's own cleared facility or at another cleared contractor site?
• Which agency has been designated as the Cognizant Security Office (CSO) for the Department of Defense and more than thirty other non‑DOD agencies?
• Which document governs contractors operating their own information systems under NISPOM?