SAPPC CERTIFICATION EXAM VERSION A AND STUDY GUIDE LATEST
UPDATE THIS YEAR WITH OVER 400 QUESTIONS AND CORRECT
ANSWERS JUST RELEASED
SAPPC CERTIFICATION EXAM
QUESTION: Explain how the adjudication process contributes to effective risk management of
DoD assets - ANSWER-Determines an individual's loyalty, reliability, and trustworthiness are in
the best interest of national security
QUESTION: Explain why access control measures are contingent on Force Protection Conditions
- ANSWER-The Force Protection Conditions determine the amount of control measures needed
to be taken in response to various levels of threats against military facilities or installations.
QUESTION: Define the purpose and function of the militarily critical technologies list (MCTL) -
ANSWER-Serves as a technical reference for the development and implementation of DoD
technology, security policies on international transfers of defense-related goods, services, and
technologies as administered by the Director, Defense Technology Security Administration
(DTSA).
QUESTION: Describe how authorization of Limited Access Authority impacts risk to DoD assets -
ANSWER-Increases risk by allowing a foreign national access to classified information. Reduces
risk by ensuring Foreign Nationals with a unique or unusual skills set have been properly
investigated, adjudicated or vetted before being granted access to specific pieces of classified
information only.
1
,Page 2 of 141
QUESTION: List three different types of threats to classified information - ANSWER-(1) Insider
threat
(2) Foreign Intelligence entities
(3) Cybersecurity Threat
Describe the purpose, intent, and security professional's role in each step of the Command
Cyber Readiness Inspections (CCRI) process - ANSWER-Defining the scope, the inspection phase,
documentation of observations, and reporting findings. A security professional would have
responsibilities in defining the scope of the inspection, overseeing the self-inspection and
remediation efforts, and coordinating with the CCRI team throughout the remainder of the
process
QUESTION: List two factors that should be considered when determining position sensitivity -
ANSWER-(1) Level of access to classified information (2) IT level needed (3) Duties associated
with position
QUESTION: Explain the process for responding to a "spillage" - ANSWER-1. Detection (implied)
2. Notification and preliminary inquiry
3. Containment and continuity of operations
4. Formal inquiry
2
,Page 3 of 141
5. Resolution
6. Reporting
QUESTION: What is the security professionals' role in pursuing and meeting cyber security
goals? - ANSWER-The role of the cyberspace workforce is to "secure, defend, and preserve
data, networks, net-centric capabilities, and other designated systems by ensuring appropriate
security controls and measures are in place, and taking internal defense actions" (DoDD
8140.01). Per DoDI 8500.01, Cybersecurity (March 14, 2014), personnel occupying cybersecurity
positions must be assigned in writing and trained / qualified in accordance with their role.
QUESTION: Identify specific baseline administrative and/or physical security controls applicable
to each system categorization - ANSWER-Controls are identified by enumerating the common
controls, identifying those relevant to the categorization level as defined in NIST SP 800-53,
potentially tailored by the Authorizing Official, and overlays are applied based on the nature of
the system.
QUESTION: List three (3) factors for determining whether US companies are under Foreign
Ownership Control of Influence (FOCI) - ANSWER-1. Record of economic and government
espionage against the US targets.
2. Record of enforcement/engagement in unauthorized technology transfer.
3. Type and sensitivity of the information that shall be accessed.
4. The source, nature and extent of FOCI.
3
, Page 4 of 141
5. Record of compliance with pertinent US laws, regulations and contracts.
6. Nature and bilateral and multilateral security and information exchange agreements.
7. Ownership or control in whole or part, by a foreign government.
QUESTION: How does lack of attention to the concept of compilation of information introduce
risks to DoD assets? - ANSWER-1. Unauthorized disclosure
2. Misclassification
3. Security Violation
4. Improper safeguarding
5. Improper dissemination
6. Improper handling
7. Improper destruction
8. Data Spill
QUESTION: List at least three indicators of insider threats - ANSWER-1. Failure to report
overseas travel or contact with foreign nationals.
2. Seeking to gain higher clearance or expand access outside the job scope.
3. Engaging in classified conversations without a need to know.
4. Working hours inconsistent with job assignment or insistence on working in private.
4
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller STUVIAGRADES. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for $22.99. You're not tied to anything after your purchase.
