INSIDER THREAT AWARENESS EXAMINATION
TEST PAPER 2026 MARKING SCHEME
◉ Paul works for a cleared defense contractor and has been granted
a Top Secret Security eligibility. His coworkers observe him speaking
on his personal cell phone in a Sensitive Compartmented
Information Facility (SCIF). To whom should his coworkers report
this behavior? Answer: Insider Threat Program Senior Official
(ITPSO) or Facility Security Officer (FSO) (Correct)
◉ Julia is an engineer for a cleared defense contractor. She took files
home from work and realized she accidently included a file marked
SECRET. Does this incident pose an insider threat as defined by the
National Insider Threat Task Force (NITTF)? Why or why not?
Answer: Yes, the incident meets the definition because Julia has
authorized access, and her intention is irrelevant. (Correct)
◉ Mateo purchased a home with the intention of flipping it. The
housing market shifted before he was able to sell putting him in
significant debt. Based on this information, is Mateo at increased
vulnerability of insider threat? Why or why not? (Select a that apply)
Answer: Yes, significant debt is a known stressor that may increase
insider threat vulnerability. (Correct)
, ◉ Which of the following scenarios are considered a potential
insider threat vulnerability? (Select all that apply) Answer: John's
disgruntlement with his employer is well known to his coworkers.
He regularly displays negligence by ignoring his job responsibilities
and not completing his work duties. (Correct)
Diane works extra hours to cover her gambling addition. (Correct)
◉ Farrah hears a co-worker, upset with his boss, sat, "If I had a gun, I
would shoot her!" What should Farrah do and why? Answer: Report
it. Threatening violence is a reportable behavioral concern. (Correct)
◉ Justin is upset that he wasn't assigned the new radar project. He is
very interested in the technology. He constantly asks his teammate
Claire to share classified, project-related formation with him, though
he is not on the project and doesn't have a need-to-know. What
should Claire do? Answer: Report it. Seeking classified information
without a need-to-know is a reportable behavioral indicator.
(Correct)
◉ Following a conference, Jacqueline, a DOD contractor, received
repeated emails from another attendee requesting specific
information about the technology that Jacqueline presented on.
Jacqueline blocked the other attendee's communications. Should she
report this? Why or why not? Answer: Yes, she should report this to
her Facility Security Officer (FSO) as a potential collection attempt.
(Correct)
TEST PAPER 2026 MARKING SCHEME
◉ Paul works for a cleared defense contractor and has been granted
a Top Secret Security eligibility. His coworkers observe him speaking
on his personal cell phone in a Sensitive Compartmented
Information Facility (SCIF). To whom should his coworkers report
this behavior? Answer: Insider Threat Program Senior Official
(ITPSO) or Facility Security Officer (FSO) (Correct)
◉ Julia is an engineer for a cleared defense contractor. She took files
home from work and realized she accidently included a file marked
SECRET. Does this incident pose an insider threat as defined by the
National Insider Threat Task Force (NITTF)? Why or why not?
Answer: Yes, the incident meets the definition because Julia has
authorized access, and her intention is irrelevant. (Correct)
◉ Mateo purchased a home with the intention of flipping it. The
housing market shifted before he was able to sell putting him in
significant debt. Based on this information, is Mateo at increased
vulnerability of insider threat? Why or why not? (Select a that apply)
Answer: Yes, significant debt is a known stressor that may increase
insider threat vulnerability. (Correct)
, ◉ Which of the following scenarios are considered a potential
insider threat vulnerability? (Select all that apply) Answer: John's
disgruntlement with his employer is well known to his coworkers.
He regularly displays negligence by ignoring his job responsibilities
and not completing his work duties. (Correct)
Diane works extra hours to cover her gambling addition. (Correct)
◉ Farrah hears a co-worker, upset with his boss, sat, "If I had a gun, I
would shoot her!" What should Farrah do and why? Answer: Report
it. Threatening violence is a reportable behavioral concern. (Correct)
◉ Justin is upset that he wasn't assigned the new radar project. He is
very interested in the technology. He constantly asks his teammate
Claire to share classified, project-related formation with him, though
he is not on the project and doesn't have a need-to-know. What
should Claire do? Answer: Report it. Seeking classified information
without a need-to-know is a reportable behavioral indicator.
(Correct)
◉ Following a conference, Jacqueline, a DOD contractor, received
repeated emails from another attendee requesting specific
information about the technology that Jacqueline presented on.
Jacqueline blocked the other attendee's communications. Should she
report this? Why or why not? Answer: Yes, she should report this to
her Facility Security Officer (FSO) as a potential collection attempt.
(Correct)
