INSIDER THREAT AWARENESS FINAL REVIEW
SET 2026 PRACTICE MATERIALS
◉ Johan is a janitor at a DOD facility. He does not have national
security eligibility determination. When he is working near the
building entrances, he often opens the door for everyone entering.
Does this pose an insider threat as defined by the NITTF? Why or
why not? Answer: Yes, the incident does meet the definition because
Johan is using his authorized access and may cause damage by
violating security procedures. (Correct)
◉ Julien is a DOD program manager. He recently accepted a friend
request from a woman on social media. The messages started out
unrelated to Julien's work. The woman's messages quickly shifted
when she started complaining about her job and offering details
about her work. Over time, Julien and the women started talking
more and more about their work. The women is now sending
messages asking increasingly direct questions about Julien's work.
What should Julien do and why? Answer: Report it, as the woman
may be part of a broader effort to gather information about DOD
programs. (Correct)
◉ Sun works for a private cleared defense contractor. Her facility
recently experienced suspicious network activity... Could the facility
be the victim of adversarial targeting? Why or why not? Answer: Yes,
adversaries target both public and private organizations (Correct)
, ◉ Consider the following scenarios. Which are required to be
reported? Answer: Leo was rushed to make a deadline and bypassed
security rules to fininsh on time (Correct).
◉ Carmen has been drinking a lot. She knows it's becoming a
problem but she's having a hard time stopping on her own. What can
Carmen do to help reach a positive outcome? Answer: Contact the
Employee Assistance Program (EAP) (Correct)
◉ Patricia's facility conducted Insider Threat training for everyone
in the facility. They stressed that everyone in an organization is
responsible for security. Is everyone responsible for reporting
concerning behavior and potential threats? Why or why not?
Answer: Yes, because Insider Threat programs rely on everyone to
report concerning behavior to get a fuller picture of potential
threats. (Correct)
◉ Rafael works for a cleared contractor. He was tarted by a foreign
collection attempt. To whom should Rafael report a potential threat?
Answer: Insider Threat Program Senior Official (ITPSO) or Facility
Security Officer (FSO) (Correct)
◉ Pauline works or a cleared defense contractor and has been
granted Secret eligibility. Her coworkers observedher using a flash
drive without authorization. She also sought classified data without
SET 2026 PRACTICE MATERIALS
◉ Johan is a janitor at a DOD facility. He does not have national
security eligibility determination. When he is working near the
building entrances, he often opens the door for everyone entering.
Does this pose an insider threat as defined by the NITTF? Why or
why not? Answer: Yes, the incident does meet the definition because
Johan is using his authorized access and may cause damage by
violating security procedures. (Correct)
◉ Julien is a DOD program manager. He recently accepted a friend
request from a woman on social media. The messages started out
unrelated to Julien's work. The woman's messages quickly shifted
when she started complaining about her job and offering details
about her work. Over time, Julien and the women started talking
more and more about their work. The women is now sending
messages asking increasingly direct questions about Julien's work.
What should Julien do and why? Answer: Report it, as the woman
may be part of a broader effort to gather information about DOD
programs. (Correct)
◉ Sun works for a private cleared defense contractor. Her facility
recently experienced suspicious network activity... Could the facility
be the victim of adversarial targeting? Why or why not? Answer: Yes,
adversaries target both public and private organizations (Correct)
, ◉ Consider the following scenarios. Which are required to be
reported? Answer: Leo was rushed to make a deadline and bypassed
security rules to fininsh on time (Correct).
◉ Carmen has been drinking a lot. She knows it's becoming a
problem but she's having a hard time stopping on her own. What can
Carmen do to help reach a positive outcome? Answer: Contact the
Employee Assistance Program (EAP) (Correct)
◉ Patricia's facility conducted Insider Threat training for everyone
in the facility. They stressed that everyone in an organization is
responsible for security. Is everyone responsible for reporting
concerning behavior and potential threats? Why or why not?
Answer: Yes, because Insider Threat programs rely on everyone to
report concerning behavior to get a fuller picture of potential
threats. (Correct)
◉ Rafael works for a cleared contractor. He was tarted by a foreign
collection attempt. To whom should Rafael report a potential threat?
Answer: Insider Threat Program Senior Official (ITPSO) or Facility
Security Officer (FSO) (Correct)
◉ Pauline works or a cleared defense contractor and has been
granted Secret eligibility. Her coworkers observedher using a flash
drive without authorization. She also sought classified data without
