Counterintelligence Awareness and Reporting Quiz
Questions: 16 · 10 minutes
1. You receive a suspicious message that may be relevant to a security review. Which action best preserves useful evidence?
Copy the text into a new document and delete the original
Forward it to several colleagues so multiple copies exist
Retain the original and follow approved instructions for reporting or preserving it
Reply with questions to generate more evidence before reporting
2. Which information is most useful in an initial report of suspicious activity?
Specific observations, dates, communications, people involved, and a clear distinction between facts and assumptions
A confident theory about who directed the activity and why
Only details that can already be supported by multiple witnesses
A shortened summary that omits uncertain or incomplete observations
3. What is the primary purpose of counterintelligence awareness in an organization?
To conduct independent investigations into coworkers and visitors
To recognize, protect against, and report possible foreign intelligence or insider-related activity
To classify every unusual workplace interaction as hostile activity
To replace cybersecurity, personnel security, and law-enforcement functions
4. After foreign travel, you notice unexplained settings changes and possible tampering on a work device. What should you do?
Restore factory settings before anyone else examines the device
Stop using it if feasible, preserve its condition, and promptly contact the designated security or IT channel
Ask a technically skilled colleague to inspect it informally
Continue using it while watching for further changes
5. A coworker repeatedly asks for detailed information about a restricted project that is unrelated to their duties. What is the best general response?
Note the observable details and report the concern through the designated channel
Question the coworker until you can determine their motive
Share a limited sample to see whether they request more
Wait until you obtain proof that the information will be misused
6. You observe behavior that may present an immediate threat of violence or serious harm. What takes priority?
Collect enough evidence to complete a detailed counterintelligence report
Move toward safety and contact the appropriate emergency or security service, then follow reporting procedures when able
Use only the routine reporting portal so the incident is formally recorded
Contact the person’s supervisor and wait for workplace guidance
7. An employee repeatedly attempts to access sensitive material outside their assigned responsibilities. How should this behavior be understood?
As proof that the employee is working for a foreign intelligence service
As solely a management issue with no possible security relevance
As harmless curiosity unless a document is successfully downloaded
As a potential insider-risk indicator that warrants contextual review and appropriate reporting
8. Which pattern most closely resembles gradual recruitment or cultivation?
A stranger makes one broad request for information that is already public
A known vendor follows a documented process for requesting technical specifications
A contact builds rapport, offers favors, tests boundaries, and gradually requests more sensitive help
A professional acquaintance asks where to find an approved public report
9. Why can seemingly harmless public social-media posts create a security concern?
Any mention of an employer automatically discloses protected information
Separate details can be combined to reveal routines, relationships, projects, or vulnerabilities
Public posts can be accessed only by verified professional contacts
Deleting a post always makes its information unavailable to others
10. Which statement best describes counterintelligence?
Activities intended to identify, understand, counter, or protect against foreign intelligence and related security threats
The collection of any publicly available information about competitors
The physical protection of buildings without attention to human or cyber activity
The investigation of ordinary policy violations that have no security connection
11. You overhear a concerning remark but cannot remember its exact wording. What is the most appropriate reporting approach?
Reconstruct a precise quotation so the report appears complete
Wait to see whether the person repeats the remark in front of others
Report what you accurately remember, identify uncertainty, and include the surrounding context
Omit the remark because incomplete recollection cannot be useful
12. At a professional event, someone flatters your expertise and gradually shifts from public topics to specific questions about nonpublic capabilities. What technique might this represent?
Routine identity verification
A formal security debriefing
Authorized collection under a nondisclosure agreement
Elicitation designed to obtain information through conversation
13. How much certainty do you generally need before reporting a counterintelligence concern?
You must first confirm that protected information was actually lost
You need enough evidence to identify the person’s sponsoring organization
You may report concerning facts or patterns without proving hostile intent
You should report only after another witness independently agrees
14. A message that appears to come from a trusted partner asks you to enter work credentials on a new login page. What is the strongest response?
Open the page in a private browser to reduce exposure
Forward the message to coworkers to ask whether they received it
Reply to the sender and ask whether the link is legitimate
Verify the request through a separate trusted channel and report the suspicious message
15. A caller claims to be a senior official, creates urgency, and asks you to bypass an access-control step. What should you do?
Pause the request and verify the identity and authority through an established official channel
Provide limited access while requesting written confirmation
Ask a coworker whether the caller sounds credible
Comply if the caller knows internal names and project terms
16. An unfamiliar overseas contact offers paid consulting work in exchange for details about your employer’s nonpublic research. What should you generally do?
Accept an introductory payment but avoid discussing classified information
Negotiate narrower topics that seem commercially harmless
Delete the messages so you are no longer associated with the contact
Preserve the communication, avoid further disclosure, and report it through the appropriate channel