Threat Awareness and Reporting Program (TARP) Practice Exam

These questions are part of the practice quiz. Start practicing

• Why should TARP include bystander reporting?
• What is the final outcome option after completing follow-up in a TARP case?
• How should leadership demonstrate commitment to TARP?
• As government employees, our greatest vulnerabilities are those things we take for granted.
• What is the benefit of training to recognize warning signs in TARP?
• What is a common misconception about TARP?
• How do you maintain a record of TARP reports?
• Which statement about anomalies is accurate?
• Which statement best describes indicators of potential violence?
• Counterintelligence is concerned with understanding, and possibly neutralizing, all aspects of the intelligence operations of foreign nations.
• Which of the following is an example of a TARP indicator?
• Which action is inappropriate when handling a suspicious incident report?
• Which action increases vulnerability to DoD systems?
• What is the primary purpose of information sharing with executives in TARP?
• Which information should be avoided in a TARP report?
• What is meant by 'anonymous reporting' in TARP?
• What should you do if a TARP report is escalated to law enforcement?
• Which topics are typically included in TARP employee training?
• Post-incident debriefs help update which element?
• What is the most accurate statement about reporting PEIs?
• What is a key benefit of timely reporting under TARP?
• Dana is a new employee working for a cleared contractor who handles sensitive information. What behavior should she exhibit to protect national security?
• Are personnel who fail to report CI activities of concern subject to disciplinary action under regulations?
• Which of the following are collection methods used by adversaries?
• How should you respond to a threat?
• Which statement best defines suspicious behavior in TARP?
• In the case described, what is the name of the former U.S. Consulate guard sentenced for attempting to communicate national defense information to China?
• What do foreign intelligence entities typically attempt to collect information about?
• How should you handle a report during a high-stress incident?
• How does TARP address privacy while handling reports?
• How does TARP address online indicators?
• Which pair of items in the example best illustrate potential targeting indicators?
• How often should organizations refresh TARP training?
• What happens after a threat assessment determines necessary safety measures?
• Which statement best describes the nature of foreign collection techniques?
• Which statement accurately reflects reporting of unexpected activity?
• Which situations trigger a formal threat assessment meeting?
• What is the difference between 'observation' and 'inference' in TARP reporting?
• You receive an invitation to attend an all-expense-paid conference in a foreign country from an unknown person. What should you do?
• What is considered suspicious activity in the TARP context?
• To inform protective measures, which purpose best describes why foreign intelligence entities seek information about activities, plans, and technologies?
• To minimize the ability of an insider threat to go undetected, you must
• How should a TARP team handle multiple related reports?
• To defeat our objectives and advance their interests, foreign entities attempt to collect information about our plans, technologies, activities, and operations.
• Who should have access to TARP reports?
• When documenting a TARP report, which elements are typically recorded in the case file?
• When should a report be escalated?
• Which statement describes the appropriate action when you observe a potential espionage indicator?
• Do counterintelligence operations address terrorism?
• When a TARP report goes to law enforcement, what is expected regarding confidentiality and documentation?
• Which agencies or authorities might be involved in a TARP-based response?
• Which of the following is a potential espionage indicator?
• What is the difference between a report and an investigation under TARP?
• Who should be involved in escalation after a TARP report?
• Which of the following best describes retaliation protections?
• What should a TARP report be grounded in?
• PEIs are activities, behaviors, or circumstances that may be indicative of potential espionage activities. Which choice best captures the concept of PEIs?
• What is the purpose of confidentiality in TARP?
• TARP emphasizes cooperation across which domains?
• In Carl's scenario, which of the following is a potential indicator of foreign intelligence entity solicitation?
• Which scenario is most indicative of potential foreign intelligence targeting?
• What is retaliation protection in the context of TARP?
• Who should participate in TARP reporting?
• What is immediate action after a reported threat?
• As a DoD employee, you can be the target of a Foreign Intelligence Entity.
• DOD personnel who suspect a coworker of possible espionage should:
• Traditional espionage activities include foreign government sponsored commercial enterprises, international trafficking organizations and terrorism.
• Which practice helps maintain confidentiality when reporting a sensitive concern?
• How does TARP protect reporter confidentiality while still collecting actionable information?
• What is the scope of TARP beyond violence?
• Which statement best describes the content that should be included in a TARP report?
• Under DODD 5240.06, Reportable Foreign Intelligence Contacts, Activities, Indicators, and Behaviors; which of the following is not reportable?
• When dealing with mental health concerns, what should be respected during safety assessment?
• What is the difference between threat recognition and threat reporting in TARP?
• What should a supervisor do after receiving a TARP report?
• Which of the following are potential espionage indicators?
• Inadvertent actions such as using easy passwords and practicing poor computer security can provide foreign entities an avenue to penetrate DoD systems.
• In the given example, which of the following was an indicator of foreign intelligence entity targeting?
• How should you handle a threat made via voicemail or message?
• FEI is defined in which directive?
• What should you do if you observe someone storing weapons or obtaining restricted materials?
• A Foreign Intelligence Entity may target Department of Defense employees.
• Foreign Intelligence Entities (FEI) are defined as ...
• What is a primary reason to follow up with the reporter after an initial TARP report?
• Why is it important to avoid sharing a TARP report on social media?
• What is the difference between a concern and a threat in TARP terminology?
• Which statement best describes a reportable alert?
• Why is cross-functional cooperation important in TARP?
• What information should be included in a TARP report?
• What is the recommended action when you observe suspicious behavior in a cleared facility?
• This Navy Civilian Engineer shared the schematics of the USS Gerald R. Ford nuclear aircraft carrier with individuals whom he believed were representing a foreign government.
• What should be included about the individual in the report?
• What is the role of training in shaping TARP culture?
• Which of the following would be considered a sign of targeting when approached about an international conference?
• In a recruitment process, what does the 'Spotting' phase refer to?
• Counterintelligence includes only offensive activities.
• Which of the following best describes what a supervisor should ensure when escalating a report?
• Which of the following is not an example of an anomaly?
• How should you document the time of an observed incident?
• Which of the following is an example of a foreign intelligence entity threat?
• Lydia experiences symptoms after meeting an unknown foreign visitor. Is this a mandatory reportable CI anomaly?
• What should you do first if you observe a potential threat?
• Which statement best describes the purpose of threat assessment in TARP?
• Which option correctly describes PEIs?
• What should you do with sensitive information obtained through TARP reporting?
• Which practice is appropriate when gathering evidence for a TARP report?
• Information sharing with executives should comply with what?
• Which action is recommended when you are unsure about something you observe related to security?
• What is meant by 'appropriate escalation' in TARP terms?
• What is a watch list in the context of TARP?
• What is the purpose of counterintelligence?
• Which action is recommended when you suspect foreign intelligence contact?
• How should reports be archived for long-term retention?
• FEI scope includes which of the following?
• Why is timely reporting emphasized in TARP?
• How should you handle sensitive information in a TARP report?
• Which scenario is most consistent with possible foreign intelligence targeting, based on the given examples?
• What is the purpose of training and refreshers in TARP?
• How does TARP interact with cybersecurity?
• Which statement best differentiates a reportable alert from a neutral observation?
• What is the role of the TARP administrator or point of contact?
• Is the statement 'FEI seldom use elicitation to extract information from people who have access to classified or sensitive information' true?
• What is the correct first step if you witness suspicious behavior?
• When should you escalate a TARP report?
• What is the typical lifecycle of a TARP report?
• Who should have access to sensitive information collected through TARP reporting?
• How can anonymous reporting be handled under TARP?
• Which of the following is an example of suspicious behavior that would warrant a TARP report?
• A Security Anomaly is best described as?
• Being invited to lecture or attend a conference in a foreign country is one potential indicator of foreign entity targeting.
• What kind of documentation is typically created after a TARP report?
• Which information category is targeted by foreign collectors according to the material?
• Disciplinary action for failing to report CI concerns is outlined under which directive?
• How soon should a threat be reported after observation?
• Which statement about reporting in good faith is true?
• What does preserving metadata when handling a threat message entail?
• Counterintelligence, as defined in Executive Order 12333, is information gathered and activities conducted to protect against espionage, other intelligence activities, sabotage, or assassinations conducted by or on behalf of foreign governments or elements thereof, foreign organizations or foreign persons, or international terrorist activities.
• During triage and screen, which aspects are evaluated?
• What is the significance of documenting witnesses in a TARP report?
• What should you do if you are unsure whether a situation qualifies as a TARP report?
• Which statement best describes the scope of counterintelligence?
• In evaluating risk, which of the following would be a strong indicator of potential foreign intelligence targeting?
• How do you distinguish between a workplace concern and a security incident requiring immediate escalation?
• What is the role of a Threat Assessment Team (TAT) in TARP?
• What should you do if a TARP report lacks sufficient information?
• Cyber vulnerabilities to DoD systems may include which items?
• How can employees protect themselves when reporting sensitive concerns?
• Which statement about whistleblower protections under TARP is accurate?
• What should be included in a well-documented report about online indicators?
• What is the difference between a 'concern' and a 'warning' in TARP language?
• What is the objective of foreign entities when collecting information about an organization?
• In the example, what combination of actions represents indicators of targeting?
• Which of the following are indicators that would trigger a TARP report?
• Which statement about whistleblower protections is accurate?
• In the undercover scenario, the FBI agent posed as what?
• Who was the disgruntled civilian employee sentenced to four consecutive life sentences for murders at the Coast Guard base in Kodiak Island, Alaska?
• What is the difference between internal reporting and external contact in TARP?
• What is meant by 'non-retaliation' in TARP?
• What is a typical next step after completing a TARP investigation?
• Which statement reflects FEI use of the Internet as a collection method?
• If a coworker asks you for access to material that he doesn't have a need to know, what should you do?
• What is an 'injury or loss' scenario in TARP context?
• Which statement about TARP coverage is NOT accurate?
• Which of the following is NOT a typical reporting channel for TARP concerns?
• If you feel you are being solicited for information, which of the following should you do?
• Which metric is commonly used to evaluate TARP effectiveness?
• How does TARP address false positives?
• Anomalous health incidents may include some of the following symptoms: headache, pain, nausea, unsteadiness, or a vertigo‑like feeling and cognitive fog.
• What is the role of human resources in TARP?
• What roles do security and law enforcement play in TARP?
• What is meant by retaliation concerns in TARP?
• What types of indicators are commonly associated with potential violent extremism in the workplace?
• If you experience headaches and cognitive fog after interacting with a foreign visitor, what is the required action?
• Which policy or directive covers reportable foreign intelligence contacts, activities, indicators, and behaviors?
• Which of the following is a recruitment indicator mentioned in the material?
• What is the difference between a 'near-term threat' and a 'long-term risk' in TARP?
• When a TARP report involves mental health concerns, what is recommended?
• What protections does TARP provide to reporters against retaliation?
• When should a TARP report be escalated to law enforcement?
• PEIs are activities, behaviors, or circumstances that may be indicative of potential espionage activities. Which option correctly reflects the examples?
• According to DODD 5240.06, which of the following are reportable items?
• What is a threat assessment in the TARP context?
• How can you maintain confidentiality when sharing a TARP report?
• PEIs are described as activities, behaviors, or circumstances that may be indicative of potential espionage. Which option best describes PEIs?
• In this context, foreign intelligence entities are best described as organizations seeking information from where?
• Cyber vulnerabilities to Department of Defense systems may include:
• Why is early reporting important?
• How should you handle a report that you disagree with or consider unfounded?
• What is the purpose of post-incident debriefs under TARP?
• Foreign intelligence entities attempt to collect information about which items?
• Under what circumstances should external law enforcement be involved?
• What is a primary responsibility of the TARP administrator?
• What is the role of a supervisor in TARP reporting?
• Who typically has access to a watch list in TARP?
• Which combination shows indicators most likely to signal foreign intelligence targeting?
• Collection methods frequently used by Foreign Intelligence Entities to collect information from DoD about critical technology produced at cleared defense contractor facilities include:
• Family, friends and co-workers may be used as a means to gain information about you.
• Which statement about reporting is true?
• What is the correct action if you encounter an immediate danger situation?
• What types of details are important when documenting a suspicious incident?
• What might be considered non-credible rumors in a TARP context?
• Mustafa Awwad is associated with which action?
• Which of the following would be considered a TARP indicator?
• Why is preserving chain of custody important?
• The scope of information collection by foreign intelligence entities includes which of the following?
• What kind of follow-up is typically conducted after a reported concern?
• How should follow-up with a reporter be conducted?
• What is the recommended approach to insider threat when suspicious activity is observed?
• In the context of TARP, what best describes the threat assessment process?
• Which collection method includes offers or invitations for cultural exchange, individual-to-individual exchanges, and ambassador programs?
• How does TARP promote a culture of reporting?
• A cleared defense contractor employee clicks a link in an email that downloads malware from a foreign intelligence entity onto the contractor's IT system. This is an example of:
• What is the purpose of maintaining an incident log in TARP?
• Which statement best reflects reporting obligations for CI concerns?
• Which statement best captures the primary goal of counterintelligence?
• How does TARP address cultural sensitivity and bias in reporting?
• What is the purpose of documenting and following up on a TARP case?
• What should you do if you doubt a report's credibility but there are some details that could indicate risk?
• Which of the following constitutes a potential indicator of foreign intelligence entity targeting in an engagement with a foreign contact?
• What role do coworkers play in TARP?
• What is the primary purpose of the Threat Awareness and Reporting Program (TARP)?
• What training materials are typically included in TARP onboarding?
• What kinds of evidence should you gather or preserve when possible?
• Who can submit a TARP report?
• Which action is correct when information is confirmed as a threat?
• What does confidentiality protect besides the reporter?
• Foreign Intelligence Entities includes international terrorists.
• What is the difference between a credible threat and a non-credible threat in TARP?
• In the described undercover operation, which individual accepted money from an undercover FBI agent posing as a Chinese intelligence officer?
• What is the primary purpose of the Threat Awareness and Reporting Program (TARP)?
• The material indicates that foreign intelligence entities collect information about three categories. Which option describes these categories?
• How should a report be structured to maximize usefulness?
• Why must you avoid deleting or altering a threat message when reporting?
• Who pled guilty to attempted spear phishing cyber-attack on Department of Energy Computers?
• Which confidentiality approach is appropriate for TARP reporting?
• What kind of training does TARP typically include for employees?
• How can TARP be used to improve organizational culture?