Threat Awareness and Reporting Program (TARP) Practice Exam

These questions are part of the practice quiz. Start practicing

• Which metric is commonly used to evaluate TARP effectiveness?
• What is the role of human resources in TARP?
• What is the primary purpose of the Threat Awareness and Reporting Program (TARP)?
• What is the primary purpose of information sharing with executives in TARP?
• Which of the following is a recruitment indicator mentioned in the material?
• Why must you avoid deleting or altering a threat message when reporting?
• A Foreign Intelligence Entity may target Department of Defense employees.
• In the case described, what is the name of the former U.S. Consulate guard sentenced for attempting to communicate national defense information to China?
• What is an 'injury or loss' scenario in TARP context?
• Why should TARP include bystander reporting?
• What is a typical next step after completing a TARP investigation?
• What is the correct action if you encounter an immediate danger situation?
• What is the primary purpose of the Threat Awareness and Reporting Program (TARP)?
• Counterintelligence, as defined in Executive Order 12333, is information gathered and activities conducted to protect against espionage, other intelligence activities, sabotage, or assassinations conducted by or on behalf of foreign governments or elements thereof, foreign organizations or foreign persons, or international terrorist activities.
• What should you do if a TARP report is escalated to law enforcement?
• To inform protective measures, which purpose best describes why foreign intelligence entities seek information about activities, plans, and technologies?
• What is meant by retaliation concerns in TARP?
• What happens after a threat assessment determines necessary safety measures?
• Why is timely reporting emphasized in TARP?
• To defeat our objectives and advance their interests, foreign entities attempt to collect information about our plans, technologies, activities, and operations.
• Which topics are typically included in TARP employee training?
• How does TARP interact with cybersecurity?
• According to DODD 5240.06, which of the following are reportable items?
• Which statement describes the appropriate action when you observe a potential espionage indicator?
• What is the recommended action when you observe suspicious behavior in a cleared facility?
• What kinds of evidence should you gather or preserve when possible?
• What is meant by 'appropriate escalation' in TARP terms?
• What is the scope of TARP beyond violence?
• Which of the following is an example of suspicious behavior that would warrant a TARP report?
• Which combination shows indicators most likely to signal foreign intelligence targeting?
• What is meant by 'non-retaliation' in TARP?
• Which statement best describes the nature of foreign collection techniques?
• Who pled guilty to attempted spear phishing cyber-attack on Department of Energy Computers?
• Which statement about reporting is true?
• How should you respond to a threat?
• How does TARP promote a culture of reporting?
• When a TARP report involves mental health concerns, what is recommended?
• Which of the following is NOT a typical reporting channel for TARP concerns?
• Which of the following are collection methods used by adversaries?
• How can anonymous reporting be handled under TARP?
• Under DODD 5240.06, Reportable Foreign Intelligence Contacts, Activities, Indicators, and Behaviors; which of the following is not reportable?
• If you experience headaches and cognitive fog after interacting with a foreign visitor, what is the required action?
• What is a threat assessment in the TARP context?
• What is meant by 'anonymous reporting' in TARP?
• How can employees protect themselves when reporting sensitive concerns?
• If you feel you are being solicited for information, which of the following should you do?
• Which confidentiality approach is appropriate for TARP reporting?
• When should a report be escalated?
• How should a report be structured to maximize usefulness?
• When should you escalate a TARP report?
• Which statement about whistleblower protections is accurate?
• Which pair of items in the example best illustrate potential targeting indicators?
• PEIs are activities, behaviors, or circumstances that may be indicative of potential espionage activities. Which choice best captures the concept of PEIs?
• When should a TARP report be escalated to law enforcement?
• Who can submit a TARP report?
• What roles do security and law enforcement play in TARP?
• To minimize the ability of an insider threat to go undetected, you must
• FEI scope includes which of the following?
• Which practice helps maintain confidentiality when reporting a sensitive concern?
• What is the purpose of training and refreshers in TARP?
• In a recruitment process, what does the 'Spotting' phase refer to?
• What is the role of a Threat Assessment Team (TAT) in TARP?
• Which collection method includes offers or invitations for cultural exchange, individual-to-individual exchanges, and ambassador programs?
• Which of the following constitutes a potential indicator of foreign intelligence entity targeting in an engagement with a foreign contact?
• You receive an invitation to attend an all-expense-paid conference in a foreign country from an unknown person. What should you do?
• Which of the following would be considered a sign of targeting when approached about an international conference?
• Which of the following best describes retaliation protections?
• Cyber vulnerabilities to DoD systems may include which items?
• What is the difference between internal reporting and external contact in TARP?
• Which of the following is a potential espionage indicator?
• What is the role of training in shaping TARP culture?
• Which statement best differentiates a reportable alert from a neutral observation?
• What is a common misconception about TARP?
• Foreign intelligence entities attempt to collect information about which items?
• In the described undercover operation, which individual accepted money from an undercover FBI agent posing as a Chinese intelligence officer?
• How should you handle sensitive information in a TARP report?
• What is the difference between a 'near-term threat' and a 'long-term risk' in TARP?
• What types of indicators are commonly associated with potential violent extremism in the workplace?
• What should you do if you observe someone storing weapons or obtaining restricted materials?
• What is the difference between threat recognition and threat reporting in TARP?
• What training materials are typically included in TARP onboarding?
• What kind of follow-up is typically conducted after a reported concern?
• As a DoD employee, you can be the target of a Foreign Intelligence Entity.
• Foreign Intelligence Entities includes international terrorists.
• When dealing with mental health concerns, what should be respected during safety assessment?
• What do foreign intelligence entities typically attempt to collect information about?
• Which of the following are potential espionage indicators?
• Which statement about anomalies is accurate?
• Mustafa Awwad is associated with which action?
• How can you maintain confidentiality when sharing a TARP report?
• What is the final outcome option after completing follow-up in a TARP case?
• Why is cross-functional cooperation important in TARP?
• What does confidentiality protect besides the reporter?
• Being invited to lecture or attend a conference in a foreign country is one potential indicator of foreign entity targeting.
• Which policy or directive covers reportable foreign intelligence contacts, activities, indicators, and behaviors?
• How should you handle a report that you disagree with or consider unfounded?
• What should you do if you doubt a report's credibility but there are some details that could indicate risk?
• Which statement best defines suspicious behavior in TARP?
• As government employees, our greatest vulnerabilities are those things we take for granted.
• Are personnel who fail to report CI activities of concern subject to disciplinary action under regulations?
• What is a primary reason to follow up with the reporter after an initial TARP report?
• What is the difference between a 'concern' and a 'warning' in TARP language?
• What is a watch list in the context of TARP?
• Traditional espionage activities include foreign government sponsored commercial enterprises, international trafficking organizations and terrorism.
• How should you handle a threat made via voicemail or message?
• How should you document the time of an observed incident?
• Which of the following is not an example of an anomaly?
• Which scenario is most indicative of potential foreign intelligence targeting?
• What role do coworkers play in TARP?
• The scope of information collection by foreign intelligence entities includes which of the following?
• What is the difference between a credible threat and a non-credible threat in TARP?
• Which practice is appropriate when gathering evidence for a TARP report?
• What protections does TARP provide to reporters against retaliation?
• What is a key benefit of timely reporting under TARP?
• How should a TARP team handle multiple related reports?
• A cleared defense contractor employee clicks a link in an email that downloads malware from a foreign intelligence entity onto the contractor's IT system. This is an example of:
• What is the objective of foreign entities when collecting information about an organization?
• A Security Anomaly is best described as?
• How do you maintain a record of TARP reports?
• Cyber vulnerabilities to Department of Defense systems may include:
• What types of details are important when documenting a suspicious incident?
• What kind of documentation is typically created after a TARP report?
• How does TARP protect reporter confidentiality while still collecting actionable information?
• When documenting a TARP report, which elements are typically recorded in the case file?
• Who was the disgruntled civilian employee sentenced to four consecutive life sentences for murders at the Coast Guard base in Kodiak Island, Alaska?
• FEI is defined in which directive?
• What is the most accurate statement about reporting PEIs?
• In evaluating risk, which of the following would be a strong indicator of potential foreign intelligence targeting?
• What is retaliation protection in the context of TARP?
• Which statement best describes the scope of counterintelligence?
• What is considered suspicious activity in the TARP context?
• What is the significance of documenting witnesses in a TARP report?
• Disciplinary action for failing to report CI concerns is outlined under which directive?
• Which statement about TARP coverage is NOT accurate?
• What is immediate action after a reported threat?
• What is the purpose of confidentiality in TARP?
• What is the typical lifecycle of a TARP report?
• What is the recommended approach to insider threat when suspicious activity is observed?
• How does TARP address online indicators?
• What should a supervisor do after receiving a TARP report?
• What should be included in a well-documented report about online indicators?
• Which statement best captures the primary goal of counterintelligence?
• Which information should be avoided in a TARP report?
• How do you distinguish between a workplace concern and a security incident requiring immediate escalation?
• What should a TARP report be grounded in?
• What is the role of a supervisor in TARP reporting?
• Why is it important to avoid sharing a TARP report on social media?
• How should you handle a report during a high-stress incident?
• What should you do if you are unsure whether a situation qualifies as a TARP report?
• Post-incident debriefs help update which element?
• Information sharing with executives should comply with what?
• Which situations trigger a formal threat assessment meeting?
• What should be included about the individual in the report?
• What might be considered non-credible rumors in a TARP context?
• Which action is inappropriate when handling a suspicious incident report?
• Which statement best describes the content that should be included in a TARP report?
• Lydia experiences symptoms after meeting an unknown foreign visitor. Is this a mandatory reportable CI anomaly?
• What is the correct first step if you witness suspicious behavior?
• What is the difference between 'observation' and 'inference' in TARP reporting?
• Which agencies or authorities might be involved in a TARP-based response?
• How can TARP be used to improve organizational culture?
• Which scenario is most consistent with possible foreign intelligence targeting, based on the given examples?
• In the context of TARP, what best describes the threat assessment process?
• Which of the following is an example of a foreign intelligence entity threat?
• When a TARP report goes to law enforcement, what is expected regarding confidentiality and documentation?
• What does preserving metadata when handling a threat message entail?
• DOD personnel who suspect a coworker of possible espionage should:
• Which statement best reflects reporting obligations for CI concerns?
• Which action is recommended when you are unsure about something you observe related to security?
• Who should have access to sensitive information collected through TARP reporting?
• If a coworker asks you for access to material that he doesn't have a need to know, what should you do?
• What is the difference between a concern and a threat in TARP terminology?
• Counterintelligence is concerned with understanding, and possibly neutralizing, all aspects of the intelligence operations of foreign nations.
• Counterintelligence includes only offensive activities.
• Dana is a new employee working for a cleared contractor who handles sensitive information. What behavior should she exhibit to protect national security?
• How should follow-up with a reporter be conducted?
• Which of the following would be considered a TARP indicator?
• What should you do if a TARP report lacks sufficient information?
• In the example, what combination of actions represents indicators of targeting?
• How does TARP address privacy while handling reports?
• In the given example, which of the following was an indicator of foreign intelligence entity targeting?
• Which of the following are indicators that would trigger a TARP report?
• Why is preserving chain of custody important?
• Foreign Intelligence Entities (FEI) are defined as ...
• What is the purpose of documenting and following up on a TARP case?
• What is a primary responsibility of the TARP administrator?
• Which statement about reporting in good faith is true?
• What kind of training does TARP typically include for employees?
• In this context, foreign intelligence entities are best described as organizations seeking information from where?
• Under what circumstances should external law enforcement be involved?
• How soon should a threat be reported after observation?
• How does TARP address false positives?
• How should leadership demonstrate commitment to TARP?
• Who should participate in TARP reporting?
• TARP emphasizes cooperation across which domains?
• What is the difference between a report and an investigation under TARP?
• Which statement best describes a reportable alert?
• Which option correctly describes PEIs?
• Inadvertent actions such as using easy passwords and practicing poor computer security can provide foreign entities an avenue to penetrate DoD systems.
• What is the purpose of maintaining an incident log in TARP?
• Which action increases vulnerability to DoD systems?
• Which statement best describes the purpose of threat assessment in TARP?
• PEIs are activities, behaviors, or circumstances that may be indicative of potential espionage activities. Which option correctly reflects the examples?
• Which of the following best describes what a supervisor should ensure when escalating a report?
• How does TARP address cultural sensitivity and bias in reporting?
• Who should be involved in escalation after a TARP report?
• How often should organizations refresh TARP training?
• During triage and screen, which aspects are evaluated?
• This Navy Civilian Engineer shared the schematics of the USS Gerald R. Ford nuclear aircraft carrier with individuals whom he believed were representing a foreign government.
• What is the purpose of post-incident debriefs under TARP?
• Which action is correct when information is confirmed as a threat?
• PEIs are described as activities, behaviors, or circumstances that may be indicative of potential espionage. Which option best describes PEIs?
• What information should be included in a TARP report?
• Which statement accurately reflects reporting of unexpected activity?
• Anomalous health incidents may include some of the following symptoms: headache, pain, nausea, unsteadiness, or a vertigo‑like feeling and cognitive fog.
• Do counterintelligence operations address terrorism?
• Which statement best describes indicators of potential violence?
• The material indicates that foreign intelligence entities collect information about three categories. Which option describes these categories?
• Which statement reflects FEI use of the Internet as a collection method?
• What is the benefit of training to recognize warning signs in TARP?
• In the undercover scenario, the FBI agent posed as what?
• Is the statement 'FEI seldom use elicitation to extract information from people who have access to classified or sensitive information' true?
• Why is early reporting important?
• What should you do first if you observe a potential threat?
• In Carl's scenario, which of the following is a potential indicator of foreign intelligence entity solicitation?
• Family, friends and co-workers may be used as a means to gain information about you.
• Collection methods frequently used by Foreign Intelligence Entities to collect information from DoD about critical technology produced at cleared defense contractor facilities include:
• What should you do with sensitive information obtained through TARP reporting?
• Which action is recommended when you suspect foreign intelligence contact?
• Who typically has access to a watch list in TARP?
• How should reports be archived for long-term retention?
• Which statement about whistleblower protections under TARP is accurate?
• Which information category is targeted by foreign collectors according to the material?
• Which of the following is an example of a TARP indicator?
• Who should have access to TARP reports?
• What is the purpose of counterintelligence?
• What is the role of the TARP administrator or point of contact?