DOD Instruction 5200.48 Controlled Unclassified Information (CUI) Practice Exam

These questions are part of the practice quiz. Start practicing

• Which item is explicitly part of the minimum CUI training standards?
• Are DoD Components required to label CUI as 'Basic' or 'Specified' right now (per initial phased implementation)?
• The second line of the designation indicator must identify?
• How is CUI defined relative to classification levels?
• What is the minimum security level referenced for DoD CUI systems and networks?
• What practice helps prevent reconstruction of disposed CUI?
• If a CUI incident or breach occurs, what action is required?
• When must DoD CUI be controlled?
• How should a CUI paper document be marked?
• In CUI, what do Basic and Specified refer to?
• Which roles are primarily responsible for CUI oversight?
• A CUI incident is defined as what?
• How does export control relate to CUI?
• Which items must be included (at minimum) in CUI training standards?
• What is the difference between marking and labeling in the CUI context?
• Flow-down safeguarding requirements to subcontractors: what does it entail?
• What is the primary purpose of DoD Instruction 5200.48 regarding CUI within the DoD?
• Who has the authority to designate CUI within a DoD program?
• Which activities are included in the CUI lifecycle as standardized by DoDI 5200.48?
• How is access to CUI controlled in information systems?
• When can CUI be disseminated within DoD and to contractors/consultants/grantees?
• What is the difference between "public release" and "authorized release" of CUI?
• How should training and awareness be measured?
• What is the CUI Registry and its purpose?
• What is the 'need to know' principle in CUI handling?
• Which role is identified as part of CUI oversight?
• How should a DoD electronic file containing CUI be marked?
• Under DoD public release processes, when is DoD CUI considered controlled?
• How soon must a CUI incident be reported after discovery?
• Which approach is recommended when data contains both CUI and classified information regarding safeguarding and labeling?
• What are the destruction requirements for CUI?
• How should restricted data or formerly restricted data be treated when it appears in an unclassified document alongside CUI?
• Is there a specific timeline to decontrol CUI?
• Are encryption requirements applicable to CUI at rest and in transit?
• Before accessing CUI, what must be determined?
• What does 'dissemination controls' mean in CUI handling?
• What is the primary purpose of CUI media sanitization?
• How does DoD Instruction 5200.48 support governance of CUI across the DoD?
• Who determines whether an individual has an authorized government purpose to access CUI?
• What does “flow-down” mean in CUI contracts?
• Are DoD contractors required to protect CUI?
• What is the main purpose of verification steps before sharing CUI?
• What is the policy on using unofficial or personal email for official business involving CUI?
• What does CUI stand for in this context?
• What determines whether legacy information meets CUI requirements?
• How should portable media containing CUI be safeguarded?
• What is the purpose of the DoD CUI Registry?
• What is the minimum marking for unclassified DoD documents containing CUI?
• If a DoD Component uses a standard letterhead or origination indicator, which element of the designation indicator may be omitted?
• What are the requirements for remote access to CUI systems?
• Which framework serves as the baseline for protecting CDI where applicable?
• What is "REL TO" used for (in this instruction's context)?
• Which action should be taken to handle a suspected CUI mishandling incident?
• When non-federal systems handle CUI under a contract, which security guideline is referenced?
• How often is CUI awareness training typically refreshed?
• How does DoD 5200.48 define CUI?
• Which topics should CUI personnel training cover?
• DoDI 5200.48 policies apply to CUI within which organization?
• What does the instruction say about future guidance on Basic vs Specified?
• Which statement best describes the DoD CUI program's stance on information sharing and safeguarding?
• Future guidance will address which aspects?
• For unclassified material within a CUI document, which marking designates its status?
• On CUI documents, what information should accompany the designation?
• What is the process for reporting potential noncompliance with CUI policy?
• Does the policy scope include contractor personnel who handle CUI?
• Which elements are required when handling CUI by contractors?
• What notification is required for systems that contain CUI?
• What marks should appear on CUI documents?
• The DoD CUI program standardizes processes per which framework?
• How should CUI be treated when stored or processed outside DoD networks?
• How should removable media containing CUI be controlled?
• When a CUI container is lost, who should be notified immediately?
• What are the dissemination controls for CUI?
• Which option best describes the content of the CUI designation banner related to dissemination restrictions?
• Which domains are addressed in safeguarding CUI protections?
• What must accompany any sharing of CUI with contractors to ensure protection?
• How should CUI be managed in cloud computing environments?
• What is the role of the Information System Security Officer (ISSO) in CUI?
• Which statement best describes external recipients' agreements before receiving CUI?
• What are the two main designations used for CUI in DoDI 5200.48?
• What is the primary purpose of inventories including access details?
• Which action reflects the governance approach to dissemination and decontrol of CUI?
• What must DoD Component heads ensure regarding CUI training?
• What marking elements must appear on CUI documents?
• What are the core components of an effective CUI program?
• Which statement best describes the flow-down obligations in data-sharing agreements for CUI?
• Does legacy information automatically become CUI?
• What is the role of risk assessment in CUI protection?
• What happens if CUI is disclosed in a FOIA request?
• Does CUI include information that is lawfully and publicly available without restrictions?
• Which core access principle restricts who may view CUI?
• How is CUI marked in classified documents?
• How should CUI be marked on hard copy documents?
• Which statement best describes CUI decontrol timing across the DoD?
• How should CUI be protected during electronic transmission?
• How should leadership reporting support governance in a CUI program?
• Who is responsible for determining at time of creation whether info falls into a CUI category?
• Which statement best describes encryption requirements for CUI in transit and at rest?
• How can compliance with the CUI program be verified?
• Under what circumstance is a preliminary inquiry appropriate in response to a CUI incident?
• How should CUI containing PII be safeguarded?
• Which of the following describes appropriate destruction methods for CUI?
• When data containing CUI is shared with external collaborators, which document is required to specify protection against CUI?
• Do derivative documents shared outside DoD need to be marked if the information qualifies as CUI?
• After CUI misuse or incidents that risk unauthorized disclosure, what is the primary focus?
• Which elements must a DoD contract require for CUI protection?
• What is the purpose of a System Security Plan (SSP) in CUI handling?
• How should CUI be destroyed?
• Which item best illustrates a CUI compliance documentation element?
• What training is required for personnel who handle CUI?
• Where on a paper CUI document should the designation, category, and dissemination restrictions be displayed?
• What verification steps confirm a recipient's need-to-know before sharing CUI?
• What is the minimum 'Controlled by' information needed on the CUI designation indicator?
• What is the role of ongoing risk management in CUI-storing systems?
• The fourth line must contain?
• What is the purpose of maintaining CUI training records?
• When can CUI be disseminated to a foreign recipient?
• What is the difference between 'FOUO' and 'CUI' labeling?
• What is NOFORN/NF in this instruction's context?
• Does CUI generally require 'need-to-know' like classified information?
• How is CUI defined in the general sense?
• Where can readers access the official list of DoD CUI indexes and categories?
• Who shares duties for establishing and maintaining the CUI program besides the senior DoD official?
• What is an example of CUI needing 'need-to-know'?
• Which elements are required for accreditation and authorization to operate (ATO) for CUI-storing systems?
• What is the role of a CUI program manager or designated official?
• Do you have to put "U" in the banner/footer like the old "U//FOUO" format?
• Is the DoD CUI Registry aligned with DoD issuances?
• The third line must identify?
• Who decontrols and releases CUI records (general rule in the instruction)?
• What is the primary purpose of DoDI 5200.48?
• CUI cannot be designated to do which of the following?
• What does “decontrol” of CUI mean?
• What are potential consequences for noncompliance with CUI policies?
• Who is responsible for applying CUI markings and dissemination instructions?
• CUI handling must be guided by which authorities?
• Which statement best describes required training refreshers for CUI handling personnel?
• What must happen before marking unclassified intelligence CUI as NOFORN/NF?
• If a paragraph contains only CUI content, how should that paragraph be marked?
• How should CUI be managed in email communications?
• The fifth line must contain?
• What must happen before CUI is approved for public release (including posting to a public website)?
• Which core component focuses on reporting security incidents involving CUI?
• What is the key driver for the DoD CUI Program in this instruction?
• Before disclosing CUI to another party, what must you verify?
• What is the purpose of inventories of CUI holdings?
• Which line contains the distribution statement or dissemination controls?
• What penalties or sanctions exist for failing to protect CUI?
• How does CUI relate to FOIA?
• Which documents demonstrate CUI compliance?
• Which statement describes Basic vs Specified handling during initial phased implementation?
• What is the concept of 'need to know' when several agencies share CUI?
• What must the designation banner and category/handling markings convey on a CUI document?
• Within a CUI document, what portion marking is required for unclassified information?
• What constitutes proper labeling for CUI in a physical environment?
• What is decontrol of CUI?
• Which statement describes the purpose of the REL TO marking?
• Under what conditions may CUI be stored on personal devices?
• What training is required for personnel handling CUI?
• Which marking indicates export control/licensing requirements exist for a foreign release?
• During initial phased implementation, how is DoD information protected regarding Basic vs Specified?
• When data contains both CUI and classified information, which safeguarding approach is recommended?
• How should mixed data containing CUI and classified information be handled?
• Which elements must be included in CUI labeling to ensure proper handling?
• Which element constitutes the CUI designation indicator on documents?
• If portion markings are used, how are portions containing CUI marked?
• What information should a CUI marking include to indicate dissemination restrictions?
• What is the scope of DoD Instruction 5200.48?
• How is CUI defined in DoDI 5200.48?
• Which registry is established by DoDI 5200.48?
• How should CUI be handled in email?
• What marking is required on each page of CUI documents?
• How does CUI Specified differ from CUI Basic?
• Which of the following statements correctly reflects the required confidentiality level for DoD CUI systems?
• What steps are taken during personnel turnover or departure to protect CUI?
• How should CUI be stored in DoD information systems?
• What is the purpose of reporting to leadership within a CUI program?
• What confidentiality impact level applies to DoD systems processing, storing, or transmitting CUI?
• How should backups and snapshots containing CUI be handled?
• What must be ensured before sharing CUI with contractors or external partners?
• What is the instruction's stance on unauthorized disclosure investigations for CUI?
• Which item is NOT listed as a CUI compliance document?
• What is required for retention of CUI records?
• Which statement best defines need-to-know in the context of CUI sharing?
• Which practice is not a standard component of contractor safeguarding when handling CUI?
• How does DoD Instruction 5200.48 relate to contractor systems and NIST SP 800-171?
• DoD 5200.48 alignment with export-control?
• What is the purpose of CUI marking and labeling within handling processes?
• What additional step is used to alert readers to CUI inside a classified multi-page document?
• Do legacy marked documents stored on a DoD access-controlled website need to be re-marked as CUI?
• Who has overall responsibility for establishing and maintaining a CUI program per DoD 5200.48?
• What are the main safeguarding controls in DoD 5200.48?
• If a CUI misuse occurs and no disciplinary action is pursued, what type of inquiry is required?
• What step is essential before disposing of removable media containing CUI?
• How does DoD 5200.48 align with NIST or other standards?
• Do legacy markings have to be redacted or re-marked as CUI?
• Which statement best describes the difference between dissemination and disclosure of CUI?
• Which is an allowed exception to using unofficial email for official CUI business?
• When should CUI be decontrolled?
• Which statement about training measurement is supported by the material?
• What is a key inclusion of safeguarding controls in DoD 5200.48 beyond physical and technical measures?
• If a new document is created from legacy material and the information qualifies as CUI, what must be done with the new document?
• Which statement best characterizes CUI within the DoD context?
• How should data-sharing agreements be used for CUI?
• Where should safeguards for an electronic CUI file be reflected?
• What is the primary purpose of DoD Instruction 5200.48?
• Which statement describes what CUI refers to?
• Who is responsible for implementing policy, providing guidance, and ensuring oversight of the CUI program?
• What kinds of information may get NOFORN/NF applied (examples listed)?
• Where are DoD CUI registry categories accessible?
• If you create a new document from legacy material, what happens if the info qualifies as CUI?
• Which core protection principle restricts how much access is granted to CUI?
• What documentation is required for CUI training records?
• NOFORN/NF marking is applicable to which of the following information types?
• Which document does DoDI 5200.48 cancel or replace?
• What is the role of the CUI Policy Official in enforcement across a DoD component?
• How should training records for CUI awareness be maintained?
• What are the two main CUI categories used under the policy?
• What is the purpose of the splash screen for systems containing CUI?
• Which statement best describes the relationship between CUI and restricted data in an unclassified document?
• Which elements best describe access control for CUI in information systems?
• What are general physical storage requirements for CUI?
• Under what conditions can CUI be shared with foreign nationals?
• What action is required if a CUI container is lost or stolen?
• Which statement best describes the use of cross-domain solutions for CUI?
• How should backups containing CUI be safeguarded?
• Hard copy CUI markings should include CUI and which additional information?
• To whom should a CUI incident be reported?
• How should CUI be disposed of when no longer needed?
• What is involved in CUI media sanitization?
• How should hotlines or reporting channels be used for CUI concerns?
• What level of safeguards must DoD Components apply at minimum?
• What is the role of the CUI Policy Official or CUI Program Manager in a DoD component?
• How is CUI incident response integrated with the broader incident handling process?
• Which statement best describes how CUI is identified in a classified document?
• Which backup practice best ensures continued protection of CUI during storage?
• How should CUI be transmitted electronically?
• Which statement best describes mobile device protection for CUI?