CFA Counterintelligence Awareness & Threat Recognition 1 — Questions and Answers
Question 1: What is the primary objective of counterintelligence (CI) operations?
- Recruiting foreign nationals as intelligence assets
- Detecting, identifying, and neutralizing foreign intelligence threats (Correct answer)
- Collecting open-source intelligence on adversaries
- Conducting offensive cyber operations against enemy networks
Correct answer: Detecting, identifying, and neutralizing foreign intelligence threats
Counterintelligence operations are fundamentally designed to detect, identify, and neutralize threats posed by foreign intelligence services, terrorist groups, and insider threats.
Question 2: The MICE acronym in counterintelligence describes the primary motivations that lead individuals to betray their organization. What does MICE stand for?
- Money, Ideology, Coercion, Ego (Correct answer)
- Management, Intelligence, Counterintelligence, Espionage
- Mission, Intent, Capability, Exploitation
- Monitoring, Infiltration, Compromise, Exposure
Correct answer: Money, Ideology, Coercion, Ego
MICE stands for Money, Ideology, Coercion, and Ego — the four most common motivators identified in espionage and insider threat cases.
Question 3: Which counterintelligence technique involves feeding slightly different versions of sensitive information to multiple suspected leaks in order to identify the source of a compromise?
- Dead drop confirmation
- Canary trap (Correct answer)
- Cold pitch approach
- Brush pass technique
Correct answer: Canary trap
A canary trap deliberately introduces unique variations of information to different individuals so that when the information surfaces externally, the specific version reveals which person leaked it.
Question 4: What is 'elicitation' in the context of counterintelligence and hostile intelligence collection?
- Physically searching a target's belongings for classified material
- Technically intercepting electronic communications
- Skillfully drawing out sensitive information through seemingly innocent conversation (Correct answer)
- Formally requesting classified documents through official channels
Correct answer: Skillfully drawing out sensitive information through seemingly innocent conversation
Elicitation is the subtle extraction of information through natural-seeming conversation without alerting the source that they are being targeted for intelligence collection.
Question 5: Which of the following behavioral indicators is most commonly associated with an insider threat who may be engaged in espionage?
- Requesting additional training in their primary job function
- Consistently arriving early and staying late without explanation
- Unexplained affluence inconsistent with their known salary (Correct answer)
- Requesting reassignment to a higher-classification position
Correct answer: Unexplained affluence inconsistent with their known salary
Unexplained affluence — such as expensive new purchases, vacations, or lifestyle changes inconsistent with known income — is a classic financial red flag indicating potential espionage compensation.
Question 6: In counterintelligence operations, what is a 'double agent'?
- An agent who operates simultaneously in two foreign countries
- An individual who is known to a foreign intelligence service but is actually controlled by the host nation's CI service (Correct answer)
- An undercover officer who uses two separate cover identities
- A field agent who collects both HUMINT and SIGINT simultaneously
Correct answer: An individual who is known to a foreign intelligence service but is actually controlled by the host nation's CI service
A double agent appears to serve a foreign intelligence service but is actually under the control of the host nation's counterintelligence service, allowing CI officers to feed disinformation and monitor adversary methods.
Question 7: Which of the following best describes the 'need-to-know' principle and its importance in counterintelligence?
- All personnel with a security clearance should have access to all classified information at their clearance level
- Access to classified information should be granted based solely on an individual's rank or seniority
- Cleared individuals should only access classified information required to perform their specific duties (Correct answer)
- Classified information should be shared broadly to ensure mission coordination
Correct answer: Cleared individuals should only access classified information required to perform their specific duties
The need-to-know principle limits classified information access to only those whose specific duties require it, minimizing the potential damage from any single compromise or insider threat.
CFA Counterintelligence Awareness & Threat Recognition 1
What is the primary objective of counterintelligence (CI) operations?