Q: From an antiterrorism perspective, espionage and security negligence are considered insider threats.
✔ TRUE — Insider threats include espionage (spying), sabotage, theft, unauthorized disclosure, and security
negligence. Anyone with authorized access who misuses it poses an insider threat.
Q: From an antiterrorism perspective, espionage and security negligence are NOT considered insider
threats.
✘ FALSE — This is the FALSE version of the same concept — both espionage AND security negligence ARE
insider threats under the DoD definition.
Q: Which one of the following is NOT an early indicator of a potential insider threat?
✔ A reasonable disagreement over US Government policy
(Reasonable policy disagreement is a protected expression of opinion — it is NOT an insider threat indicator.
Actual indicators include: abnormal mood swings, depression, suicidal remarks, presence of unauthorized
weapons, aggression or threats toward coworkers, and sudden unexplained wealth.)
Q: Knowing indicators of an unstable person can allow you to identify a potential insider threat before an
incident.
✔ TRUE — Early recognition of behavioral warning signs — such as extreme mood changes, expressions of
grievance, unusual interest in security systems, or threats — can help prevent incidents.
Q: Persons who have been given access to an installation can be counted on to be of no threat.
✘ FALSE — Access does NOT equal trustworthiness. Insider threats often come from authorized personnel.
Always remain vigilant and report suspicious behavior through proper channels.
Section 5: Active Shooter Response
Q: Active resistance should be the immediate response to an active shooter incident.
✘ FALSE — The preferred response order is: RUN (escape if possible) → HIDE (barricade/shelter) → FIGHT
(actively resist only as a last resort when your life is in immediate danger).
Q: In an active shooter incident involving firearms, you should immediately lie on the ground.
✘ FALSE — Lying on the ground makes you a stationary target. Instead: RUN if a clear escape route exists,
HIDE behind solid cover if you cannot escape, or FIGHT as a last resort.
Q: Which of the following is NOT a recommended response to an active shooter incident?
✔ Provide instructions to arriving law enforcement personnel or stop them to ask for help
(When law enforcement arrives, DO NOT: stop them, give them instructions, or try to help them. Instead: keep
your hands visible, follow all commands, and do not make sudden movements. Let professionals take control.)
Q: Which of the following IS a recommended response to an active shooter?
✔ Look for a place to hide or an area that can be barricaded / Look for possible escape routes / Find
something solid to take cover behind / If necessary, actively resist as a last resort
(The Run-Hide-Fight protocol: Escape if possible, barricade/hide if you cannot escape, and fight only when
there is no other option to survive.)
Section 6: Hostage Situations & Skyjacking
Q: The initial moments of a hostage taking incident can be extremely dangerous.
✔ TRUE — The first few minutes of a hostage incident are the most dangerous — captors are agitated and
may react violently. Stay calm, comply with instructions, and avoid confrontation.