Counter-Espionage
Counter-espionage is the defensive discipline of detecting, deterring and neutralising state-sponsored intelligence collection against a nation's secrets, people and institutions. The candidate should understand the intelligence cycle from the adversary's perspective - direction, collection, processing, analysis, dissemination - because defensive questions usually ask where in that cycle an intervention bites.
Core concepts: the insider threat and the recruitment cycle (spotting, assessing, developing, recruiting, handling, termination); motivation models (ideology, coercion, ego, money, divided loyalty); tradecraft indicators (unusual travel, unexplained affluence, unsolicited contact, unusual interest in matters beyond one's role); and the difference between collection platforms - human (HUMINT), signals, and open-source. Understand counter-intelligence versus security: CI seeks to understand and neutralise the adversary; security protects assets. Both are needed.
Traps: questions that treat every foreign national as a spy, or that rely on a single indicator. Beware answers that propose entrapment, unauthorised surveillance, or confronting a suspected handler - these compromise investigations and may be unlawful. Another trap is confusing a person of security interest with a proven espionage agent; suspicion is not proof, and handling decisions must be proportionate.
Rule of thumb: report, don't investigate. An employee who notices unusual contact should report through the proper channel rather than probe further. Worked example: a cleared analyst is approached at a conference by someone asking detailed questions about their project. The correct response is to note details, avoid disclosing anything, and report promptly - not to "play along" or confront, because uncontrolled engagement risks tipping off a handler and losing collection value.