I85PREP
⌘ K
Military Cyber Test study materials
Military Cyber Test study resources

Military Cyber Test practice questions

One question at a time. Build your Military Cyber Test understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cyber Operations Fundamentals and Doctrine

In U.S. joint doctrine, which term describes the integrated employment of offensive and defensive cyberspace operations to achieve objectives in and through cyberspace?

  1. Electronic warfare
  2. Cyberspace operations Correct answer.
  3. Information operations
  4. Network management

Explanation

Cyberspace operations encompass offensive, defensive, and DoD information network operations conducted to achieve objectives in or through cyberspace. Electronic warfare and information operations are related but distinct mission areas that only partially overlap with cyberspace.

Question 2Cyber Operations Fundamentals and Doctrine

A commander wants to deny an adversary the use of a specific computer network to reduce its military effectiveness. Which category of cyberspace operation does this describe?

  1. DoD information network operation
  2. Defensive cyberspace operation
  3. Cyberspace security operation
  4. Offensive cyberspace operation Correct answer.

Explanation

Offensive cyberspace operations are employed to deny, degrade, disrupt, destroy, or manipulate adversary or target systems to create effects that support the mission. Denying an adversary network use is the classic OCO objective.

Question 3Cyber Operations Fundamentals and Doctrine

Which authority must a military commander typically obtain before conducting offensive cyberspace operations outside an area of active hostilities?

  1. An internet service provider notice
  2. A vendor license agreement
  3. A network administrator's change ticket
  4. A presidential or secretary-level authorization via the approval chain Correct answer.

Explanation

Offensive cyberspace operations require national-level authorization through the established approval chain, because of escalation risk and the need for policy and legal review. Technical or commercial approvals cannot substitute for this authority.

Question 4Cyber Operations Fundamentals and Doctrine

The principle of distinction in the law of armed conflict, applied to cyberspace, requires that operations be directed at military objectives rather than civilian objects. Which target best satisfies this principle?

  1. A hospital's patient records server
  2. A public university research system
  3. A civilian power grid serving a city
  4. A military command-and-control network Correct answer.

Explanation

Distinction requires directing operations against military objectives, and a military command-and-control network is a clear military objective. Civilian infrastructure such as hospitals, power grids, and universities is presumptively protected unless it becomes a military objective.

Question 5Cyber Operations Fundamentals and Doctrine

Which concept describes the condition in which cyberspace operations are coordinated with and support the joint force's overall campaign rather than pursued in isolation?

  1. Network segmentation
  2. Spectrum deconfliction
  3. Cyberspace integration Correct answer.
  4. Data sovereignty

Explanation

Cyberspace integration means cyberspace effects and capabilities are planned and synchronized with the joint campaign to support commander's objectives. It prevents cyber actions from being treated as disconnected technical events.

Question 6Cyber Operations Fundamentals and Doctrine

A defensive cyberspace operation that deploys sensors and analytic tools to detect intrusion attempts across a military enclave is best described as which type of mission?

  1. Offensive response
  2. Influence operation
  3. Passive defense
  4. Active defense Correct answer.

Explanation

Active defense involves detecting, tracking, and countering adversary activity within or near friendly networks, including the use of sensors and hunt tools. Passive defense emphasizes hardening and architecture rather than active detection and maneuver.

Question 7Cyber Operations Fundamentals and Doctrine

In the mission assurance construct, what does the 'defense in depth' principle primarily achieve for a military network?

  1. Replaces the requirement for operational planning
  2. Layers independent controls so a single failure does not compromise the whole Correct answer.
  3. Guarantees that no intrusion can ever succeed
  4. Eliminates the need for user authentication

Explanation

Defense in depth layers multiple independent protective measures so that the failure of one control does not expose the entire system. No architecture guarantees absolute security, but layering raises cost and reduces single points of failure.

Question 8Cyber Operations Fundamentals and Doctrine

Which activity best exemplifies computer network defense (CND) within a military enclave?

  1. Monitoring enclave traffic for indicators of compromise and blocking malicious flows Correct answer.
  2. Exploiting an adversary router to collect intelligence
  3. Drafting the campaign's information operations annex
  4. Procuring new encryption hardware

Explanation

Computer network defense protects and monitors one's own networks, so traffic monitoring and blocking malicious flows are core CND activities. Exploiting adversary systems is offensive, while drafting annexes and procurement are staff or acquisition functions.

Question 9Cyber Operations Fundamentals and Doctrine

A military planner must ensure that a cyber effect against an adversary's logistics system is synchronized with a kinetic strike on the same target set. Which planning consideration is most directly engaged?

  1. Frequency allocation
  2. Deconfliction and effects synchronization Correct answer.
  3. Configuration management
  4. Personnel security clearance review

Explanation

When cyber and kinetic effects target the same or interdependent systems, planners must deconflict timing and synchronize effects to avoid interference and unintended consequences. This is an effects-coordination problem rather than an administrative one.

Question 10Cyber Operations Fundamentals and Doctrine

Which statement best captures the relationship between cyberspace and the electromagnetic spectrum?

  1. Cyberspace operations never involve radio links
  2. The electromagnetic spectrum is a subset of cyberspace
  3. Cyberspace relies partly on the electromagnetic spectrum for wireless transmission Correct answer.
  4. Cyberspace is entirely independent of the electromagnetic spectrum

Explanation

Cyberspace is a domain that includes physical network infrastructure and the electromagnetic spectrum used for wireless links. The two overlap but neither is wholly a subset of the other.

Question 11Cyber Operations Fundamentals and Doctrine

What is the primary purpose of a rules of engagement (ROE) annex for cyberspace operations?

  1. To specify the technical protocols used in an exploit
  2. To list the vendor products installed on a network
  3. To define the circumstances and limits under which forces may act Correct answer.
  4. To document the network's IP address plan

Explanation

Rules of engagement define when and how forces may use capabilities, including constraints and escalation thresholds. They are policy and legal instruments, not technical configuration documents.

Question 12Cyber Operations Fundamentals and Doctrine

A commander is told that a proposed cyber action risks collateral effects on civilian systems. Under the principle of proportionality, what must be assessed?

  1. Whether the operation can be completed within the budget
  2. Whether the adversary has previously conducted cyber operations
  3. Whether the target uses open-source software
  4. Whether the expected incidental harm is excessive relative to the anticipated military advantage Correct answer.

Explanation

Proportionality requires weighing expected incidental civilian harm against the concrete and direct military advantage anticipated. The assessment is about relative harm and advantage, not cost or adversary history.

Question 13Cyber Operations Fundamentals and Doctrine

Which of the following best describes an 'operation in the information environment' as it relates to cyberspace doctrine?

  1. Actions affecting information, systems, and perceptions to influence decision-making Correct answer.
  2. Any use of social media by service members
  3. A hardware refresh cycle for servers
  4. A cryptographic key rotation schedule

Explanation

Operations in the information environment affect information, information systems, and perceptions to shape adversary and audience decision-making. Cyberspace operations are one contributor within this broader environment.

Question 14Cyber Operations Fundamentals and Doctrine

In cyber mission planning, what does the term 'target system analysis' primarily produce?

  1. A training schedule for network defenders
  2. A legal opinion on the operation's authority
  3. An understanding of the target's architecture, dependencies, and potential effects Correct answer.
  4. A list of approved vendors for hardware

Explanation

Target system analysis develops knowledge of a target's architecture, dependencies, and how effects might propagate so planners can select actions. It is an intelligence and planning product, not a legal or administrative one.

Question 15Cyber Operations Fundamentals and Doctrine

Which action best illustrates the principle of 'persistent engagement' as discussed in contemporary military cyber discourse?

  1. Disconnecting from all networks to avoid risk
  2. Maintaining ongoing operations to contest adversary activity and shape the environment Correct answer.
  3. Outsourcing all defense to a commercial provider
  4. Conducting a single one-time network scan

Explanation

Persistent engagement emphasizes continuous contesting of adversary activity below the threshold of armed conflict to impose cost and shape behavior. It is an ongoing operational posture, not a one-time event.

Question 16Cyber Operations Fundamentals and Doctrine

A military unit discovers malware beaconing from a classified enclave. Which initial defensive step best reflects incident response doctrine?

  1. Publish the indicators on public social media
  2. Contain and isolate affected systems while preserving evidence Correct answer.
  3. Immediately launch offensive operations against the suspected source
  4. Disable all authentication across the enterprise indefinitely

Explanation

Incident response doctrine begins with containment and evidence preservation so the scope can be understood and the intrusion stopped without destroying forensic data. Offensive action requires separate authorization and is not an automatic first step.

Question 17Cyber Operations Fundamentals and Doctrine

Which document type typically establishes the commander's intent, objectives, and tasks for a cyberspace operation within a joint campaign?

  1. A vulnerability disclosure policy
  2. A service level agreement
  3. A concept of operations Correct answer.
  4. A software bill of materials

Explanation

A concept of operations articulates intent, objectives, and how forces will accomplish the mission within the campaign. The other documents are technical, contractual, or policy artifacts rather than operational plans.

Question 18Cyber Operations Fundamentals and Doctrine

What is the primary doctrinal rationale for assigning cyberspace operations to a dedicated component command rather than to individual units?

  1. To avoid coordination with other domains
  2. To centralize authorities, deconfliction, and technical expertise across the joint force Correct answer.
  3. To eliminate the need for intelligence support
  4. To reduce the number of personnel in the military

Explanation

A dedicated component centralizes authorities, deconfliction, and specialized expertise so cyberspace effects are coordinated across the joint force. It increases, rather than removes, the need for intelligence and cross-domain coordination.

Question 19Cyber Operations Fundamentals and Doctrine

Which of the following is an example of a 'cyber key terrain' consideration in operational planning?

  1. Choosing the office location for the planning team
  2. Deciding which font to use in the operations order
  3. Selecting the color scheme of the operations dashboard
  4. Identifying network nodes whose control enables or denies mission accomplishment Correct answer.

Explanation

Key terrain in cyberspace refers to systems or nodes whose seizure, control, or denial significantly affects mission success. The other options are administrative or cosmetic choices.

Question 20Cyber Operations Fundamentals and Doctrine

In the context of military cyber operations, what does 'attribution' primarily involve?

  1. Registering a domain name with a registrar
  2. Encrypting all traffic on a network
  3. Assigning a cost center to a network upgrade
  4. Determining the identity or origin of an actor responsible for cyber activity Correct answer.

Explanation

Attribution is the process of identifying who is responsible for cyber activity, which informs response and policy decisions. It is an analytic and intelligence challenge, not an accounting or encryption task.

Question 21Cyber Operations Fundamentals and Doctrine

A planner proposes a cyber operation that would temporarily disrupt an adversary's air defense network during a strike. Which doctrinal principle most directly supports synchronizing this effect with the strike's timing?

  1. Data minimization
  2. Unity of effort through integrated effects Correct answer.
  3. Separation of duties
  4. Least privilege

Explanation

Integrated effects and unity of effort require cyber and kinetic actions to be synchronized so they reinforce rather than interfere with one another. Least privilege, separation of duties, and data minimization are security administration principles.

Question 22Cyber Operations Fundamentals and Doctrine

Which statement about the 'dual-use' nature of many cyber targets is most accurate for military planning?

  1. Dual-use systems are never lawful targets
  2. Dual-use systems are always lawful targets without further analysis
  3. Dual-use status only matters for maritime operations
  4. Dual-use systems require careful legal and operational analysis because they serve both civilian and military purposes Correct answer.

Explanation

Dual-use systems serve both civilian and military functions, so planners must analyze whether and how they qualify as military objectives and weigh collateral effects. Neither automatic lawfulness nor an absolute prohibition is correct.

Question 23Cyber Operations Fundamentals and Doctrine

What role does a 'cyber protection team' typically play in support of a deployed unit?

  1. It conducts strategic nuclear planning
  2. It manages the unit's public affairs messaging
  3. It negotiates contracts with software vendors
  4. It hunts for and mitigates threats on the unit's networks and advises on defensive posture Correct answer.

Explanation

Cyber protection teams perform threat hunting, incident response, and defensive posture assessment for supported units. They are defensive technical assets, not strategic nuclear, contracting, or public affairs elements.

Question 24Cyber Operations Fundamentals and Doctrine

Which consideration most directly limits the use of a discovered vulnerability in an offensive cyber operation?

  1. The rank of the network administrator
  2. The color of the exploit developer's badge
  3. The potential that disclosure would allow defenders to patch and eliminate the capability Correct answer.
  4. The number of pages in the operations order

Explanation

Using a vulnerability offensively risks its discovery and patching, which can eliminate a capability and affect intelligence value. This tradeoff between use and disclosure is a central policy and operational consideration.

Question 25Cyber Operations Fundamentals and Doctrine

In joint doctrine, what distinguishes 'cyberspace operations' from 'information operations'?

  1. Cyberspace operations act in and through networks, while information operations coordinate influence activities across multiple means Correct answer.
  2. Information operations are exclusively technical network attacks
  3. Cyberspace operations never involve influence effects
  4. The two terms are exact synonyms in all doctrine

Explanation

Cyberspace operations are conducted in and through networks, whereas information operations coordinate influence and information activities across multiple means, including but not limited to cyberspace. They overlap but are not synonyms.

Question 26Cyber Operations Fundamentals and Doctrine

Within the cyberspace operations mission framework, which set of activities is conducted to secure friendly networks and protect data, systems, and capabilities from adversary exploitation?

  1. Department of Defense information network operations (DoDIN ops) Correct answer.
  2. Cyberspace situational awareness (SA)
  3. Defensive cyberspace operations (DCO)
  4. Offensive cyberspace operations (OCO)

Explanation

DoDIN operations encompass the operate-and-maintain activities that build, secure, and sustain friendly networks, including configuration management, patching, and identity control. DCO responds to active threats and intrusions against those networks, while OCO projects effects into adversary systems. The distinction matters because DoDIN ops are continuous and foundational, whereas DCO is triggered by adversary activity.

Question 27Cyber Operations Fundamentals and Doctrine

A joint force commander wants cyber effects integrated into the targeting cycle so that a network attack on an adversary command node is timed with a ground maneuver. Which planning process most directly supports this synchronization?

  1. The intelligence preparation of the operational environment
  2. The joint targeting cycle Correct answer.
  3. The defense readiness reporting process
  4. The operational security review

Explanation

The joint targeting cycle provides the structured sequence of end-state objectives, target development, capabilities analysis, commander's decision, mission planning and force execution, and assessment, which is how cyber effects are synchronized with other fires and maneuver. Intelligence preparation of the battlefield feeds target development but does not itself sequence and deconflict effects. Timing and deconfliction across domains are the defining outputs of the targeting cycle.

Question 28Cyber Operations Fundamentals and Doctrine

A cyber planner must decide whether a proposed effect against an adversary's logistics network should be authorized under title 10 or title 50 authorities. Which factor most directly determines that choice?

  1. Whether the operation is covert action intended to influence political or economic conditions abroad, or a traditional military activity Correct answer.
  2. Whether the operation is conducted by a joint or a single-service element
  3. Whether the target network uses commercial off-the-shelf hardware
  4. Whether the effect is delivered through a network or through a kinetic munition

Explanation

The legal characterization turns on the nature and purpose of the activity: covert action designed to influence conditions abroad falls under title 50 findings, while traditional military activities are conducted under title 10. The delivery medium, the equipment used, and the command arrangement do not by themselves control the authority. Planners must therefore frame the operation's purpose and intended effect before selecting the legal basis.

Question 29Cyber Operations Fundamentals and Doctrine

During a mission, a cyber operator discovers that an exploited adversary system is also used by a neutral third-country hospital. Which course of action best reflects the doctrinal principle of distinguishing military objectives from protected objects?

  1. Proceed with the effect and document the hospital as incidental damage afterward
  2. Reclassify the hospital as a military objective because it supports civilian infrastructure
  3. Delegate the decision to the lowest tactical level to preserve operational tempo
  4. Suspend or modify the effect until the protected function can be separated or the risk is reduced Correct answer.

Explanation

The principle of distinction requires that effects be directed at military objectives and that protected objects such as hospitals be spared; when a target is dual-use, the operation should be paused or adjusted to reduce risk to protected functions. Proceeding and documenting harm afterward inverts the requirement to take precautions before acting. Reclassifying a hospital as a military objective is not a permissible workaround.

Question 30Cyber Operations Fundamentals and Doctrine

A staff assesses that a cyber capability has a very narrow window of exploitability because the underlying vulnerability will likely be patched after first use. How should this characteristic most influence operational planning?

  1. It should require that the effect be delivered only through non-kinetic means
  2. It should lead planners to disclose the vulnerability publicly to deter adversaries from using similar ones
  3. It should be ignored because operational planning deals only with effects, not with technical persistence
  4. It should drive the capability toward persistent access that survives patching, and shape timing and intelligence requirements around a use-it-or-lose-it decision Correct answer.

Explanation

A vulnerability that is likely to be closed after discovery creates a perishable capability, so planners must weigh the value of immediate use against the loss of future access and invest in persistent access paths that survive patching. This shapes the timing of the operation and the intelligence needed to confirm the target state. Treating the limitation as irrelevant or as a reason for public disclosure misreads how military cyber capabilities are managed.

Question 31Offensive Cyber Operations and Mission Planning

In joint operation planning, which product translates strategic and theater objectives into a prioritized list of cyber effects that must be delivered to support the commander's concept of operations?

  1. The intelligence collection plan
  2. The communications status report
  3. The cyber effects synchronization matrix Correct answer.
  4. The joint targeting list

Explanation

A cyber effects synchronization matrix maps each planned effect to the target, timing, supported maneuver or fires event, and responsible cyber element, which is exactly how theater objectives become a prioritized, time-phased delivery list. It is a planning and deconfliction artifact rather than a targeting nomination list or an intelligence collection tool.

Question 32Offensive Cyber Operations and Mission Planning

Which term describes the staff estimate that a cyberspace operations planner produces to recommend the most effective use of cyber capabilities in support of a proposed course of action?

  1. Cyberspace course of action support estimate Correct answer.
  2. Cyber operations feasibility assessment
  3. Network terrain analysis annex
  4. Mission assurance risk register

Explanation

Planners prepare a cyberspace course of action support estimate that compares candidate cyber actions against each friendly course of action, weighing feasibility, risk, and contribution to objectives. It feeds the staff's course of action comparison rather than replacing it.

Question 33Offensive Cyber Operations and Mission Planning

During mission planning, the deconfliction of cyberspace operations with other joint fires primarily serves which purpose?

  1. Synchronizing intelligence collection with the targeting cycle
  2. Preventing friendly units from accidentally engaging the same physical target
  3. Guaranteeing that cyber effects achieve their intended target effects
  4. Ensuring cyber effects do not unintentionally disrupt friendly or neutral systems relied upon by the joint force Correct answer.

Explanation

Deconfliction ensures that a planned cyber effect will not degrade or destroy systems that the joint force, partners, or protected populations depend upon, and that it does not collide with other fires. Achieving the intended effect is a target development concern, not the purpose of deconfliction.

Question 34Offensive Cyber Operations and Mission Planning

Which planning artifact documents the specific authorities, legal review, and approval chain required before a proposed cyberspace operation may be executed?

  1. The target folder
  2. The after-action report
  3. The execution checklist
  4. The authorities and approval annex Correct answer.

Explanation

Cyberspace operations require documented authority because effects may cross geographic and organizational boundaries and implicate legal and policy constraints. An authorities and approval annex records who may approve the action, under what legal basis, and through which chain.

Question 35Offensive Cyber Operations and Mission Planning

A planner must determine whether a proposed cyber effect against an adversary command-and-control node will also affect a coalition partner sharing the same infrastructure. Which analytic step addresses this concern?

  1. Pattern-of-life analysis
  2. Battle damage assessment
  3. Collateral effects assessment Correct answer.
  4. Target validation board review

Explanation

A collateral effects assessment evaluates unintended consequences of an action on systems, persons, or infrastructure beyond the intended target, including partner and neutral dependencies. It is performed before approval so that mitigation or alternate options can be developed.

Question 36Offensive Cyber Operations and Mission Planning

Which of the following best describes the purpose of a cyber mission analysis during the joint planning process?

  1. To identify the friendly and adversary cyberspace capabilities, dependencies, and vulnerabilities relevant to the mission Correct answer.
  2. To compile the after-action lessons learned
  3. To approve the commander's intent for cyberspace operations
  4. To execute the cyber tasking order

Explanation

Mission analysis frames the problem: it identifies the operational environment, adversary and friendly cyberspace capabilities, critical dependencies, and vulnerabilities that shape feasible options. Approval of intent and execution of tasking occur later in the process.

Question 37Offensive Cyber Operations and Mission Planning

In the joint targeting cycle, at which phase is a cyberspace target's functional characterization and vulnerability analysis primarily accomplished?

  1. Target development Correct answer.
  2. Capabilities analysis
  3. Mission planning and force execution
  4. Commander's objectives and guidance

Explanation

Target development is the phase in which targets are characterized functionally, their critical elements identified, and vulnerabilities analyzed against available capabilities. Capabilities analysis then matches those vulnerabilities to specific means.

Question 38Offensive Cyber Operations and Mission Planning

A cyberspace operations planner is drafting the portion of the plan that describes how cyber actions will support the main effort at a decisive point. Which planning element is being addressed?

  1. The intelligence estimate
  2. The personnel status report
  3. The logistics annex
  4. The scheme of employment Correct answer.

Explanation

The scheme of employment describes how and when capabilities, including cyberspace effects, will be employed to support the concept of operations and the main effort. It links effects to decisive points and timing.

Question 39Offensive Cyber Operations and Mission Planning

An operational planner learns that a critical friendly logistics system shares a software component with an adversary target. What is the most appropriate planning response?

  1. Assess the shared dependency and develop mitigation or an alternate target before approval Correct answer.
  2. Delegate the decision to the intelligence staff without further review
  3. Proceed with the effect because the target is a valid military objective
  4. Cancel all cyber operations in the theater

Explanation

Shared dependencies create a risk of unintended friendly disruption, so the planner must conduct collateral effects analysis and identify mitigations, timing adjustments, or alternate targets before seeking approval. Validity of the military objective does not eliminate the need to weigh foreseeable incidental harm.

Question 40Offensive Cyber Operations and Mission Planning

Which best explains why cyberspace operations often require earlier coordination with the intelligence community than kinetic strike planning?

  1. Intelligence personnel must approve all cyber operations
  2. Cyber effects are always reversible and therefore require less planning
  3. Access development and target characterization can take considerable time before an effect is feasible Correct answer.
  4. Kinetic strikes do not require target development

Explanation

Delivering a cyber effect depends on gaining and maintaining access and understanding the target's configuration, which can require lengthy intelligence preparation. This lead time means planners must initiate coordination early to align effects with operational timelines.

Question 41Offensive Cyber Operations and Mission Planning

A commander wants a cyber effect to shape adversary decision-making before a ground offensive begins. Which planning consideration most directly governs the timing of that effect?

  1. The synchronization of the effect with the phase of the operation and the supported maneuver Correct answer.
  2. The number of personnel assigned to the cyber unit
  3. The adversary's network refresh schedule
  4. The classification level of the target folder

Explanation

Cyber effects must be synchronized with the phases of the operation and the supported maneuver so that the effect produces the desired shaping outcome at the right moment. While technical factors such as refresh cycles may affect feasibility, they do not govern operational timing.

Question 42Offensive Cyber Operations and Mission Planning

During course of action development, a planner identifies a cyber capability that could achieve a desired effect but would reveal a sensitive access. What is the most appropriate staff action?

  1. Report the option only to the intelligence staff
  2. Execute the option immediately to exploit the opportunity
  3. Exclude the option without documentation to protect the source
  4. Include the option and document the risk to the access as a planning consideration Correct answer.

Explanation

The course of action should be presented with its operational risk, including the potential loss of a sensitive access, so the commander can weigh the tradeoff against the objective. Silently discarding or unilaterally executing the option removes the decision from the commander.

Question 43Offensive Cyber Operations and Mission Planning

What distinguishes a cyber tasking order from a cyber effects synchronization matrix?

  1. The matrix is classified and the tasking order is unclassified
  2. The tasking order is a planning product, while the matrix is an execution order
  3. The tasking order directs execution of specific tasks, while the matrix aligns planned effects with operations for deconfliction Correct answer.
  4. The tasking order is used only for defensive operations

Explanation

The tasking order is an execution document that assigns specific tasks to cyber elements with timing and reporting requirements. The synchronization matrix is a planning tool that aligns effects with the broader operation and supports deconfliction.

Question 44Offensive Cyber Operations and Mission Planning

A planner is considering a cyber effect that would disable an adversary air defense network. Which additional factor is most important to confirm before recommending the effect?

  1. Whether the adversary uses the same network to control civil air traffic Correct answer.
  2. Whether the effect is reversible within one hour
  3. Whether the effect can be delivered by a single operator
  4. Whether the target folder is complete

Explanation

If the air defense network also supports civil air traffic control, disabling it could cause serious incidental harm to civilians, which must be assessed before recommending the effect. Operator count, folder completeness, and reversibility do not address that humanitarian risk.

Question 45Offensive Cyber Operations and Mission Planning

In the joint planning process, when is the cyber effects estimate most useful to the commander?

  1. Only during the redeployment phase
  2. During course of action comparison and selection Correct answer.
  3. Before mission analysis begins
  4. After the operation is executed

Explanation

The cyber effects estimate informs course of action comparison by showing what cyber capabilities can contribute, at what risk, to each option, enabling the commander to select the best course of action. It is not useful only before mission analysis or after execution.

Question 46Offensive Cyber Operations and Mission Planning

Which consideration most directly limits the persistence of a planned cyber effect during a prolonged operation?

  1. The adversary's ability to patch, reconfigure, or rebuild affected systems Correct answer.
  2. The classification of the plan
  3. The rank of the approving authority
  4. The availability of briefing slides

Explanation

Cyber effects often endure only until the adversary detects and remediates them, so persistence depends on the adversary's capacity and willingness to patch, reconfigure, or rebuild. Planners must account for this when timing effects across phases.

Question 47Offensive Cyber Operations and Mission Planning

A planner proposes a cyber effect that would require access through a third-party nation's infrastructure without that nation's consent. What is the primary planning concern?

  1. Whether the cyber unit has sufficient desk space
  2. Whether the action is consistent with applicable authorities and political constraints Correct answer.
  3. Whether the target folder uses the correct template
  4. Whether the effect can be executed within the current fiscal quarter

Explanation

Operating through third-party infrastructure raises sovereignty and policy questions, so the planner must confirm that the action is consistent with applicable legal authorities and political guidance. Technical or administrative details do not resolve the sovereignty concern.

Question 48Offensive Cyber Operations and Mission Planning

Which statement best characterizes the relationship between cyberspace operations and the commander's operational design?

  1. Cyberspace operations are confined to the information environment and do not affect maneuver
  2. Cyberspace operations replace the need for operational design
  3. Cyberspace operations are planned independently and then appended to the plan
  4. Cyberspace effects are integrated into operational design to create and exploit advantages across all domains Correct answer.

Explanation

Cyberspace effects are woven into operational design so that they create, enable, or exploit advantages that support maneuver, fires, and information operations across domains. They are not an afterthought appended to a completed plan.

Question 49Offensive Cyber Operations and Mission Planning

During execution, a cyber effect produces an unintended outage in a partner's network. Which action best reflects sound mission command?

  1. Conceal the outage to avoid reputational damage
  2. Terminate all cyber operations in the theater
  3. Immediately escalate to a kinetic response
  4. Report the outage through the chain of command and initiate the mitigation plan Correct answer.

Explanation

Mission command requires timely, honest reporting so the commander can reassess risk and direct mitigation, including halting or adjusting the effect. Concealment deprives the commander of decision-relevant information.

Question 50Offensive Cyber Operations and Mission Planning

A planner is asked to recommend a cyber effect against an adversary's propaganda distribution network. Which planning principle most directly applies?

  1. Effects should be planned without regard to the information environment
  2. Effects should always be delivered by the most junior element available
  3. Effects should be selected solely because the capability exists
  4. Effects should be tied to a clearly defined objective and measurable assessment criteria Correct answer.

Explanation

Every proposed effect must trace to a defined objective and include criteria for assessing whether the effect achieved it, which supports accountability and adaptation. Selecting a capability merely because it exists inverts the planning logic.