Evelyn is a system administrator at her agency and wants to use a thumb drive — is her use acceptable?

The answer

Evelyn's use of the thumb drive is acceptable because it satisfies the three conditions the DoD and federal cybersecurity policy require for removable media on a government system:

1. It is Government-owned or Government-provided — not a personal or unknown device.
2. It is operationally necessary — there is a legitimate work reason to use it.
3. It is approved under her agency's policy and by the appropriate authority.

When all three are true, using removable media is permitted. The scenario is designed to test whether you recognize that removable media is not banned outright—it is restricted to a narrow, controlled set of circumstances. Because Evelyn is a system administrator acting within approved policy on a Government-provided device for a necessary task, her conduct is compliant.

Why the other options are wrong

The distractors in this Cyber Awareness question usually push you toward absolutist answers:

• "Removable media is never allowed on government systems." Wrong. It is discouraged and heavily controlled, but Government-owned, approved, operationally necessary use is explicitly permitted.
• "It's fine because she's an administrator." Wrong reasoning even if the outcome is 'acceptable'—privilege alone does not authorize it. The authorization comes from approval, ownership, and necessity, not from her job title.
• "It's acceptable to use her personal USB drive since she is trusted." Wrong. Personal or unapproved devices are prohibited regardless of the user's trust level, because they bypass the controls that ensure the device is clean and accounted for.
• "She may use any found or unlabeled drive if she scans it first." Wrong. Unknown media (especially found devices) must never be connected; they are a classic malware-delivery and 'baiting' vector.

The bigger picture

Removable media—thumb drives, external hard drives, SD cards, CDs—are a top cybersecurity risk because they can silently introduce malware (the infamous Stuxnet worm spread this way), enable data exfiltration, and evade network monitoring. This is why the DoD banned uncontrolled use after major incidents and now permits it only under strict conditions.

Before using any removable device, a system administrator should confirm: the device is Government-issued and inventoried, the use is documented and approved, the action is operationally necessary (no safer alternative like an approved network transfer), and the media is encrypted and scanned. If any of those fail, the correct action is to stop and not connect the device. Evelyn passes each check, so her use is authorized and correct.