Tularemia’s potential as a bioweapon is driven by how readily it can cause disease once people are exposed. The key point is a very low infectious dose—only a small number of organisms can establish infection in humans. That high infectivity means a release or exposure can lead to illness across many people even if the dissemination isn’t extensive or sophisticated. Mortality isn’t the defining feature here; while untreated cases of tularemia can be severe, mortality is not consistently high with modern treatment, so focusing on how easily people become ill is the most relevant factor for weaponization potential. In contrast, claiming it requires high-tech dissemination doesn’t fit the material, since it can be spread through relatively simple means and still cause illness. So, the best description is that it has high infectivity.

Defending against phishing requires a layered approach that addresses both people and technology. Training builds the habit of spotting suspicious emails, avoiding risky actions, and reporting phishing attempts, which lowers the likelihood of credential theft. Phishing simulations reinforce that training with realistic practice and provide metrics to tailor ongoing education. Technical controls like multi-factor authentication make it much harder for attackers to misuse stolen credentials, since a second factor is needed. Email filtering and security gateways block many phishing messages before they reach users, and proper email authentication standards (such as DMARC, DKIM, SPF) help verify legitimate senders. Put together, these elements create a defense-in-depth that reduces both the chance of a phish succeeding and the damage if one slips through. Relying on only one part leaves gaps, while the full combination provides the strongest protection.

Noncombatant immunity is the protection that civilians and civilian objects must not be targeted and should be shielded from the effects of armed conflict. This means that, in war, the rule is to distinguish between military objectives and civilians, aiming attacks only at legitimate military targets while minimizing harm to noncombatants. That’s why the statement about civilians and civilian objects being protected from the effects of armed conflict is the best choice. A useful nuance is that civilians who directly participate in hostilities lose that protection for the duration of their participation, but this is limited to those specific actions and does not grant blanket permission to target all civilians. The other options overstate or misstate the protection: targeting civilians if they engage in hostilities ignores the broader immunity that normally applies, and saying only military targets are protected or that immunity applies only in peacetime are both incorrect.

Accreditation and authorization provide the formal approval that a system’s security controls have been properly implemented and tested, and that the residual risk is acceptable before the system is allowed to operate. In this process, evidence from the system security plan, testing of controls, and risk assessment is reviewed by an authorizing official who grants an authorization to operate (ATO) under defined conditions. This pre-operation sign-off ensures that security requirements are met and agreed upon before the system goes live, with ongoing monitoring to maintain compliance. Patch management is about applying updates to fix vulnerabilities and keep software current, not the formal pre-use clearance. Change control governs modifications after deployment to maintain baseline integrity. Risk acceptance is the decision to operate with identified risks, but it doesn’t by itself certify that security requirements are met before operation.

Mission Analysis centers on framing the problem and establishing what success looks like. It asks you to clarify the mission, define the end state—the condition you want to achieve when the mission is complete—and identify the tasks, forces, and constraints that will shape how you approach the operation. This step gathers the important facts, identifies knowledge gaps, and surfaces risks, so planners know what information they need as they develop courses of action. This focus is why it’s the best fit: it sets the foundation for everything that follows, ensuring later steps—like developing and comparing courses of action—are grounded in a clear understanding of what must be achieved, who or what will do the work, and what limits or restrictions must be respected. It’s not about allocating resources, creating COAs, or evaluating weapon feasibility—that comes later or in different analyses.