ASIS-PSP Physical Security Professional (PSP) Exam Questions and Answers

Natural surveillance is a CPTED principle that enhances visibility in public or semi-public spaces to deter crime. Positioning kitchen windows to overlook a playground increases the likelihood of observation, reducing the opportunity for illicit behavior and enhancing safety.

A (Defensible space) is a broader concept that includes natural surveillance.

B (Territoriality) focuses on expressing ownership of space.

C (Overwatch) is a military/security term not directly used in CPTED.

The best way to express the impact of a risk in business terms is through monetary value. This allows decision-makers to understand the financial consequences of threats and justify investments in controls or mitigation strategies. Assigning a dollar value helps in prioritizing risks and performing cost-benefit analyses.

B (Cost-benefit ratio) is used in analysis, not direct impact expression.

C (Downtime estimate) is useful, but only a part of financial impact.

D (Frequency graph) represents likelihood, not impact.

Comprehensive Detailed Explanation:

Pandemics primarily impact human health and workforce availability rather than directly damaging physical infrastructure. The effects on infrastructure are typically secondary, such as reduced staffing at utilities or service providers, rather than structural destruction (as in natural disasters).

Infrastructure remains physically intact, but operations may be disrupted due to workforce shortages.

Comprehensive Detailed Explanation:

To implement effective preventive maintenance, you must have access to the manufacturer ' s specifications for each component. These specifications provide details such as recommended maintenance intervals, acceptable tolerances, environmental operating conditions, and part replacement guidelines.

A (MTBF), B (Performance reports), and C (Failure rates) are useful for analysis, but the foundational document for preventive action is the manufacturer’s specification.

Reserves are security personnel who are not assigned to fixed posts or patrol routes but are instead held in readiness to respond when assistance is needed. They may be used during emergencies, staffing shortages, or heightened security alerts. Their role is crucial in maintaining flexibility in a security force structure.

In the context of risk management:

A hazard is a condition or factor that increases the likelihood or severity of a peril (a cause of loss).

For example, oily floors (hazard) increase the chance of slips and falls (peril).

A (possible occurrence) and B (probable occurrence) describe likelihood, not hazard.

C (difference between actual and expected losses) refers to variance, not hazard.

The prediction of internal crime (e.g., theft, fraud) heavily relies on historical data to identify patterns, vulnerable departments, and recurring behaviors. This data-driven approach informs proactive security strategies.

A (Background checks) are preventive, not predictive.

B and C offer useful insights but are not the primary basis for trend analysis.

Electronic Article Surveillance (EAS) systems are commonly used in retail environments to prevent theft. These systems often use VHF, microwave, or other radio frequencies to detect tagged merchandise. When someone attempts to exit the store without deactivating the tag, the system sets off an alarm.

A (Point-of-sale surveillance) involves video and transaction monitoring.

C (Dual detector) refers to motion detection in security systems.

D (Magnetometer) is used for metal detection, not retail theft prevention.

The ignition stage is the point at which a fire starts. This occurs when fuel, heat, and oxygen are present in the correct combination and for the right duration. It marks the beginning of combustion and transitions the scenario from a fire hazard to an active fire.

Free burning (A) is a later stage where flames are fully developed.

Pyrolysis stage (C) refers to pre-ignition gas release.

Incipient stage (D) can be synonymous with ignition but more commonly refers to the pre-flame development phase.

A good risk management program incorporates multiple stages:

Identifying risks or vulnerabilities (e.g., threats to assets or processes)

Analyzing risks based on likelihood and potential impact (quantitative or qualitative assessment)

Evaluating and aligning existing or proposed security programs to determine adequacy and needed improvements

All three elements are part of a systematic approach to managing security and organizational risk effectively.

References from PSP: Risk Management Process – ASIS POA; PSP Study Manual – Security Program Development

Comparative fault, also known as comparative negligence, is a legal principle where the plaintiff’s own actions are taken into account when determining liability and awarding damages. If a person contributed to their own injury—e.g., by entering a restricted area—their compensation may be reduced proportionally to their share of fault.

Control tactics (A) and Defensive control (C) relate to use-of-force procedures, not legal doctrines.

Performance testing typically involves precise measurement using calibrated instruments or devices to ensure systems meet specified performance criteria (e.g., camera resolution, sensor range, alarm response time).

A (Operational) testing checks usability.

C (Subsystem) testing targets individual components.

D (Post-maintenance) confirms system functionality after servicing.

Metal halide lamps emit a bright, white light with a bluish cast. This makes them ideal for applications requiring good color rendering and visibility, such as CCTV surveillance or high-intensity outdoor lighting.

A (Sodium vapor) emits yellow/orange light.

C (Mercury vapor) also has a bluish tint but less desirable color rendering.

D (Incandescent) gives off a warm, yellowish light.

Comprehensive Detailed Explanation:

Asset value in physical security is determined not just by its original purchase cost, but by:

Criticality: How essential the asset is to operations or mission success.

Ease of Replacement: Difficulty or time involved in replacing the asset.

Some Measure of Value: This may include financial worth, proprietary importance, or symbolic significance.

This broader view reflects operational risk more accurately than financial cost alone.

A, B, and C mention components but do not include all three core elements correctly.

When a bomb threat targets a specific floor, safety protocols typically mandate evacuation of the identified floor and the floors immediately above and below. This accounts for the potential blast radius and structural impact, ensuring personnel safety in adjacent vulnerable areas.

A is too vague.

C and D (all floors above or below) may be excessive unless threat specifics demand it.

The three types of comparative negligence statutes include:

Pure approach (A): The plaintiff’s compensation is reduced by their percentage of fault, no matter how high.

50/50 rule (B): The plaintiff can recover damages only if their fault is 50% or less.

51 percent rule (C): The plaintiff can recover only if they are less than 51% at fault.

All three are valid comparative negligence models used in different jurisdictions.

Insurance companies provide coverage based on actuarial calculations that allow them to remain profitable. The total amount of premiums collected across all policyholders must exceed the total claims paid. Therefore, the estimated value of all losses across a pool of insured clients is generally less than or balanced with the total premiums collected, ensuring profitability and sustainability for the insurer.

References from PSP: ASIS POA – Insurance Principles and Economics; PSP Manual – Underwriting and Risk Pooling Concepts

An “after action” review is a structured process following an incident, drill, or actual disaster, in which events are documented, timelines are reconstructed, and lessons learned are gathered. Its purpose is to identify what went well, what failed, and what can be improved in future responses.

Testing (A) refers to evaluating procedures before an event.

Quality assurance (B) focuses on performance and compliance but not necessarily post-event analysis.

" All of the above " (D) is incorrect because only after action includes all these specific elements.

Span of control refers to the number of subordinates or direct reports that a manager or supervisor can effectively oversee. A narrower span (fewer direct reports) typically allows for closer supervision, while a wider span may require more autonomy among subordinates.

In security management, span of control helps determine appropriate team structures and resource allocation, especially in large-scale operations.

An electric strike allows for remote electrical locking and unlocking while still permitting free mechanical egress from the protected (inside) side of the door. This is essential for life safety and code compliance, especially in commercial and public buildings.

A (Vertical pin) is a mechanical lock component, not an electric device.

B (Electromagnetic) locks typically require power to release and may not allow mechanical egress without integration.

D (Delayed egress) restricts exit temporarily, which may violate free egress rules depending on application.

Recruitment into jihadist or other terrorist movements typically involves identifying individuals vulnerable to radical ideology, indoctrinating them through propaganda and religious misinterpretation, and then training them for operational activities, including attacks or support roles.

In biometric systems:

False Acceptance Rate (FAR) represents unauthorized access.

False Rejection Rate (FRR) represents inconvenience to legitimate users.

From a security perspective, a low FAR is more critical because it ensures that unauthorized individuals are not granted access. A higher FRR can be tolerated in high-security environments, as it affects convenience rather than security.

A (low/low) is ideal but harder to achieve.

C and D (high FAR) compromise security.

Under the 51 percent rule, a plaintiff can recover damages only if they are 50% or less at fault. If they are 51% or more responsible, they are barred from any recovery. Thus, the correct condition is that their contribution to the negligence must be less than 51% (i.e., up to and including 50%).

Answers B, C, and D contain incorrect thresholds and wording.

A bidder instruction document typically requests verification of a contractor ' s relevant experience and professional licenses. This ensures the vendor is qualified and legally authorized to perform the work.

A, C, and D include valid components but do not reflect the standard combination used for qualification.

Remote access control using CCTV requires two-way communication to authenticate identity, provide instructions, and ensure that individuals requesting entry can be properly engaged. This supports access decisions made by personnel monitoring remotely.

A and D (monitoring and visual analysis) are important but secondary to communication.

C (constant camera display) is inefficient and not a requirement if smart alerting or switching is used.

Transportation terminals—such as airport cargo areas, seaports, and train yards—have implemented access controls that limit entry to underground or restricted zones. These security measures help prevent unauthorized access and protect critical infrastructure and high-value cargo.

Maritime operations (A) refer to port activities but not specifically to underground security.

Security measures (B) is too general.

Resealing (D) is not relevant to underground access control.

Credit reports not only reflect a person ' s financial condition (debts, credit utilization, bankruptcies), but also provide useful data such as past addresses and the names of previous employers. This auxiliary information is essential during background investigations and helps validate the accuracy of job applications.

Legal and compliance considerations apply; employers must follow fair credit reporting laws and obtain consent.

Comprehensive Detailed Explanation:

During the planning phase of a physical protection system, key deliverables include:

Preliminary design: Conceptual plans showing system layout and strategy.

Drawings: Visual representations that help in communicating system intent and scope.

These work products set the foundation for detailed design and implementation.

A, B, and C include elements used later in the process (procurement, budgeting).

An intangible asset is non-physical but adds value to an organization. A company’s reputation is a prime example—it influences customer trust, brand strength, and business continuity, especially in crisis situations.

A (Patents) are intellectual property, which are intangible but categorized differently.

C (Digital files) are tangible in terms of data assets.

D (Obsolete equipment) is a tangible depreciated asset.

Comprehensive Detailed Explanation:

Site Acceptance Testing (SAT) verifies that a system has been installed properly and functions as intended in the actual operating environment. It checks for compliance with design specifications, performance standards, and functional reliability under real-world conditions.

A (Factory Acceptance Testing) occurs before delivery at the manufacturer’s site.

B (Reliability testing) focuses on system stability over time.

C (Equipment performance testing) is narrower and usually component-level.

Detention, particularly in the context of retail loss prevention, refers to the practice of holding a suspected shoplifter temporarily while investigating or waiting for law enforcement. This concept has evolved to provide legal protection for merchants when they act in good faith and with reasonable cause.

Release (A) and Confinement (B) do not fit the protective context.

None of the above (D) is incorrect because " Detention " is a valid and specific term used.

Annual Loss Expectancy (ALE) is a key financial metric used in risk management to estimate the potential dollar loss per year due to a specific risk. It is calculated as:

ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO).

This helps quantify the financial impact of a threat, allowing better prioritization and budgeting for mitigation efforts.

B (Probability) is part of the ALE calculation but not a dollar-value measure.

C (Criticality) relates to function importance but not direct financial impact.

D (Risk) is broader and includes impact and likelihood, but ALE specifically quantifies impact in dollars.

Private security functions are generally client-centered—focused on protecting the assets, people, and interests of a private entity or organization. In contrast, public law enforcement is tasked with serving the community at large, maintaining public order, and enforcing laws for societal benefit.

This fundamental difference in mission and orientation underpins many of the operational and strategic differences between the two sectors.

Using two geographically and physically separate cable paths ensures redundancy. If one path is damaged (e.g., due to construction, sabotage, or natural disaster), the other can maintain communication. This is a key principle in critical infrastructure protection.

A: Surveillance helps detect issues but doesn’t prevent physical interruption.

B: Wireless is useful but often less reliable and secure than wired systems.

C: Tamper-proof cables increase security but don’t address path redundancy.

Legal encyclopedias are comprehensive reference works that summarize legal principles and doctrines across a wide range of topics. They often include discussions of cases where these principles apply and are used by legal professionals to understand broad areas of law before delving into specific statutes or case law.

Legal document (B) is a broad term and not specific to educational or reference materials.

Formal memorandum (C) is used for legal opinion or communication, not for general legal research.

Security is not a standalone function; it must align with and support the broader mission and strategic goals of the organization. This includes protecting assets, enabling business continuity, and ensuring safety in a way that complements business objectives.

A (Quarterly cycle) is not a standard requirement.

B (Certified manager) is good practice but not a defining mandate.

D (Lowest cost) is not always ideal; effectiveness and alignment are more important than minimal cost.

A complete Physical Protection System (PPS) procurement package must include:

Contract terms and conditions

Instructions for bidders

Technical system specifications

Design drawings

This ensures that all vendors have a uniform understanding of the scope and requirements, leading to accurate and comparable proposals.

A, B, and D include valid elements, but only C includes all core components required at minimum.

Comprehensive Detailed Explanation:

The " Theft Triangle " is a concept used in physical security and loss prevention to illustrate the three primary elements that must exist for theft to occur: motive, desire, and opportunity.

Motive: The reason someone considers committing theft (e.g., financial hardship).

Desire: The internal emotional or psychological urge to obtain something.

Opportunity: The circumstances or vulnerabilities that allow the act to occur.

All three must typically be present for theft to happen. This model is used in behavioral risk assessments and insider threat prevention strategies.

Patrol duty involves moving through assigned routes or areas to monitor activity, detect irregularities, and observe the general condition of the facility. Patrolling can be conducted on foot or by vehicle and is a fundamental component of proactive security operations.

Posts (B) are stationary assignments.

Reserves (C) are backup personnel.

" None of the above " (D) is incorrect because patrol duty is the accurate answer.

Pre-action sprinkler systems are designed to prevent accidental water discharge. These systems include a detection component (such as smoke or heat detectors) that must activate before the water enters the pipes. They are often used in areas where water damage would be catastrophic (e.g., data centers, museums).

Discovery system (A), Exposure (B), and Post-action system (C) are not standard terms in fire suppression.

“Post-action system” is incorrect; the correct terminology is “pre-action system.”

A clearly defined and executed procurement contract is critical to successful implementation of a physical security construction project. It outlines scope, deliverables, timelines, cost structures, and responsibilities, ensuring all parties operate with aligned expectations and accountability.

A (RFQ) is a pricing request, not a contract.

B (BIA) informs continuity planning, not project execution.

D (Cost analysis) is useful but not foundational for execution.

Post orders are written instructions for security personnel detailing duties, responsibilities, and conduct at a specific post. These orders must clearly express the policies and expectations of the protected organization, ensuring alignment with security protocols and business objectives.

A (Reviewing shift log) is a task, not a policy directive.

C (Verbal instructions override written) contradicts best practice.

D (Policies of local authorities) may influence actions but do not replace enterprise policies in post orders.

Asking targeted questions about post orders helps supervisors verify that security officers understand their duties. It encourages engagement, promotes accountability, and reinforces learning through direct interaction.

A (Checking training records) shows completion but not understanding.

B (Logbook review) focuses on past actions, not comprehension.

D (Written report) may test literacy more than actual understanding.

Security consultants are often retained to provide strategic input on staffing needs, policy design, and technology integration. Their advice helps organizations make informed decisions regarding the deployment of personnel, the structure of policies, and the selection of physical and electronic security systems.

The three keys to a successful contract or partnership in the context of security management are:

Accessibility: Open communication and availability between parties.

Meetings: Regular reviews and check-ins to ensure alignment.

Resource Management: Efficient allocation and use of both personnel and technical resources.

These three elements contribute to maintaining accountability, service quality, and responsiveness between the security provider and client.

Scavenging refers to the process of retrieving residual data from system memory (such as RAM) or buffers. This data remains until it is overwritten or the system is powered off. Scavenging can be used by attackers to recover sensitive information such as passwords or encryption keys.

Random memory (A) is not a valid term.

Awaiting memory (C) and Search memory (D) are not industry terms.

Before an enterprise risk analysis can be properly conducted, the security professional must first identify the assets to be protected. These may include people, property, information, and operations. Only after defining what needs protection can threats, vulnerabilities, and risks be effectively evaluated.

A (Identify threats) comes after asset identification.

C (Classify risks) and D (Determine security adequacy) are later stages in the risk management process.

Privacy invasion is a legal or ethical issue, not a type of insurance policy. Common types of insurance relevant to security include:

Fidelity Bonds: Cover losses due to employee dishonesty

Surety Bonds: Provide financial assurance that obligations will be fulfilled

3-D (Dishonesty, Disappearance, and Destruction) Policies: Provide broader coverage for internal and external crimes

Privacy-related issues may be addressed under cyber liability or data breach insurance but not as a standalone policy called “Privacy Invasion.”

The number of security personnel required is typically directly proportional to the size and complexity of a facility, not inversely. Larger facilities or those with more employees often require more security staff to ensure adequate coverage, surveillance, access control, and emergency response. Factors influencing personnel needs include square footage, asset value, location, threat level, and operational hours.

The statement in the question is incorrect, making the correct answer " False. "

When selecting countermeasures, the most important factor is the overall risk posed to the asset or operation. This includes both the likelihood of a threat and the potential impact. Cost, criticality, and probability are components of the risk equation but are not stand-alone decision criteria.

A (Cost) is important for feasibility but follows risk evaluation.

B (Probability) and C (Criticality) contribute to risk but don’t outweigh it individually.

The statement is incorrect. The correct definitions are:

Libel is written defamation—false and damaging statements published in writing or other fixed mediums.

Slander is oral defamation—spoken false statements meant to damage someone’s reputation.

So, libel is not oral; slander is.

The primary objective of a CCTV system is deterrence—by making individuals aware they are being monitored, it discourages unauthorized or criminal behavior. While recording for evidence and employee monitoring are benefits, they are secondary.

A (Reducing guard costs) may be a benefit but is not the main objective.

C (Evidence collection) supports post-incident action but doesn’t directly deter behavior.

D (Watching employees) is an application, not the core goal.

When designing safety and security countermeasures for an existing (especially aging) facility, the first priority for a Physical Security Professional is to assess the current state of physical security. This includes evaluating doors, locks, windows, barriers, structural access points, and environmental design features.

Understanding what currently exists sets the foundation for integrating other systems like fire detection, access control, and intrusion detection.

Fire detection (A) is critical for life safety but not the first step in physical security design.

Access control (B) and intruder detection (D) are components of the overall physical security system and come after baseline evaluation.

A hybrid staffing model uses both proprietary and contract security personnel. In this scenario:

Proprietary staff can be assigned to sensitive and top-secret projects for tighter control, loyalty, and internal vetting.

Contract staff can manage less critical areas such as visitor parking, reducing cost.

This model is both secure and cost-effective, offering flexibility and risk-based deployment.

B (Contract) is cost-effective but lacks control for sensitive tasks.

C (Proprietary) is highly secure but more expensive.

D (Total systems) is not a staffing strategy.

Exterior lighting systems should be formally evaluated at installation and then at least annually to ensure proper function, coverage, and maintenance. Routine checks may occur more frequently, but full surveys are typically annual unless conditions dictate otherwise.

A, B, and C may be appropriate for operational checks, but not full surveys.

Security is increasingly recognized as a critical management function in global business operations. From protecting physical assets to ensuring the safety of personnel and intellectual property, security plays a vital role in risk mitigation and continuity planning. It integrates with other business areas such as compliance, human resources, and information technology.

Backgrounding is the act of conducting a discreet investigation into an applicant’s past and current activities. This includes reviewing criminal records, employment history, education, and possibly financial or social behaviors to evaluate risk before hiring. It ' s a key aspect of the screening process for sensitive or high-trust positions.

Reporting and recording (B, D) involve documentation but not investigative vetting.

Supervisory (C) relates to management, not background checking.

Metal halide lamps provide excellent color rendering that closely resembles natural daylight, making them ideal for enhancing image quality in CCTV systems. However, they are also more expensive to install and maintain compared to other types such as high-pressure sodium or mercury vapor.

A (Mercury vapor) and D (Low-pressure sodium) offer poor color rendering.

B (High-pressure sodium) is efficient but has a yellow hue that distorts colors.

Gopher is a hypertext-based information retrieval tool that predates the World Wide Web. It uses a series of text-based menus to allow users to navigate and access various types of textual information hosted on servers. It was one of the first attempts at organizing and accessing online information in a user-friendly way.

Consortium (A) refers to a group or association, not a technology.

Hyper-text based tool (B) is descriptive but not the specific name of the system.

Symantec (C) is a cybersecurity software company, unrelated to menu-based text access systems.

A Material Safety Data Sheet (MSDS), now standardized globally as a Safety Data Sheet (SDS), includes multiple essential sections, among them:

Product identification (A): Basic information about the chemical, manufacturer, and use.

Hazardous ingredients list (B): Details on harmful components and their concentrations.

Physical characteristics (C): Such as boiling point, vapor pressure, appearance, and odor.

These are just a few of the required elements; current SDS formats usually contain 16 standardized sections.

Comprehensive Detailed Explanation:

Lux is the SI unit of illuminance and is used to measure the amount of light that falls on a surface. It quantifies how much luminous flux is spread over a given area. One lux equals one lumen per square meter. It is critical in physical security when designing lighting for surveillance, perimeter control, or safety.

A is too general.

C (Luminare) refers to a complete lighting unit.

D refers to fluorescent tube operation, not illumination measurement.

Conversion is a civil tort that occurs when one party wrongfully possesses or interferes with another’s personal property (chattel) to the extent that the owner ' s use or rights are seriously restricted or denied. It’s essentially a civil version of theft.

Restriction (A), Transfer (B), and Constraint (C) are not legally specific terms for this tort.

Integrity, in the context of information security, refers to ensuring data is accurate, consistent, and unaltered by unauthorized actions. Maintaining integrity prevents data manipulation or corruption, ensuring reliability for organizational decision-making.

Analysis (A) is the process of evaluating data.

Security (C) is a broader term encompassing integrity, confidentiality, and availability.

Availability (D) ensures access but does not guard against data tampering.

Wide Area Networks (WANs), like LANs, allow multiple devices to share communication lines. In WANs, technologies such as packet switching, virtual circuits, and multiplexing are used to let multiple users communicate over shared infrastructure. This is essential for scalability and efficiency across geographically dispersed locations.

Modern terrorism, unlike historical or localized violence, leverages advanced technologies and global networks. It necessitates comprehensive national strategies involving political decision-making, resource allocation, intelligence, law enforcement, and industry collaboration to combat the sophisticated threats posed.

Annual Loss Expectancy (ALE) is calculated as:

ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO),

which reflects the impact (SLE) and the frequency (ARO) of an event. This formula is a key component in risk assessment for determining expected financial loss.

A, B, and C are partially correct but not the accepted risk formula framework.

Material Safety Data Sheets (MSDS), now referred to as Safety Data Sheets (SDS) under the Globally Harmonized System (GHS), provide detailed information about chemicals, including hazards, handling procedures, and emergency measures. OSHA regulations require employers to maintain these sheets for all hazardous substances in the workplace.

Asset Standard Act (A), Procurement Asset Safety Program (C), and Product Stability Program (D) are not applicable to this requirement.

Record safes are designed primarily to protect documents from fire, not theft. They often lack adequate burglary resistance features. Using record safes for storing valuables such as cash, jewelry, or sensitive items prone to theft is a major security vulnerability. This misapplication can lead to easy compromise during unauthorized access or burglary.

???? References:

ASIS International, Protection of Assets (POA), Chapter: Asset Protection and Safes

ASIS PSP Study Guide, Physical Security Devices

Line executives are individuals in the direct chain of command who are responsible for achieving the core objectives of an organization. They have authority over subordinate personnel and direct responsibility for organizational results. They differ from staff personnel, who provide advice or support but do not directly manage line functions.

Management (A) is a broader term that includes both line and staff.

Authorized directives (B) are formal instructions, not people.

Stockholders (D) are owners, not organizational authorities.

Conditional honesty is a behavior pattern where a person acts honestly primarily due to the fear of being caught or facing consequences. Unlike integrity, which is internal and moral-based, conditional honesty is external and consequence-based. It is considered a product of reasoning and is a key concept in evaluating personnel risk in security-sensitive roles.

Strict liability applies when a manufacturer or service provider is held legally responsible for damages or injuries caused by a defective product or service, regardless of fault or intent. This type of liability is often associated with consumer protection laws, where the focus is on the danger posed to the user rather than negligence on the part of the provider.

Plaintiff (B) is the party bringing the suit.

Defendant (C) is the party being sued.

" None of the above " (D) is incorrect since " Strict liability " is the correct legal principle.

A pre-bid conference allows all prospective bidders to gain a clear and consistent understanding of the project requirements, including walkthroughs of affected facilities. This helps ensure uniformity in bid proposals and reduces ambiguity or scope misinterpretation.

A (Engineering evaluation) is internal and technical.

C (Invitation for bid) is a document, not an event.

D (Procurement meeting) is not a standard pre-bid process phase.

Contingency planning traditionally focuses on:

Infrastructure (A)

People (B)

Processes (C)

While reputation is a concern in broader risk management and public relations, it is not considered a direct category of contingency planning programs, which deal more with operational continuity than brand management.

A Business Impact Analysis (BIA) identifies critical functions and assesses the financial and operational impact of business disruptions. It helps prioritize recovery efforts and supports continuity planning by quantifying potential losses.

Enterprise impact analysis (A) and Managerial impact analysis (B) are not formal terms.

Critical process impact (C) is a component considered in the BIA but not the term itself.

An “innocuous virus” is not a formally recognized type of computer virus. All viruses, by definition, are considered malicious because they replicate without authorization and potentially cause harm, whether immediate or latent.

Common types of viruses include:

Humorous (B): A virus designed to prank users without causing real harm (e.g., funny messages).

Hostile (C): Actively destructive or malicious.

Altering (D): Modifies system files or behaviors.

" Innocuous virus " (A) is a misnomer, making it the correct choice as " not " a virus type.

Communism promotes state or collective ownership of property as a political and economic ideology. Radical Islam, while it may advocate for community-oriented economic practices (e.g., zakat, or almsgiving), does not follow the same foundational principles of property ownership as communism. The idea of " sharing property " in radical Islam is not analogous to " common property " in communism.

Piecemeal security refers to the ad hoc or fragmented implementation of security measures without an overarching strategic plan. Security elements are added reactively, often after an incident or perceived risk, rather than being guided by a coordinated risk assessment. This results in inconsistent, sometimes redundant or ineffective protection efforts, leaving gaps in security coverage.

References from PSP: ASIS POA – Strategic Security Planning; PSP Study Manual – Program Design Principles

The first step in a risk analysis is to identify or recognize potential threats. Before assessing vulnerabilities or selecting countermeasures, a security practitioner must know what they are defending against. This forms the foundation for the rest of the risk assessment process.

A (Selecting countermeasures) is done after analyzing risks.

B (Vulnerability assessment) follows threat identification.

C (Determining costs) happens later in the risk evaluation phase.

The critical detection point in a Physical Protection System (PPS) occurs when the remaining distance or time an adversary must cover before reaching the target exceeds the security response time. This ensures that detection happens early enough for responders to act and intervene before the attacker reaches the asset.

B and C refer to detection and interruption probabilities, which are important metrics but not the defining threshold for the critical detection point.

D (Remaining delay time) factors into the protection layers but does not define the detection threshold.

Comprehensive Detailed Explanation:

Pre-qualifying vendors ensures that only those with the necessary experience, resources, and qualifications are invited to bid on a project. This avoids wasted effort on unqualified proposals and increases the likelihood of successful project execution.

A (Code enforcement) and D (Spec compliance) happen during later review stages.

C (Financial stability) is one part of the evaluation but not the sole goal.

The contingency fee in a bid package is typically set at 10% of the total project cost. This budgetary buffer accounts for unforeseen issues, changes, or risks that might arise during project execution. It is a standard practice in both construction and security system projects.

A (5%) may be insufficient.

C (15%) and D (20%) are considered excessive unless the project has high uncertainty.

Ethernet was developed in the early 1970s by Robert Metcalfe and his team at Xerox Corporation’s Palo Alto Research Center (PARC). It became the foundational technology for local area networks (LANs) and remains widely used in networking today.

IBM (B) developed other networking technologies but not Ethernet.

Microsoft (C) is a software company and did not develop Ethernet.

Motive is the internal drive or reason behind someone ' s actions. In this context, an employee who has been passed over for a promotion and feels resentment may develop a motive for misconduct, such as sabotage, theft, or workplace disruption.

Desire refers to the emotional want.

Opportunity is about environmental or procedural chances to act.

All of the above (D) includes broader elements, but the question specifically asks for what the resentment reflects — that is motive.

For confined interior areas containing explosive vapors or materials, non-emitting sensors are preferred to avoid ignition risk. Passive Infrared (PIR) sensors are ideal in such environments because they detect heat signatures (infrared energy) emitted by intruders without emitting any signals or energy that could trigger an explosion.

A (Ultrasonic) and C (Capacitance) sensors emit signals.

D (Passive vibration sensors) detect vibration and are used in a different context, like surface tampering.

In security and risk management, criticality refers to the importance or impact of a loss, typically measured in monetary terms. It helps determine how severely the loss of an asset, process, or system could affect operations, productivity, or safety. Understanding criticality allows security professionals to prioritize protection efforts based on potential financial and operational consequences.

References from PSP: Risk Assessment Terminology – ASIS POA; PSP Study Guide – Asset Valuation and Risk Impact

Comprehensive Detailed Explanation:

A project is defined as a temporary endeavor undertaken to create a unique product, service, or result. In security, examples include designing and installing a new access control system or conducting a vulnerability assessment.

A (Scope of work) outlines what a project includes.

B (Work breakdown structure) is a tool used in managing a project.

D (System) refers to a set of components working together, not the temporary process to build it.

An Uninterruptible Power Supply (UPS) is the best solution to immediately mitigate the risk of power loss in a computer. It provides backup power instantly upon power failure, allowing safe shutdown or continued operation for a limited period.

A (Surge protector) protects against voltage spikes but doesn’t provide backup power.

C (Emergency generator) has a startup delay and is more suitable for large systems.

D (Batteries) are components of a UPS, not a standalone mitigation.

In the organizational structure of a security function, the core activities typically include:

Managerial: Oversight, policy development, leadership.

Administrative: Recordkeeping, personnel management, compliance.

Preventive: Strategies and operations to deter incidents before they occur.

Investigative: Reactive efforts to determine the cause of incidents or breaches.

These functions vary depending on the organization and risk profile but represent the foundational elements of an effective security program.

Comprehensive Detailed Explanation:

Contingency planning in security and business continuity comprises four key components:

Emergency Response – immediate action to protect life and assets.

Crisis Management – command, communication, and decision-making during crises.

Business Recovery – restoring critical functions temporarily.

Business Resumption – restoring full, normal operations post-disruption.

Other options include irrelevant terms such as “pressure devices” or “under investigation,” which are not core to contingency planning.

Hold harmless clauses are contractual provisions that attempt to shift liability from one party to another—typically from the hiring organization to the contractor. However, under the principle of non-delegable duty, courts often do not honor these clauses when essential legal responsibilities (like ensuring public safety) are involved. This reinforces that certain legal obligations cannot be waived or outsourced.

Options A and B are not recognized legal phrases.