ASIS-PSP Physical Security Professional (PSP) Exam Questions and Answers

Risk spreading refers to decentralizing operations or distributing assets so that if one site or operation is compromised, the entire organization isn’t paralyzed. For example, backing up data across multiple locations ensures that the loss of one system doesn ' t cause total data loss.

References from PSP: Risk Management Techniques – ASIS POA; PSP Certification Guide – Business Resilience Measures

Preventive maintenance involves proactive actions taken to ensure systems continue to operate efficiently and to prevent failures before they occur. Updating system and application software is a clear example of preventive maintenance because it improves system performance, addresses vulnerabilities, and ensures compatibility with current operational requirements. In Human Resource and organizational management contexts, preventive maintenance supports uninterrupted operations, protects organizational assets, and ensures employee safety by reducing the likelihood of system failures. In contrast, investigating problems, restoring systems, and updating documentation are reactive or corrective maintenance activities that occur after an issue has already arisen. Preventive measures like regular updates, inspections, and testing help maintain reliability and reduce downtime. Therefore, option B is correct because it reflects a proactive approach to maintaining system effectiveness.

Probability of detection refers to the likelihood that an intrusion or unauthorized action will be identified by the security system. It is a key performance metric used to evaluate the effectiveness of electronic security components such as sensors and alarms. A high probability of detection means a more reliable system.

A (System validation) is a phase where detection may be measured, but it’s not the definition.

B (Officer response) is unrelated to detection probability.

D (Response timing) is part of delay or intervention, not detection.

In selecting video surveillance cameras, the primary criterion is the ability to clearly identify objects or individuals within the monitored area, which is directly determined by the horizontal resolution.

Horizontal resolution represents the number of distinct points of information captured across the width of the scene and dictates the level of detail available for identification.

Pixel count or chip output alone does not guarantee usable image quality; it must be supported by optics and scene coverage.

Sensitivity affects performance in low-light conditions but is secondary when the main goal is resolution-based identification.

Focal length adjusts the field of view but does not replace the need for sufficient horizontal resolution to meet identification objectives.

ASIS PSP guidance stresses that camera selection should align with the operational purpose, ensuring captured video meets evidentiary and situational awareness requirements while optimizing system design and cost efficiency.

Private security functions are generally client-centered—focused on protecting the assets, people, and interests of a private entity or organization. In contrast, public law enforcement is tasked with serving the community at large, maintaining public order, and enforcing laws for societal benefit.

This fundamental difference in mission and orientation underpins many of the operational and strategic differences between the two sectors.

A hybrid staffing model uses both proprietary and contract security personnel. In this scenario:

Proprietary staff can be assigned to sensitive and top-secret projects for tighter control, loyalty, and internal vetting.

Contract staff can manage less critical areas such as visitor parking, reducing cost.

This model is both secure and cost-effective, offering flexibility and risk-based deployment.

B (Contract) is cost-effective but lacks control for sensitive tasks.

C (Proprietary) is highly secure but more expensive.

D (Total systems) is not a staffing strategy.

Magnetometers, used in security screening for detecting metallic objects, typically operate using two main methods:

Continuous-wave: Emits a constant electromagnetic field to detect disruptions caused by metal.

Pulsed-field: Emits bursts of energy and analyzes the return signals to identify metal objects.

These methods allow both walk-through and handheld devices to detect ferrous and non-ferrous metals.

A, C, and D include terms not applicable to standard magnetometer operation.

Conspiracy in the context of theft or fraud refers to two or more individuals collaborating—often using confusion or chaos in the environment—to execute or conceal a theft. This is especially common in employee-customer collusion or multi-person theft scenarios.

Accountability (B) reduces confusion.

Invoicing (C) is a documentation process.

Proliferation (D) means rapid increase, not relevant here.

A guiding principle of business continuity planning is flexibility. While the plan provides structure and direction, every crisis is unique and may require adjustments. A rigid plan may fail if it doesn ' t account for variables in real-time conditions, making adaptability a critical success factor.

A (remote site capability) may be included, but it is not a universal requirement.

C is unrealistic—it ' s not feasible to have complete instructions for every possible scenario.

D (outline format) is too minimalistic and reactive rather than proactive.

Credit reports not only reflect a person ' s financial condition (debts, credit utilization, bankruptcies), but also provide useful data such as past addresses and the names of previous employers. This auxiliary information is essential during background investigations and helps validate the accuracy of job applications.

Legal and compliance considerations apply; employers must follow fair credit reporting laws and obtain consent.

Detention differs from arrest in legal terms. Merchants and security personnel may temporarily detain someone suspected of theft under " shopkeeper ' s privilege " laws. This must be done with reasonable cause, for a reasonable period, and without excessive force. Arrest involves formal legal procedures and typically requires law enforcement authority.

Comprehensive Detailed Explanation:

Specifications are considered the cornerstone of any construction project because they define the materials, workmanship, quality standards, and installation requirements. They ensure consistency, compliance with design intent, and are the foundation upon which contractors bid and work.

A (Drawings) show layout but don’t specify materials or quality.

B (Guidelines) are general and not enforceable.

C (Procedures) guide execution but are not foundational to the build.

A clearly defined and executed procurement contract is critical to successful implementation of a physical security construction project. It outlines scope, deliverables, timelines, cost structures, and responsibilities, ensuring all parties operate with aligned expectations and accountability.

A (RFQ) is a pricing request, not a contract.

B (BIA) informs continuity planning, not project execution.

D (Cost analysis) is useful but not foundational for execution.

The actions described represent risk reduction because the organization is implementing measures to decrease the likelihood and impact of theft rather than eliminating the activity entirely. Moving the coat department, installing surveillance systems, using anti-theft tags, and limiting access to merchandise are all strategies that reduce vulnerability and deter potential offenders. In Human Resource and organizational management, risk reduction is a common approach that balances operational needs with security controls, allowing business activities to continue while minimizing threats. Risk avoidance would involve eliminating the activity altogether, such as no longer selling coats, while risk transfer would involve shifting responsibility, such as through insurance. Risk acceptance would mean taking no action. Therefore, option B is correct because the organization is actively reducing exposure to theft through multiple preventive measures.

Reserves are security personnel who are not assigned to fixed posts or patrol routes but are instead held in readiness to respond when assistance is needed. They may be used during emergencies, staffing shortages, or heightened security alerts. Their role is crucial in maintaining flexibility in a security force structure.

According to best practices, the vendor should offer a warranty that includes full maintenance of the equipment because the vendor is typically responsible for delivering the complete solution, including installation, integration, and ongoing support. In Human Resource and organizational management contexts, having a single accountable party ensures clarity, efficiency, and reliable service. Vendors coordinate between manufacturers, technicians, and service providers, making them best positioned to manage maintenance responsibilities and ensure system performance. This arrangement also simplifies communication and accountability, which is important for minimizing downtime and maintaining workplace safety. Manufacturers may provide product warranties, but they usually do not handle full system maintenance. Therefore, option A is correct because the vendor ensures comprehensive support and aligns with best practices in system lifecycle management.

Risk management is the continuous and proactive process of identifying areas where a business may suffer losses, assessing the likelihood and potential impact of those losses, and implementing security countermeasures to minimize or eliminate them. This function ensures that organizational assets—people, property, and information—are protected against threats such as theft, sabotage, natural disasters, and operational failures.

References from PSP: ASIS POA – Risk Management; PSP Study Guide – Physical Security Assessment Domain

This definition matches the U.S. Department of State and ASIS definitions of terrorism. It highlights the political and psychological components of terrorism, including the targeting of civilians and the intent to instill fear or send a political message.

Infrared sensors can function as both passive and active types:

Passive Infrared (PIR): Detects natural heat (infrared radiation) from people or animals.

Active Infrared: Emits infrared beams and detects interruptions in the beam (e.g., photoelectric sensors).

This dual use allows infrared to serve a variety of security applications.

A (Microwave) is strictly active.

C (Vibration) and D (Pressure) are passive only.

Impressioning is a covert method used to create a working key for a lock without disassembly. It involves inserting a blank key into the lock and turning or jiggling it to create small marks where pins contact the blank, which are then filed down to form the correct cuts.

B (Rapping) and C (Bumping) are techniques to bypass a lock, not to create a key.

D (Decoding) involves analyzing key cuts visually or electronically but not physically producing a key directly.

Recovery of critical processes depends heavily on identifying and assessing the resources needed—such as personnel, facilities, IT systems, and communication tools. Without a proper resource assessment, recovery plans may fail to address key operational dependencies.

A Business Impact Analysis is the correct process because it evaluates how disruptive events can affect critical operations, resources, and organizational continuity. While a risk assessment identifies threats, vulnerabilities, and likelihood, a Business Impact Analysis goes further by examining the operational consequences if a disruption actually occurs. In Human Resource and organizational management, this is important because security incidents can affect employee safety, staffing, communication, payroll, access control, and essential workplace functions. The analysis helps management prioritize critical services, allocate resources, and prepare recovery strategies to reduce downtime and organizational loss. The other options do not serve the same forward-looking planning purpose. Therefore, option D is correct because a Business Impact Analysis complements risk assessment by focusing on the real business and workforce impact of potentially disruptive events.

The classic “fire triangle” describes the three elements necessary for fire to occur:

Heat – to raise material to ignition temperature

Fuel – combustible material

Oxygen – typically from the air, to sustain combustion

Removing any one of these three elements will prevent or extinguish a fire.

Legal action, civil lawsuits, and civil litigation all fall under categories of public records that provide documented histories of an individual ' s involvement in legal or financial disputes. These records can offer valuable insight into behavior patterns, financial stability, and legal integrity — all of which are critical in personnel vetting.

Such records are accessed (where lawful) during comprehensive background checks.

Security standards typically require that any opening in a perimeter (e.g., HVAC ducts, pipe chases, vents) be lockable or otherwise protected if the cross-sectional area is 96 square inches or greater. This threshold is based on a size that could permit unauthorized entry or object passage.

A, B, and D are incorrect measurements based on security industry benchmarks.

The correct answer is C. Performance test.

In PSP physical security system implementation, testing is used to verify whether security equipment and systems meet required performance requirements and success metrics. The ASIS PSP Body of Knowledge includes performance requirements, success metrics, commissioning, final acceptance testing, and life-cycle evaluation as part of physical security system design and implementation.

A performance test determines measurable operating parameters of the system or equipment. For intrusion detection sensors, these parameters can include probability of detection, false alarm rate, nuisance alarm rate, sensitivity, detection coverage, and other measurable performance characteristics. Sandia’s physical security testing guidance also identifies NAR/FAR — nuisance alarm rate/false alarm rate and probability of sensing as key sensor performance metrics collected from test results.

The other options are not the best answer:

A. Safety test focuses on whether testing or equipment creates unsafe conditions.

B. Evaluation test is broader and is used to validate overall PPS effectiveness, not mainly to determine specific parameters like nuisance alarm rate.

D. Post-maintenance test is conducted after maintenance to confirm the system still works properly.

Therefore, the correct answer is C. Performance test.

The Edison Electric Institute, in collaboration with the North American Electric Reliability Council (NERC) and the Department of Energy (DOE), developed security guidelines for the protection of the electrical grid. One of the primary components of these guidelines is performing a vulnerability/risk analysis to identify potential weaknesses and assess the impact of threats to the infrastructure.

While threat response and cyber scenarios are part of broader planning, vulnerability/risk analysis is a foundational element.

Emergency detection is important but not a specifically highlighted part of the referenced guidelines.

Comprehensive Detailed Explanation:

The three primary and sequential functions of a Physical Protection System (PPS) are:

Detection – identifying unauthorized activity.

Delay – slowing intruder progress.

Response – intervening before asset compromise.

This layered approach ensures an opportunity to detect and intercept threats before they succeed.

A and D include " deterrence " or " prevention, " which are security goals but not primary PPS functions.

C lists valid concepts but omits the critical detection phase.

Post-implementation evaluation testing should be performed at least annually to assess whether the security system continues to meet operational requirements. It also ensures that performance standards are upheld, and helps identify any necessary updates or improvements.

A, B, and C are more frequent than typical industry best practice unless special conditions apply.

Private security refers to individuals or organizations that offer security-related services for compensation. This includes both self-employed individuals (such as independent security consultants or contractors) and funded business entities (such as security companies or firms) that provide services to private clients for a fee. These services may include guarding, patrolling, risk assessments, investigations, alarm monitoring, or other protective activities.

A limited area is a controlled zone within a facility where a higher level of security is required than in general access areas. These are typically used to protect sensitive operations or assets. Access is restricted to authorized individuals who require entry for specific operational duties.

Pass system area (B) refers to the access control method, not the area classification.

Multiple areas (C) and External area (D) are not specific security designations.

In risk assessment, the tangibility of an asset does not automatically determine whether it is more or less valuable than another asset. Both tangible assets, such as equipment and facilities, and intangible assets, such as reputation, information, and employee knowledge, can be critical to an organization. Human Resource management especially recognizes that intangible assets like workforce expertise, trust, and organizational culture can have major strategic value. Because of this, each asset must be evaluated based on its specific importance, exposure to risk, and potential impact on operations. Protection measures should then be matched to that value and level of risk. A physical item is not always more valuable than a nonphysical one, and mitigation strategies should not automatically be identical. Therefore, option D is the most accurate answer.

A security system’s power supply must be sized with headroom to accommodate additional devices, future expansion, and potential peak loads. ASIS PSP guidance recommends that the system load should not exceed 60% of the total power capacity.

Loading above this threshold can reduce system reliability, limit the ability to add new devices, and stress power components, potentially shortening equipment lifespan.

Maintaining a margin ensures that batteries and power supplies can support the system under normal and emergency conditions, including temporary peak loads.

This practice aligns with standard design principles for redundancy, scalability, and safe operation of integrated security systems.

Microwave sensors are active volumetric sensors that transmit microwave signals and detect motion based on frequency changes. For optimal coverage and effectiveness, they are typically mounted near the ceiling of the protected area. This elevated placement allows the sensor to cover a wider detection zone and reduces interference from obstacles such as furniture or equipment. In workplace security and Human Resource safety management, proper sensor placement is essential to ensure reliable detection and minimize false alarms. Mounting sensors too low can limit their range and increase the likelihood of obstructions affecting performance. Positioning them at ceiling level enhances monitoring efficiency and supports a safer working environment by ensuring comprehensive coverage. Therefore, option D is correct because it provides the most effective installation position for microwave sensors.

In security and risk management, criticality refers to the importance or impact of a loss, typically measured in monetary terms. It helps determine how severely the loss of an asset, process, or system could affect operations, productivity, or safety. Understanding criticality allows security professionals to prioritize protection efforts based on potential financial and operational consequences.

References from PSP: Risk Assessment Terminology – ASIS POA; PSP Study Guide – Asset Valuation and Risk Impact

Crime Prevention Through Environmental Design (CPTED) is a proactive design philosophy that uses environmental elements to reduce crime opportunities. One of its core principles is natural surveillance, which involves designing spaces so that legitimate users can easily observe their surroundings. This increases perceived risk for offenders and discourages criminal activity.

A (Balanced systems), B (Protection in depth), and D (Layered defense) are principles used in security system design but not specific to CPTED.

The four common types of physical lock-down systems for protecting hardware, especially in IT environments, include:

Cages: Enclosures for servers or critical equipment.

Plates: Lock-down plates secured to desks or floors.

Cables: Security cables to tether devices.

Alarms: Motion or tamper-detection systems.

These measures are used to deter theft and unauthorized physical access.

Screening is the process of identifying the most suitable candidates for a job, factoring in both qualifications (skills and experience) and personal integrity. This may involve background checks, interviews, and reference verification to ensure candidates are reliable and trustworthy.

Vetting (C) is often used interchangeably but generally refers more narrowly to background checks.

Recruitment (B) is the broader process of attracting candidates.

Inspection (A) refers to a physical or procedural review, not personnel selection.

A Physical Security Personnel metric measures the performance or responsiveness of individuals or teams responsible for maintaining physical security systems. " Integrator response to a service request " measures how quickly and effectively a technician or support provider addresses security system issues—making it a valid personnel performance metric.

A and C relate to threat detection or monitoring, not personnel metrics.

B is a system-level metric, not specific to personnel.

Within the PSP framework and project management methodology, the design phase is where technical and cost evaluations are conducted. During this phase, the security system’s requirements are translated into detailed specifications, including system architecture, component selection, and preliminary layouts.

Technical evaluation assesses whether proposed systems, devices, or configurations meet operational and functional requirements, including performance, scalability, and compliance with standards.

Cost evaluation ensures that proposed solutions align with the organization’s budget and provides a basis for cost-benefit analysis.

These evaluations inform decision-making before procurement and installation, reducing risk of over-specification, underperformance, or budget overruns. In contrast, planning defines objectives and scope, procurement executes purchase decisions, and installation implements the system according to the design.

A Business Impact Analysis (BIA) identifies critical functions and assesses the financial and operational impact of business disruptions. It helps prioritize recovery efforts and supports continuity planning by quantifying potential losses.

Enterprise impact analysis (A) and Managerial impact analysis (B) are not formal terms.

Critical process impact (C) is a component considered in the BIA but not the term itself.

The correct answer is D. retinal pattern recognition.

In PSP physical security design, access control is part of integrated physical security systems and countermeasure implementation. ASIS describes the PSP credential as covering physical security assessments, integrated physical security systems, and implementation/evaluation of security measures.

Retinal pattern recognition is a biometric access control method. It verifies a person based on a unique physical characteristic rather than something the person carries or knows. Biometric authentication uses unique body characteristics such as retinas, fingerprints, facial structure, or other biological traits for security and authentication.

The other options provide lower security by comparison:

A. Proximity card — possession-based credential; it can be lost, stolen, shared, or cloned.

B. Computer-controlled keypad — knowledge-based credential; PINs can be observed, guessed, shared, or compromised.

C. Smart card — stronger than a basic proximity card, but still a possession-based credential unless combined with PIN or biometric verification.

D. Retinal pattern recognition — biometric; tied directly to the individual and therefore provides the highest level of security among the listed options.

Therefore, for a high-security area such as a data center, the best answer is D. retinal pattern recognition.

Comprehensive Detailed Explanation:

Identity theft is the act of obtaining and using someone else ' s personal or financial information—such as social security numbers, bank details, or credit card information—without permission, often for committing fraud or other criminal activities.

Identity fraud (A) refers to the actual fraudulent acts committed after the identity is stolen.

Identity dissemination (C) and Identity distortion (D) are not standard legal or cybersecurity terms.

The effectiveness of entry control systems is typically measured by:

Throughput (speed of entry)

False Acceptance Rate (FAR) — unauthorized access

False Rejection Rate (FRR) — denial of access to authorized users

These metrics provide insight into both the security and user experience of the access control system.

A (Cost) is relevant to budgeting, not effectiveness.

B (Activation delays) may affect throughput but isn’t a primary measure.

D (System obsolescence) relates to lifecycle, not effectiveness.

Staff authority occurs when individuals (such as a chief executive officer or department head) are given delegated authority by their superior but do not sit directly in the operational chain of command. They support line functions by providing recommendations, analysis, and specialized services. Unlike line authority, which involves direct supervision, staff authority enables influence through expertise or policy.

Financial authority (A) pertains to budget control.

Control authority (B) is not a formal organizational term.

Dominance authority (D) is not used in standard management structures.

An “after action” review is a structured process following an incident, drill, or actual disaster, in which events are documented, timelines are reconstructed, and lessons learned are gathered. Its purpose is to identify what went well, what failed, and what can be improved in future responses.

Testing (A) refers to evaluating procedures before an event.

Quality assurance (B) focuses on performance and compliance but not necessarily post-event analysis.

" All of the above " (D) is incorrect because only after action includes all these specific elements.

A pre-bid conference allows all prospective bidders to gain a clear and consistent understanding of the project requirements, including walkthroughs of affected facilities. This helps ensure uniformity in bid proposals and reduces ambiguity or scope misinterpretation.

A (Engineering evaluation) is internal and technical.

C (Invitation for bid) is a document, not an event.

D (Procurement meeting) is not a standard pre-bid process phase.

In the context of physical security, predictability typically refers to human behavior patterns that adversaries could exploit. For example, predictable patrol schedules or access procedures can be observed and defeated. Reducing predictability enhances security by complicating an attacker’s planning process.

A (Accuracy) and B (Effectiveness) relate to system performance.

D (Efficiency) relates to resource use, not vulnerability.

Under the 50/50 rule (also known as the " modified comparative negligence " rule), the plaintiff may recover damages only if they are 50% or less at fault. If the plaintiff ' s fault is more than 50%, they cannot recover any damages. Therefore, a person responsible for more than 50% of the negligence would be barred from recovery.

The most widely accepted classification of leadership skills includes:

Conceptual skills: Ability to think abstractly and see the " big picture "

Human relations skills: Interpersonal and communication capabilities

Technical skills: Expertise and proficiency in specific tasks

These skill sets are collectively known as the " skill mix " and are essential for effective security leadership.

Comprehensive Detailed Explanation:

A building is considered a high-rise when its height exceeds the maximum reach of fire department equipment (typically 75–100 feet). This classification impacts safety regulations, evacuation strategies, and fire protection system requirements.

C and D are rough guidelines, but B is the technical definition used in most codes.

A describes a design feature, not a defining criterion.

Scavenging refers to the process of retrieving residual data from system memory (such as RAM) or buffers. This data remains until it is overwritten or the system is powered off. Scavenging can be used by attackers to recover sensitive information such as passwords or encryption keys.

Random memory (A) is not a valid term.

Awaiting memory (C) and Search memory (D) are not industry terms.

The three most common categories of risk in organizational security are:

Personnel: Risks to human safety and behavior.

Property: Risks to physical and digital assets.

Liability: Legal exposure due to negligence or failure to act.

This classification helps align mitigation strategies and insurance planning.

A and D incorrectly list “hazards” as a category rather than a risk source.

B omits personnel, a critical category.

An electric strike allows for remote electrical locking and unlocking while still permitting free mechanical egress from the protected (inside) side of the door. This is essential for life safety and code compliance, especially in commercial and public buildings.

A (Vertical pin) is a mechanical lock component, not an electric device.

B (Electromagnetic) locks typically require power to release and may not allow mechanical egress without integration.

D (Delayed egress) restricts exit temporarily, which may violate free egress rules depending on application.

Among the listed options, asphalt has the lowest reflectance. CCTV performance depends on lighting and surface reflectivity.

Snow (A) has very high reflectance, sometimes exceeding 80%.

Sandy soil (B) and red bricks (D) reflect more light than asphalt.

Asphalt, being dark and non-reflective, absorbs more light, making it harder for cameras to capture detail unless well illuminated.

A Change Review Board (CRB) is typically composed of key stakeholders representing the major interests involved in a project—engineering, operations, security, IT, procurement, and other relevant departments. This cross-functional group ensures that proposed changes are reviewed, justified, and approved collaboratively.

A, C, and D list some roles, but they don’t fully represent the project’s key partners in a typical governance model.

The four main types of invasion of privacy recognized under civil law are:

Misappropriation of name or likeness for commercial use (A)

False light (B) — misrepresenting someone publicly

Intrusion upon seclusion (D) — unauthorized intrusion into someone’s private space or affairs

Public disclosure of private facts — not “private disclosure of public facts” as stated in option C

Option C is incorrect because “private disclosure of public facts” is not a valid tort; it reverses the recognized tort, which is “public disclosure of private facts.”

The total financial impact of a loss extends beyond the replacement cost of a stolen or damaged item. It includes:

Temporary replacement costs (e.g., rental equipment or substitute materials)

Downtime costs (e.g., loss of production or service disruption)

Discounted or future cash flow losses, such as delayed revenues or lost customers

These hidden or indirect costs can significantly increase the true loss value.

References from PSP: ASIS POA – Total Cost of Loss; PSP Manual – Loss Impact Assessment

X.25 is a standard protocol suite developed by the Consultative Committee for International Telephone and Telegraph (CCITT), now known as ITU-T. It is one of the earliest protocols used for WAN communications, enabling reliable data transfer across public networks using packet switching.

XA.10 (B), CXA 1.23 (C), and X.20 (D) are not recognized standards for WAN protocols.

A significant issue in the operation of intrusion detection systems is the occurrence of false positives and false negatives. A false positive happens when the system signals an alarm even though no real intrusion has occurred, while a false negative happens when an actual intrusion is not detected. In organizational and Human Resource related security management, both problems are serious because they affect employee trust, response efficiency, and overall workplace safety. Frequent false alarms can cause staff to become less responsive or careless, while missed detections can expose personnel, assets, and sensitive information to harm. Effective training, proper maintenance, and accurate calibration are essential to reducing these issues. Therefore, option B is correct because false positives and false negatives are among the most important operational concerns in intrusion detection systems.

Annual Loss Expectancy (ALE) is calculated as:

ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO),

which reflects the impact (SLE) and the frequency (ARO) of an event. This formula is a key component in risk assessment for determining expected financial loss.

A, B, and C are partially correct but not the accepted risk formula framework.

Patrol duty involves moving through assigned routes or areas to monitor activity, detect irregularities, and observe the general condition of the facility. Patrolling can be conducted on foot or by vehicle and is a fundamental component of proactive security operations.

Posts (B) are stationary assignments.

Reserves (C) are backup personnel.

" None of the above " (D) is incorrect because patrol duty is the accurate answer.

The multifactor approach examines terrorism through multiple dimensions, including psychological, sociological, ideological, and organizational factors. It analyzes how individuals are recruited, indoctrinated, and motivated within terrorist networks. This is key in understanding the behavioral patterns and lifecycle of a terrorist.

An auxiliary alarm system uses a direct connection (usually via leased lines) to a public emergency service center, such as police, fire, or 911. This provides rapid response but limits control to only the responding agencies, unlike proprietary or central station systems.

In the PSP methodology, the preliminary design phase includes both threat assessments and vulnerability analyses.

Threat assessment identifies potential adversaries, hazards, and scenarios that could negatively impact the facility or operations.

Vulnerability analysis examines weaknesses in systems, processes, and physical infrastructure that could be exploited by threats.

These analyses inform the design of security measures by determining risk exposure and guiding the selection of protective layers. While operating security reviews and security systems architecture focus on implementation and operational evaluation, the preliminary design phase is where risks are systematically identified and addressed in the system concept and specifications, consistent with ASIS PSP guidance.

Recruitment into jihadist or other terrorist movements typically involves identifying individuals vulnerable to radical ideology, indoctrinating them through propaganda and religious misinterpretation, and then training them for operational activities, including attacks or support roles.

An initial threat or hazard evaluation must include an assessment of how likely each threat is to occur. This probability, when combined with impact analysis, forms the foundation for risk assessments. Understanding likelihood allows prioritization of mitigation strategies.

A (Estimate costs) and C (Develop business case) are later steps.

D (Develop response plan) comes after risk characterization.

If stairwells are used regularly for inter-floor travel and permitted by local code, the best practice is to maintain both life safety and security. This can be done by installing approved access control devices (e.g., card readers) and two-way communication systems (intercoms) to manage access while allowing emergency use.

A (Fail-secure locks) could pose a safety risk in emergencies.

B (Unlocked doors) may violate building security policies.

C (Selective unlocking) is inconsistent and may cause confusion during emergencies.

The primary function of an electronic security system during an attempted or successful penetration is to notify personnel so that appropriate action can be taken. While alarms, countermeasures, and system integrations are important components, they are all secondary to ensuring that responsible individuals are informed promptly. In Human Resource and organizational security management, timely notification enables trained personnel to respond effectively, follow established procedures, and minimize potential damage or risk. Without proper notification, alarms alone may not lead to action, and automated responses may not address the situation appropriately. Effective communication and response coordination are critical aspects of workplace safety and incident management. Therefore, notifying personnel is the most essential function, making option B the correct answer.

Modern terrorism, unlike historical or localized violence, leverages advanced technologies and global networks. It necessitates comprehensive national strategies involving political decision-making, resource allocation, intelligence, law enforcement, and industry collaboration to combat the sophisticated threats posed.

The critical detection point in a Physical Protection System (PPS) occurs when the remaining distance or time an adversary must cover before reaching the target exceeds the security response time. This ensures that detection happens early enough for responders to act and intervene before the attacker reaches the asset.

B and C refer to detection and interruption probabilities, which are important metrics but not the defining threshold for the critical detection point.

D (Remaining delay time) factors into the protection layers but does not define the detection threshold.

Security consultants are often retained to provide strategic input on staffing needs, policy design, and technology integration. Their advice helps organizations make informed decisions regarding the deployment of personnel, the structure of policies, and the selection of physical and electronic security systems.

Comprehensive Detailed Explanation:

A Business Impact Analysis (BIA) identifies and prioritizes critical business functions that are essential to the survival and continuity of operations. The results of the BIA help guide recovery strategies, resource allocation, and business continuity planning.

A (Budget) and B (Personnel allocation) are determined later, informed by the BIA.

C (Number of hot sites) is a strategic outcome but not the direct purpose of the BIA.

Comprehensive Detailed Explanation and References

Group terrorism involves an organized entity that includes a leadership hierarchy, recruitment infrastructure, training procedures, and operations planning. These groups typically have defined ideological goals and logistics networks. Examples include Hezbollah, al-Qaeda, and the FARC.

The correct answer is C. Equipment performance testing.

In PSP physical security implementation, testing is used to verify that installed security equipment and systems actually perform according to required functional and performance objectives. The ASIS PSP Body of Knowledge includes functional requirements, performance requirements, success metrics, commissioning, and final acceptance testing as part of physical security system design and implementation.

Equipment performance testing is the specific type of testing used to determine whether equipment or a system is functional, has adequate sensitivity, and meets its design and performance objectives. This matches the wording of the question directly. Physical security testing guidance also describes security system performance testing as determining whether security equipment is functional, has adequate sensitivity, and meets design and performance objectives under operating conditions.

The other options are not the best answer:

A. Factory acceptance testing is normally conducted before delivery or installation to verify equipment at the factory or vendor stage.

B. Reliability performance testing focuses more on dependability, availability, or continued operation over time.

D. Site acceptance testing verifies the installed system at the actual site, but the wording about functionality, sensitivity, and design/performance objectives specifically describes equipment performance testing.

Therefore, the correct answer is C. Equipment performance testing.

Enterprise Security Risk Management (ESRM) considers a variety of operating environments that influence organizational risk, including geopolitical, economic, legal, and technological factors. The geopolitical environment—such as regional instability, regulatory changes, and political threats—plays a critical role in shaping security strategy and risk prioritization.

A (Legal), B (Digital), and C (Physical) are important, but they are all subsets of the broader geopolitical and global risk context within ESRM.

Under the pure comparative negligence approach, a plaintiff can recover damages even if they were primarily responsible for their own injury. For example, if the plaintiff was 90% at fault, they could still recover 10% of the damages from the defendant. This model allows for partial recovery based on proportional fault, regardless of the level of the plaintiff’s responsibility.

50/50 rule and 51 percent rule prevent recovery when the plaintiff is found equally or more at fault.

Comprehensive Detailed Explanation:

A security system acceptance test verifies that the system has been installed according to the design and is operating properly. This includes ensuring cameras are correctly aimed, focused, and provide the intended coverage and image quality. This practical verification is critical for performance validation.

B and C may be part of training or specific functionality checks but are not core acceptance test items.

D refers to reliability testing, which is separate from initial acceptance.

Fidelity bonds specifically cover losses resulting from dishonest acts committed by employees, such as theft, fraud, or embezzlement. These are commonly used in financial institutions and other sectors where employees handle cash or sensitive assets.

Contingency planning traditionally focuses on:

Infrastructure (A)

People (B)

Processes (C)

While reputation is a concern in broader risk management and public relations, it is not considered a direct category of contingency planning programs, which deal more with operational continuity than brand management.

Continuity planning involves developing strategies and procedures to ensure that critical infrastructure, processes, and systems continue to function or are restored promptly after a disruption. It includes emergency response, crisis management, recovery, and resumption phases.

Contingent planning (A) is not a standard term.

Resource planning (C) focuses on allocation of resources, not continuity.

Resumption planning (D) is a subset of continuity planning.

In the organizational structure of a security function, the core activities typically include:

Managerial: Oversight, policy development, leadership.

Administrative: Recordkeeping, personnel management, compliance.

Preventive: Strategies and operations to deter incidents before they occur.

Investigative: Reactive efforts to determine the cause of incidents or breaches.

These functions vary depending on the organization and risk profile but represent the foundational elements of an effective security program.

Security consultants are often retained to provide strategic input on staffing needs, policy design, and technology integration. Their advice helps organizations make informed decisions regarding the deployment of personnel, the structure of policies, and the selection of physical and electronic security systems.

Post orders are written instructions for security personnel detailing duties, responsibilities, and conduct at a specific post. These orders must clearly express the policies and expectations of the protected organization, ensuring alignment with security protocols and business objectives.

A (Reviewing shift log) is a task, not a policy directive.

C (Verbal instructions override written) contradicts best practice.

D (Policies of local authorities) may influence actions but do not replace enterprise policies in post orders.

The most effective approach to risk management emphasizes proactive measures taken before a loss occurs. Implementing an efficient before-the-loss arrangement involves:

Identifying potential threats and vulnerabilities

Prioritizing assets and exposures

Designing protective measures and contingency plans

Allocating resources to minimize potential operational, financial, and safety impacts

Reactive measures, such as arranging after-the-loss recovery or focusing exclusively on loss-prevention techniques, do not comprehensively address risk and may leave organizations exposed. Calculated-risk theory provides a framework for decision-making but must be applied within a before-the-loss strategy to optimize mitigation and resource allocation.

This aligns with ASIS PSP guidance, which underscores the importance of anticipating risks and implementing protective measures in advance rather than relying primarily on post-loss actions.

A crime is defined as a voluntary and intentional violation of a law by someone who is legally competent. It involves breaking a legal duty meant to protect society. This can include actions that are prohibited or omissions where action was legally required.

Corruption (A) is a specific type of crime involving abuse of power.

Law-breaking (B) is a general, non-legal term.

Fault (C) is too broad and often used in civil contexts.

Staff personnel serve in a supportive or advisory capacity to the organization’s line executives. They provide specialized knowledge, consultation, and services (e.g., legal, HR, finance) without having direct authority over operations. Their role is crucial in supporting efficient decision-making and strategic planning.

CFO (A) may be a staff officer but is a specific example.

Merchandiser (B) and Retail marketer (D) are job functions, not general categories of organizational roles.

Intangible assets are non-physical resources that carry value for an organization and require protection despite lacking a tangible form. Patents are a classic example because they represent proprietary technology or intellectual property, which can provide competitive advantage and legal protection.

Reputation and digital files may hold value, but in PSP asset valuation, patents are specifically recognized as legal intangible assets with quantifiable ownership rights.

Obsolete equipment is a tangible, depreciated asset and does not qualify as intangible.

Properly identifying and valuing intangible assets like patents ensures that security strategies address not only physical property but also intellectual and proprietary assets, aligning with PSP guidance on comprehensive asset protection.

Wide Area Networks (WANs), like LANs, allow multiple devices to share communication lines. In WANs, technologies such as packet switching, virtual circuits, and multiplexing are used to let multiple users communicate over shared infrastructure. This is essential for scalability and efficiency across geographically dispersed locations.

Proprietary security services are those in which the security personnel are hired, trained, and managed directly by the organization they protect. They are part of the company’s staff and are not outsourced from external firms. Proprietary security typically ensures tighter integration with company culture and policies and offers better control over personnel and procedures.

Contract security services (Answer D) involve third-party firms providing personnel who are not employees of the protected organization.

Security enforcement (Answer B) is a general term, not a specific classification.

Pilferage (Answer C) refers to theft and is unrelated to service type.

Executives are the most crucial stakeholders to engage because they have the authority, strategic perspective, and organizational influence needed to support an enterprise-wide asset protection strategy. In Human Resource and organizational management terms, senior leadership helps align protection efforts with business goals, approves budgets, sets priorities, and ensures cooperation across departments. Asset protection is not only a security issue; it involves people, policies, systems, operations, and culture throughout the entire organization. Executives are in the best position to balance these needs and drive unified implementation. While security, IT, and human resources each play important supporting roles, they usually focus on specific functional areas. Executive engagement ensures the strategy is supported at the highest level and integrated across the enterprise. Therefore, option B is the most accurate answer.

Legal encyclopedias are comprehensive reference works that summarize legal principles and doctrines across a wide range of topics. They often include discussions of cases where these principles apply and are used by legal professionals to understand broad areas of law before delving into specific statutes or case law.

Legal document (B) is a broad term and not specific to educational or reference materials.

Formal memorandum (C) is used for legal opinion or communication, not for general legal research.

Training plays a critical role in enhancing employee motivation, which directly contributes to higher employee morale. In Human Resource management, well-designed training programs improve employees’ skills, confidence, and sense of value within the organization. When employees feel competent and supported, their job satisfaction increases, leading to a more positive attitude toward their work and the organization. This improved morale often results in better teamwork, reduced turnover, and increased productivity. Training does not inherently increase workload or supervision, nor is legal protection its primary outcome. Instead, it strengthens employee engagement and commitment. Therefore, the most accurate outcome of improved staff motivation through training is enhanced employee morale, making option D the correct answer.

Asset value in risk management is determined by considering criticality, ease of replacement, and some measure of value. Criticality refers to how important the asset is to organizational operations, including its impact on productivity, safety, and continuity. Ease of replacement evaluates how quickly and easily the asset can be restored or substituted if lost. The measure of value includes financial worth as well as operational or strategic importance. In Human Resource and organizational contexts, this is especially relevant when assessing both physical assets and human capital, as employee roles and skills may be difficult to replace and highly critical to operations. Original cost alone does not reflect true importance, making it less useful. Therefore, option D is correct because it includes the most relevant and comprehensive factors for determining asset value.

An Invitation to Bid (ITB) is typically used when the buyer has clearly defined requirements and a good understanding of the market offerings. It focuses on obtaining competitive pricing for known solutions and is suitable for well-specified projects where minimal deviation is expected.

B (Request for proposals) is used when buyer needs input on how to meet requirements.

C (Sole source) limits competition and is only used under specific conditions.

D (Request for quote) is generally used for lower-cost, commodity items.

Project management principles emphasize balancing scope, time, and cost, often referred to as the project management “triple constraint” or “iron triangle.”

Scope defines the work required to complete the project successfully, including deliverables, system specifications, and operational objectives.

Time represents the project schedule and deadlines for completing tasks, phases, or milestones.

Cost encompasses budgetary limits, including labor, materials, equipment, and contingencies.

A project manager must continuously monitor and adjust these factors to ensure that changes in one area do not negatively impact the others. For example, expanding scope without adjusting time or cost can jeopardize project success. This approach aligns with PSP guidance for security system projects, where maintaining balance among scope, schedule, and budget is critical to delivering an effective and operationally viable security system.

An Uninterruptible Power Supply (UPS) is the best solution to immediately mitigate the risk of power loss in a computer. It provides backup power instantly upon power failure, allowing safe shutdown or continued operation for a limited period.

A (Surge protector) protects against voltage spikes but doesn’t provide backup power.

C (Emergency generator) has a startup delay and is more suitable for large systems.

D (Batteries) are components of a UPS, not a standalone mitigation.

Motive is the internal drive or reason behind someone ' s actions. In this context, an employee who has been passed over for a promotion and feels resentment may develop a motive for misconduct, such as sabotage, theft, or workplace disruption.

Desire refers to the emotional want.

Opportunity is about environmental or procedural chances to act.

All of the above (D) includes broader elements, but the question specifically asks for what the resentment reflects — that is motive.

The Internet Protocol (IP) is used to route packets of data between LANs and WANs. It allows communication across interconnected networks regardless of the underlying hardware or local network configuration. IP is part of the TCP/IP protocol suite and is the foundational protocol for all modern internetworking.

Ethernet Protocol (A) applies to LANs but not internetwork communication.

Options B and C are not valid or recognized protocol names.

Proprietary (in-house) security often provides better control over personnel, consistency in training, greater loyalty, and better integration with the corporate culture. This can enhance overall performance and organizational prestige.

B, C, and D list some advantages but miss the full combination that best defines proprietary staffing benefits.

Smoldering burning is the final phase of a fire where visible flames are no longer present, but extreme heat persists. This occurs when the available fuel is nearly consumed, or oxygen is limited, creating a high-temperature environment without active flames. It poses a serious re-ignition risk.

Ignition stage (B) is the beginning of the fire.

Last stage (C) is too vague.

Incipient stage (D) refers to the early development before flames appear.

A security survey is a detailed, on-site examination of an organization’s premises, operations, procedures, and systems. Its purpose is to identify weaknesses, evaluate risks, and recommend countermeasures. It includes physical inspection, interviews, documentation reviews, and testing of current security controls.

This is distinct from a risk analysis (which is more data-focused) or a performance audit (which evaluates outcomes rather than vulnerabilities).

References from PSP: Physical Security Assessment – ASIS POA; PSP Certification Study Manual – Domain 1

Quantitative analysis involves the use of numeric data to evaluate system performance. In Intrusion Detection Systems, metrics such as Probability of Detection (PD), False Alarm Rate (FAR), and Nuisance Alarm Rate (NAR) are used to objectively measure system effectiveness.

A and C are more subjective or observational.

B (Theoretical) implies modeling, not actual data evaluation.

The primary purpose of analyzing data collected during a risk analysis is to support informed decision-making regarding identified risks. In Human Resource and organizational management, data-driven decisions are essential for effectively prioritizing threats, allocating resources, and implementing appropriate security measures. By evaluating collected data, a Physical Security Professional can understand the likelihood and impact of risks, identify vulnerabilities, and determine the most suitable mitigation strategies. While options such as identifying peak activities, selecting technologies, or communicating with management may result from the analysis, they are secondary outcomes. The core objective remains to guide sound and informed decisions that enhance organizational safety and operational efficiency. Therefore, option A is correct because it reflects the fundamental purpose of risk analysis in supporting strategic and evidence-based decision-making.

A contingent event is one that may or may not occur and is typically dependent on other conditions or events. In risk and continuity planning, a contingent event is considered in scenarios such as equipment failure, natural disasters, or cyberattacks. Preparing for such events is central to contingency planning.

Critical processes (B) are the operations needing continuity.

Conditional delegation (C) refers to assigning authority under specific conditions.

Emergency response (D) is the action taken, not the uncertain event itself.

In physical security terminology, a " facility " refers to any plant, building, office, institution, or industrial/commercial complex along with all its associated functions and structures that are part of an integrated operation. This includes everything from administrative buildings to warehouses and utility structures.

This definition helps determine the scope of security assessments and protective strategies under Domain 1 of the PSP program, " Physical Security Assessment. "

“Contents” (B) refers to the items inside a facility.

“Interior” (C) refers to internal areas within a facility.

“Padlocks” (D) are physical locking devices and do not define a type of structure or location.

???? References:

ASIS International, Physical Security Principles (PSP) Study Guide – Domain 1: Physical Security Assessment

Protection of Assets (POA) Manual – Chapter: Physical Security Concepts

The correct answer is A. To provide connectivity.

In a physical security system, the communications subsystem serves as the link that allows different security subsystems to exchange signals, data, alarms, and control information. It supports connectivity between devices such as access control panels, intrusion detection sensors, video surveillance systems, alarm monitoring equipment, control stations, and other integrated security components.

The other options are related but too narrow:

Coordinating surveillance operations is usually a function of the video management or command-and-control system.

Emergency communications may be supported by the broader communications infrastructure, but that is not its primary role for all security subsystems.

Secure data transmission is important, especially in modern networked systems, but the basic primary function is still to provide connectivity.

Therefore, the communications subsystem’s main purpose is to provide connectivity across all security subsystems so they can operate as an integrated security system.

In perimeter lighting, light should be directed away from the protected area (toward potential adversaries) to illuminate potential threats outside the fence or perimeter, making it easier to detect intrusions. Backlighting (placing the source behind the area being monitored) enhances visibility of trespassers without creating glare for security personnel.

A, C, and D correctly describe standard characteristics of perimeter lighting.

B incorrectly suggests the wrong direction for optimal lighting design.