ASIS-PSP Physical Security Professional (PSP) Exam Question and Answers

A Single Pass System issues a unique, coded pass or badge to an employee, which is retained for continued use during employment. The pass allows access to predefined areas and is typically updated if access rights change or when employment ends.

Piecemeal security refers to the ad hoc or fragmented implementation of security measures without an overarching strategic plan. Security elements are added reactively, often after an incident or perceived risk, rather than being guided by a coordinated risk assessment. This results in inconsistent, sometimes redundant or ineffective protection efforts, leaving gaps in security coverage.

References from PSP: ASIS POA – Strategic Security Planning; PSP Study Manual – Program Design Principles

A crime is defined as a voluntary and intentional violation of a law by someone who is legally competent. It involves breaking a legal duty meant to protect society. This can include actions that are prohibited or omissions where action was legally required.

Corruption (A) is a specific type of crime involving abuse of power.

Law-breaking (B) is a general, non-legal term.

Fault (C) is too broad and often used in civil contexts.

Nuisance alarms, particularly from doors, are often caused by mechanical failures such as worn hinges, faulty magnetic switches, or misaligned contacts. Regular inspections and maintenance are the most effective way to reduce false alarms.

Signage (A) helps inform but doesn’t fix the mechanical issue.

Patrols (C) are reactive, not preventative.

Janitorial scheduling (D) can reduce traffic but doesn’t address faulty hardware.

The ignition stage is the point at which a fire starts. This occurs when fuel, heat, and oxygen are present in the correct combination and for the right duration. It marks the beginning of combustion and transitions the scenario from a fire hazard to an active fire.

Free burning (A) is a later stage where flames are fully developed.

Pyrolysis stage (C) refers to pre-ignition gas release.

Incipient stage (D) can be synonymous with ignition but more commonly refers to the pre-flame development phase.

An alarm sensor (also called a detector or initiating device) detects specific changes such as motion, temperature, or opening/closing of entry points. It is the primary component in any detection system and initiates the alarm response.

When selecting countermeasures, the most important factor is the overall risk posed to the asset or operation. This includes both the likelihood of a threat and the potential impact. Cost, criticality, and probability are components of the risk equation but are not stand-alone decision criteria.

A (Cost) is important for feasibility but follows risk evaluation.

B (Probability) and C (Criticality) contribute to risk but don’t outweigh it individually.

Bid specifications are comprehensive documents that define the project ' s scope, including equipment requirements, installation standards, and ongoing maintenance services. They are essential for ensuring that contractors and suppliers provide consistent and comparable proposals.

Needs analysis (B) identifies security requirements but does not specify equipment or service contracts.

ROI and cost-benefit analysis (A and D) evaluate financial viability but don’t document specifications.

Comprehensive Detailed Explanation:

Nuisance alarm rate is a measure of system reliability and is calculated by tracking the number of false or unwanted alarms over a specified time. This metric is crucial for tuning sensor performance and reducing unnecessary responses.

A, B, and C provide insights but are not standard methods of calculating nuisance alarm rate.

Color rendition refers to how accurately a light source displays colors in comparison to natural daylight. In security lighting, especially for surveillance and CCTV, high color rendition allows operators to better distinguish colors, which can be critical for identification purposes (e.g., clothing or vehicle color).

B (Color temperature) relates to the warmth or coolness of light, not how colors appear.

C and D describe related but less precise aspects of lighting performance.

From a management perspective, organizing a security operation involves multiple interconnected activities:

Planning and goal setting (A) to define the scope and objectives.

Establishing controls (B) such as policies, standard operating procedures, and compliance mechanisms.

Hiring personnel (C) with appropriate qualifications and placing them in roles suited to their capabilities.

All these components work together to structure and guide the security effort effectively.

Probability of detection refers to the likelihood that an intrusion or unauthorized action will be identified by the security system. It is a key performance metric used to evaluate the effectiveness of electronic security components such as sensors and alarms. A high probability of detection means a more reliable system.

A (System validation) is a phase where detection may be measured, but it’s not the definition.

B (Officer response) is unrelated to detection probability.

D (Response timing) is part of delay or intervention, not detection.

The multifactor approach examines terrorism through multiple dimensions, including psychological, sociological, ideological, and organizational factors. It analyzes how individuals are recruited, indoctrinated, and motivated within terrorist networks. This is key in understanding the behavioral patterns and lifecycle of a terrorist.

Smoldering burning is the final phase of a fire where visible flames are no longer present, but extreme heat persists. This occurs when the available fuel is nearly consumed, or oxygen is limited, creating a high-temperature environment without active flames. It poses a serious re-ignition risk.

Ignition stage (B) is the beginning of the fire.

Last stage (C) is too vague.

Incipient stage (D) refers to the early development before flames appear.

The Transmission Control Protocol (TCP) works with IP as part of the TCP/IP suite. It divides data into packets, numbers them sequentially, and adds error detection and correction codes. This ensures that data is transmitted reliably, in order, and without loss or corruption.

File Transfer Protocol (B) uses TCP but does not handle packet creation itself.

Information Control Protocol (C) is not a recognized protocol.

“None of the above” (D) is incorrect because TCP is the correct answer.

A guiding principle of business continuity planning is flexibility. While the plan provides structure and direction, every crisis is unique and may require adjustments. A rigid plan may fail if it doesn ' t account for variables in real-time conditions, making adaptability a critical success factor.

A (remote site capability) may be included, but it is not a universal requirement.

C is unrealistic—it ' s not feasible to have complete instructions for every possible scenario.

D (outline format) is too minimalistic and reactive rather than proactive.

Reserves are security personnel who are not assigned to fixed posts or patrol routes but are instead held in readiness to respond when assistance is needed. They may be used during emergencies, staffing shortages, or heightened security alerts. Their role is crucial in maintaining flexibility in a security force structure.

Among the listed options, asphalt has the lowest reflectance. CCTV performance depends on lighting and surface reflectivity.

Snow (A) has very high reflectance, sometimes exceeding 80%.

Sandy soil (B) and red bricks (D) reflect more light than asphalt.

Asphalt, being dark and non-reflective, absorbs more light, making it harder for cameras to capture detail unless well illuminated.

Comprehensive Detailed Explanation:

A building is considered a high-rise when its height exceeds the maximum reach of fire department equipment (typically 75–100 feet). This classification impacts safety regulations, evacuation strategies, and fire protection system requirements.

C and D are rough guidelines, but B is the technical definition used in most codes.

A describes a design feature, not a defining criterion.

In biometric systems:

False Acceptance Rate (FAR) represents unauthorized access.

False Rejection Rate (FRR) represents inconvenience to legitimate users.

From a security perspective, a low FAR is more critical because it ensures that unauthorized individuals are not granted access. A higher FRR can be tolerated in high-security environments, as it affects convenience rather than security.

A (low/low) is ideal but harder to achieve.

C and D (high FAR) compromise security.

Class K fires involve cooking oils, grease, and fats typically found in commercial kitchens. These fires require specific extinguishers that saponify the oil, cooling and smothering the flames. Class K extinguishers often contain wet chemical agents.

Class C (A) involves energized electrical equipment.

Class D (B) involves combustible metals.

Class L (D) is not a recognized fire class.

Microwave sensors are active volumetric sensors that transmit microwave signals and detect motion based on frequency changes. For optimal coverage and effectiveness, they are typically mounted near the ceiling of the protected area. This elevated placement allows the sensor to cover a wider detection zone and reduces interference from obstacles such as furniture or equipment. In workplace security and Human Resource safety management, proper sensor placement is essential to ensure reliable detection and minimize false alarms. Mounting sensors too low can limit their range and increase the likelihood of obstructions affecting performance. Positioning them at ceiling level enhances monitoring efficiency and supports a safer working environment by ensuring comprehensive coverage. Therefore, option D is correct because it provides the most effective installation position for microwave sensors.

In physical security terminology, a " facility " refers to any plant, building, office, institution, or industrial/commercial complex along with all its associated functions and structures that are part of an integrated operation. This includes everything from administrative buildings to warehouses and utility structures.

This definition helps determine the scope of security assessments and protective strategies under Domain 1 of the PSP program, " Physical Security Assessment. "

“Contents” (B) refers to the items inside a facility.

“Interior” (C) refers to internal areas within a facility.

“Padlocks” (D) are physical locking devices and do not define a type of structure or location.

📚 References:

ASIS International, Physical Security Principles (PSP) Study Guide – Domain 1: Physical Security Assessment

Protection of Assets (POA) Manual – Chapter: Physical Security Concepts

The correct answer is A. Humans.

In the ASIS PSP Body of Knowledge, asset identification is part of Domain One: Physical Security Assessment, where the security professional must identify assets to determine their value, criticality, and loss impact. The PSP Body of Knowledge specifically includes knowledge of the nature and types of assets, including tangible and intangible assets.

A tangible asset is an asset that has a physical form or physical presence. Humans/people are tangible because they physically exist and can be directly protected through physical security measures such as access control, emergency response, life safety systems, barriers, screening, and security staffing.

The other choices are not the best examples of tangible assets:

B. Information is generally treated as an intangible asset, although it may be stored on physical media.

C. Reputation is an intangible organizational asset.

D. Trademarks are intellectual property and are intangible assets.

ASIS also describes the PSP credential as related to protecting an organization’s assets, including people, property, and information, which supports the classification of people/humans as a core asset in physical security.

Therefore, the correct answer is A. Humans.

Worms are a form of malware that replicate and spread through networks. In doing so, they consume system memory and processing resources, which can result in performance degradation or denial of service for legitimate applications and users. Some worms are specifically designed to exhaust system memory.

Comprehensive Detailed Explanation:

Microwave sensors, which work by emitting electromagnetic waves and detecting changes in the reflected signal, are most effective when a target moves laterally (side-to-side) across the detection zone. This movement creates the greatest frequency shift (Doppler effect), making it easier for the sensor to detect motion.

Movement directly toward or away (C) causes minimal frequency change and can go undetected.

Speed (B or D) matters, but direction relative to the sensor is the key factor for detection efficiency.

The number of security personnel required is typically directly proportional to the size and complexity of a facility, not inversely. Larger facilities or those with more employees often require more security staff to ensure adequate coverage, surveillance, access control, and emergency response. Factors influencing personnel needs include square footage, asset value, location, threat level, and operational hours.

The statement in the question is incorrect, making the correct answer " False. "

Using two geographically and physically separate cable paths ensures redundancy. If one path is damaged (e.g., due to construction, sabotage, or natural disaster), the other can maintain communication. This is a key principle in critical infrastructure protection.

A: Surveillance helps detect issues but doesn’t prevent physical interruption.

B: Wireless is useful but often less reliable and secure than wired systems.

C: Tamper-proof cables increase security but don’t address path redundancy.

The standard life cycle of a security project includes:

Feasibility – Determine whether the project should proceed.

Design – Develop system specifications and plans.

Execution – Install and implement the system.

Closeout – Finalize and evaluate project completion, transfer documentation, and training.

A, B, and D include non-standard or loosely defined stages.

Workstations can serve as basic servers in small networks. While they are typically used for individual tasks, they can be configured to act as servers for file sharing, printing, or hosting lightweight applications without needing specialized installation or infrastructure.

Minicomputers (B) are outdated mid-range systems.

Supercomputers (C) are specialized, high-cost systems for massive computations, not typical servers.

“None of the above” (D) is incorrect because workstations can indeed be used as servers.

Comprehensive Detailed Explanation and References

Group terrorism involves an organized entity that includes a leadership hierarchy, recruitment infrastructure, training procedures, and operations planning. These groups typically have defined ideological goals and logistics networks. Examples include Hezbollah, al-Qaeda, and the FARC.

The correct answer is C. 328 ft. (100 m).

In PSP physical security system design, cabling distance is important because electronic security systems such as access control, video surveillance, and intrusion detection depend on proper communication infrastructure. The ASIS PSP Body of Knowledge includes electronic security systems, applicable codes/standards, performance requirements, and technical system design capacities under physical security system design.

For category-rated UTP cable, the standard distance limitation is 100 meters, which equals approximately 328 feet. This is the commonly accepted maximum channel distance for category-rated twisted-pair Ethernet cabling. TIA/EIA cabling references repeatedly use 100 m (328 ft) as the standard measurement length for category-rated cable performance values.

Therefore, the correct PSP-relevant answer is C. 328 ft. (100 m).

Warm sites are backup facilities that are partially equipped and can be brought online relatively quickly in the event of a disaster. They typically have necessary infrastructure (e.g., power, networking) and some hardware but are missing the primary computer systems or up-to-date data.

Hot sites (A) are fully configured and ready for immediate use.

Cold sites (C) are empty facilities with just space and basic utilities.

Frequent sites (D) is not a recognized term.

Insurance is not a substitute for a security program. It only compensates for loss after it occurs and does not prevent incidents. A comprehensive security program includes preventive measures such as access control, surveillance, personnel training, and emergency planning, which work in tandem with insurance as part of a broader risk management strategy.

References from PSP: ASIS POA – Insurance vs. Security Controls; PSP Study Guide – Prevention vs. Compensation

Special-use alarms are tailored to monitor specific environmental or operational conditions. They include sensors and devices that detect temperature thresholds, toxic gas presence, machine vibrations, or over-speed conditions in mechanical systems. These alarms are critical in industrial and hazardous environments.

When a bomb threat targets a specific floor, safety protocols typically mandate evacuation of the identified floor and the floors immediately above and below. This accounts for the potential blast radius and structural impact, ensuring personnel safety in adjacent vulnerable areas.

A is too vague.

C and D (all floors above or below) may be excessive unless threat specifics demand it.

The Pass-Exchange System enhances security by requiring that the employee exchanges one pass for another at a control point before entering a more secure or restricted area. This ensures that access is tightly monitored and controlled on a zone-by-zone basis.

A Business Impact Analysis (BIA) identifies critical functions and assesses the financial and operational impact of business disruptions. It helps prioritize recovery efforts and supports continuity planning by quantifying potential losses.

Enterprise impact analysis (A) and Managerial impact analysis (B) are not formal terms.

Critical process impact (C) is a component considered in the BIA but not the term itself.

The distance from the camera to the gate is the straight-line distance, which must be calculated using the Pythagorean theorem since the camera is mounted above ground and the gate is a horizontal distance away.

Using the formula:

√(height² + horizontal distance²)

= √(40² + 30²)

= √(1600 + 900)

= √2500 = 50 feet

So, the focal length must accommodate a 50-foot (15-meter) distance.

A change key is designed to operate a single specific lock within a keyed system and is typically assigned to an individual user for limited access. In key control systems, which are important in organizational and Human Resource security management, different key types are used to control access levels. A change key provides the lowest level of access, ensuring that employees can only enter authorized areas relevant to their roles. This supports accountability, reduces security risks, and helps enforce workplace policies. Options A and C describe functions of master or grand master keys, which open multiple locks. Option D refers to control or core keys used for lock maintenance. Proper use of change keys helps organizations maintain structured access control and protect assets, personnel, and sensitive areas effectively.

Preventive maintenance involves proactive actions taken to ensure systems continue to operate efficiently and to prevent failures before they occur. Updating system and application software is a clear example of preventive maintenance because it improves system performance, addresses vulnerabilities, and ensures compatibility with current operational requirements. In Human Resource and organizational management contexts, preventive maintenance supports uninterrupted operations, protects organizational assets, and ensures employee safety by reducing the likelihood of system failures. In contrast, investigating problems, restoring systems, and updating documentation are reactive or corrective maintenance activities that occur after an issue has already arisen. Preventive measures like regular updates, inspections, and testing help maintain reliability and reduce downtime. Therefore, option B is correct because it reflects a proactive approach to maintaining system effectiveness.

An Invitation to Bid (ITB) is typically used when the buyer has clearly defined requirements and a good understanding of the market offerings. It focuses on obtaining competitive pricing for known solutions and is suitable for well-specified projects where minimal deviation is expected.

B (Request for proposals) is used when buyer needs input on how to meet requirements.

C (Sole source) limits competition and is only used under specific conditions.

D (Request for quote) is generally used for lower-cost, commodity items.

Risk acceptance is the mitigation option that has no direct cost because the organization chooses to acknowledge the risk without taking additional action to reduce, transfer, or eliminate it. In Human Resource and organizational management, this approach is typically used when the cost of mitigation exceeds the potential impact of the risk or when the risk level is considered minimal. While there may still be indirect consequences if the risk materializes, no immediate financial investment is required to manage it. In contrast, risk avoidance may involve changing operations, risk limitation requires implementing controls and safeguards, and risk transference often includes costs such as insurance or outsourcing. Therefore, option B is correct because risk acceptance does not require upfront expenditure, making it the only option with no direct cost.

In a competitive pre-bid conference, the most important information to record in the meeting minutes is the project questions raised and the answers provided during the conference. From an organizational and Human Resource management perspective, accurate documentation supports fairness, transparency, and equal access to information for all participants. If all bidders receive the same clarifications, the process remains ethical and professionally managed. Recording only attendance or walk-through details does not fully protect the integrity of the bidding process. The questions and answers are critical because they may affect how contractors interpret requirements, prepare pricing, and understand project expectations. Proper records also reduce misunderstandings, disputes, and claims of favoritism. Therefore, option D is the correct answer because it best supports a fair and well-documented procurement process.

If stairwells are used regularly for inter-floor travel and permitted by local code, the best practice is to maintain both life safety and security. This can be done by installing approved access control devices (e.g., card readers) and two-way communication systems (intercoms) to manage access while allowing emergency use.

A (Fail-secure locks) could pose a safety risk in emergencies.

B (Unlocked doors) may violate building security policies.

C (Selective unlocking) is inconsistent and may cause confusion during emergencies.

Recovery of critical processes depends heavily on identifying and assessing the resources needed—such as personnel, facilities, IT systems, and communication tools. Without a proper resource assessment, recovery plans may fail to address key operational dependencies.

Modern terrorism, unlike historical or localized violence, leverages advanced technologies and global networks. It necessitates comprehensive national strategies involving political decision-making, resource allocation, intelligence, law enforcement, and industry collaboration to combat the sophisticated threats posed.

The correct answer is C. Equipment performance testing.

In PSP physical security implementation, testing is used to verify that installed security equipment and systems actually perform according to required functional and performance objectives. The ASIS PSP Body of Knowledge includes functional requirements, performance requirements, success metrics, commissioning, and final acceptance testing as part of physical security system design and implementation.

Equipment performance testing is the specific type of testing used to determine whether equipment or a system is functional, has adequate sensitivity, and meets its design and performance objectives. This matches the wording of the question directly. Physical security testing guidance also describes security system performance testing as determining whether security equipment is functional, has adequate sensitivity, and meets design and performance objectives under operating conditions.

The other options are not the best answer:

A. Factory acceptance testing is normally conducted before delivery or installation to verify equipment at the factory or vendor stage.

B. Reliability performance testing focuses more on dependability, availability, or continued operation over time.

D. Site acceptance testing verifies the installed system at the actual site, but the wording about functionality, sensitivity, and design/performance objectives specifically describes equipment performance testing.

Therefore, the correct answer is C. Equipment performance testing.

The correct answer is C. environmental and degradation factors.

In PSP physical security design, lighting is treated as a structural security countermeasure, and the ASIS PSP Body of Knowledge includes knowledge of lighting, electronic security systems, performance requirements, and security system design capacities.

A 4:1 light-to-dark ratio means the brightest area should not be more than four times brighter than the darkest area within the assessed scene. This provides relatively even illumination for guards and video assessment systems. In physical protection system guidance, the light-to-dark ratio directly affects the ability to assess a scene; very high ratios create dark blind spots, while a lower ratio such as 4:1 greatly reduces those blind spots.

The reason 4:1 is used as the preferred design goal is that lighting systems degrade over time due to environmental and maintenance-related factors such as lamp aging, dirt on fixtures, weather effects, dust, damaged lamps, vegetation growth, and surface reflectance changes. Guidance on security camera lighting states that lighting may be designed for a 4-to-1 ratio to allow for degradation over time, while a 6-to-1 ratio is still used as a practical maximum to avoid areas becoming too dark or too bright for assessment.

The other options are not the best answer:

A. High surface reflection may help contrast, but it is not the reason for selecting a 4:1 design goal.

B. High aspect ratio is not a security lighting design objective in this context.

D. Reflected glare reduction is important, but the 4:1 ratio is mainly selected to maintain usable illumination despite environmental and degradation factors.

Therefore, the correct answer is C. environmental and degradation factors.

During a security survey, plan drawings provide the layout of a facility, showing the position of walls, doors, windows, corridors, and other structural elements. These drawings serve as the primary reference for determining the placement and coverage of security devices such as cameras, access control points, sensors, and alarms.

Elevation drawings depict vertical surfaces and are used primarily for understanding façade or wall-mounted equipment placement.

Details drawings provide component-level specifications but do not give the full spatial context.

Riser diagrams illustrate electrical or network paths vertically through a building and help with cabling but not with overall device location planning.

Plan drawings give a comprehensive, horizontal layout view, which is essential for surveyors to accurately locate and document all security devices in relation to the facility’s operational spaces, consistent with ASIS PSP guidance.

Post orders are written instructions for security personnel detailing duties, responsibilities, and conduct at a specific post. These orders must clearly express the policies and expectations of the protected organization, ensuring alignment with security protocols and business objectives.

A (Reviewing shift log) is a task, not a policy directive.

C (Verbal instructions override written) contradicts best practice.

D (Policies of local authorities) may influence actions but do not replace enterprise policies in post orders.

A security survey is a detailed, on-site examination of an organization’s premises, operations, procedures, and systems. Its purpose is to identify weaknesses, evaluate risks, and recommend countermeasures. It includes physical inspection, interviews, documentation reviews, and testing of current security controls.

This is distinct from a risk analysis (which is more data-focused) or a performance audit (which evaluates outcomes rather than vulnerabilities).

References from PSP: Physical Security Assessment – ASIS POA; PSP Certification Study Manual – Domain 1

Strict liability applies when a manufacturer or service provider is held legally responsible for damages or injuries caused by a defective product or service, regardless of fault or intent. This type of liability is often associated with consumer protection laws, where the focus is on the danger posed to the user rather than negligence on the part of the provider.

Plaintiff (B) is the party bringing the suit.

Defendant (C) is the party being sued.

" None of the above " (D) is incorrect since " Strict liability " is the correct legal principle.

The effectiveness of entry control systems is typically measured by:

Throughput (speed of entry)

False Acceptance Rate (FAR) — unauthorized access

False Rejection Rate (FRR) — denial of access to authorized users

These metrics provide insight into both the security and user experience of the access control system.

A (Cost) is relevant to budgeting, not effectiveness.

B (Activation delays) may affect throughput but isn’t a primary measure.

D (System obsolescence) relates to lifecycle, not effectiveness.

Determining the objectives of a Physical Protection System (PPS) begins with understanding the context—what needs to be protected, how the facility operates, what processes are in place, and what assets exist. This foundational understanding informs risk assessments and system requirements.

A (Risk analysis) comes after defining what’s being protected.

B (Budget) is important but not the starting point.

D (Business case) is an outcome, not an initial step.

Risk assessment in the PSP framework is centered on understanding the interplay between assets, exposure, and losses.

Assets are the people, property, information, and operations that must be protected.

Exposure represents the vulnerability or likelihood that an asset will be affected by threats or hazards.

Losses are the potential consequences, whether financial, operational, reputational, or physical, if a threat materializes.

By systematically analyzing these three considerations, security professionals can prioritize risks, allocate resources effectively, and design appropriate mitigation strategies. Countermeasures are developed later as responses to identified exposures and potential losses, not as a primary input to risk classification. This aligns with ASIS guidance on structured risk assessment and enterprise security risk management.

Crime Prevention Through Environmental Design (CPTED) is a proactive design philosophy that uses environmental elements to reduce crime opportunities. One of its core principles is natural surveillance, which involves designing spaces so that legitimate users can easily observe their surroundings. This increases perceived risk for offenders and discourages criminal activity.

A (Balanced systems), B (Protection in depth), and D (Layered defense) are principles used in security system design but not specific to CPTED.

Training plays a critical role in enhancing employee motivation, which directly contributes to higher employee morale. In Human Resource management, well-designed training programs improve employees’ skills, confidence, and sense of value within the organization. When employees feel competent and supported, their job satisfaction increases, leading to a more positive attitude toward their work and the organization. This improved morale often results in better teamwork, reduced turnover, and increased productivity. Training does not inherently increase workload or supervision, nor is legal protection its primary outcome. Instead, it strengthens employee engagement and commitment. Therefore, the most accurate outcome of improved staff motivation through training is enhanced employee morale, making option D the correct answer.

Holography on ID badges provides a unique, hard-to-replicate visual feature that significantly reduces the chances of badge counterfeiting. Holograms are difficult to duplicate with standard printing technologies, thus enhancing the integrity of badge-based access control systems.

Theft (A) and Intrusion (C) are indirect risks that holography helps mitigate by reducing counterfeiting.

Security (D) is a broad concept rather than a specific risk being addressed.

Comprehensive Detailed Explanation and References

Intrusion alarms are systems specifically designed to detect unauthorized entry into a protected area while the system is active. These alarms respond when a perimeter is breached, such as through windows, doors, or motion detection. When triggered, they signal unauthorized access.

The description in the question refers to a " qualified " or " trained " individual in security or loss prevention, but none of the answer choices—Engaged liaison, Review personnel, Supportive person—specifically identify a person already knowledgeable in loss prevention and security. Therefore, “None of the above” is the correct choice as it best fits the context.

Engaged liaison (A) refers to someone facilitating coordination, not necessarily with security knowledge.

Review personnel (B) and Supportive person (C) are too generic and do not accurately define a trained security professional.

The most widely accepted classification of leadership skills includes:

Conceptual skills: Ability to think abstractly and see the " big picture "

Human relations skills: Interpersonal and communication capabilities

Technical skills: Expertise and proficiency in specific tasks

These skill sets are collectively known as the " skill mix " and are essential for effective security leadership.

Private security refers to individuals or organizations that offer security-related services for compensation. This includes both self-employed individuals (such as independent security consultants or contractors) and funded business entities (such as security companies or firms) that provide services to private clients for a fee. These services may include guarding, patrolling, risk assessments, investigations, alarm monitoring, or other protective activities.

Conditional honesty is a behavior pattern where a person acts honestly primarily due to the fear of being caught or facing consequences. Unlike integrity, which is internal and moral-based, conditional honesty is external and consequence-based. It is considered a product of reasoning and is a key concept in evaluating personnel risk in security-sensitive roles.

Encryption is a method of converting readable data into an encoded format using algorithms. Only those with the appropriate decryption key can convert the data back into its original, usable form. It is a primary method for protecting data confidentiality in storage and transmission.

Distraction (A), Disgruntling (B), and Falsification (C) are unrelated to data protection techniques.

Ethernet was developed in the early 1970s by Robert Metcalfe and his team at Xerox Corporation’s Palo Alto Research Center (PARC). It became the foundational technology for local area networks (LANs) and remains widely used in networking today.

IBM (B) developed other networking technologies but not Ethernet.

Microsoft (C) is a software company and did not develop Ethernet.

Comprehensive Detailed Explanation:

Pyrolysis is the chemical decomposition of solid materials (often organic) caused by heat. It results in the release of flammable gases or vapors, which can mix with oxygen and ignite. Pyrolysis is a critical process in the early stages of a solid-fuel fire.

Liquidity (A) and Vaporization (B) refer to liquids turning into gas, not solid decomposition.

“None of the above” (D) is incorrect since “Pyrolysis” is the correct term.

Proprietary security officers are employed directly by the organization they protect, which often leads to:

Higher loyalty to the organization (B),

Stronger identification with company values,

Higher prestige and potential quality of personnel (A, D).

However, this close affiliation can reduce impartiality, especially in situations involving internal investigations or enforcement actions against coworkers or executives.

Material Safety Data Sheets (MSDS), now referred to as Safety Data Sheets (SDS) under the Globally Harmonized System (GHS), provide detailed information about chemicals, including hazards, handling procedures, and emergency measures. OSHA regulations require employers to maintain these sheets for all hazardous substances in the workplace.

Asset Standard Act (A), Procurement Asset Safety Program (C), and Product Stability Program (D) are not applicable to this requirement.

Metal halide lamps emit a bright, white light with a bluish cast. This makes them ideal for applications requiring good color rendering and visibility, such as CCTV surveillance or high-intensity outdoor lighting.

A (Sodium vapor) emits yellow/orange light.

C (Mercury vapor) also has a bluish tint but less desirable color rendering.

D (Incandescent) gives off a warm, yellowish light.

Integrity and lie detection tests fall into multiple categories, including:

Polygraph: Measures physiological responses to assess truthfulness.

Psychological Stress Evaluator (PSE): Analyzes voice stress to detect deception.

Personal Security Inventory: A written assessment designed to evaluate honesty and attitudes toward theft or other misconduct.

Each of these tools can play a role in assessing trustworthiness, particularly in high-risk or sensitive positions, and are often part of pre-employment or internal investigation procedures (where legally permissible).

Capability refers to the potential of a person to commit dishonest acts, and it is considered a controllable variable in security management. The degree of control needed over a person ' s capability depends on their level of honesty. In environments with higher risks of internal threats, security systems, supervision, and checks may be increased to mitigate the risks associated with those who have both opportunity and capability.

Targeting refers to the process by which a threat actor selects a specific facility or asset based on attractiveness, vulnerabilities, symbolic value, or opportunity. This helps differentiate why one location may be more likely to be attacked than another.

Motivation (B) refers to the reason behind the attack.

Collusion (C) involves cooperation between insiders.

Desire (D) is a psychological element, not an operational step.

Gopher is a hypertext-based information retrieval tool that predates the World Wide Web. It uses a series of text-based menus to allow users to navigate and access various types of textual information hosted on servers. It was one of the first attempts at organizing and accessing online information in a user-friendly way.

Consortium (A) refers to a group or association, not a technology.

Hyper-text based tool (B) is descriptive but not the specific name of the system.

Symantec (C) is a cybersecurity software company, unrelated to menu-based text access systems.

Insurance companies provide coverage based on actuarial calculations that allow them to remain profitable. The total amount of premiums collected across all policyholders must exceed the total claims paid. Therefore, the estimated value of all losses across a pool of insured clients is generally less than or balanced with the total premiums collected, ensuring profitability and sustainability for the insurer.

References from PSP: ASIS POA – Insurance Principles and Economics; PSP Manual – Underwriting and Risk Pooling Concepts

The classic “fire triangle” describes the three elements necessary for fire to occur:

Heat – to raise material to ignition temperature

Fuel – combustible material

Oxygen – typically from the air, to sustain combustion

Removing any one of these three elements will prevent or extinguish a fire.

Performance testing typically involves precise measurement using calibrated instruments or devices to ensure systems meet specified performance criteria (e.g., camera resolution, sensor range, alarm response time).

A (Operational) testing checks usability.

C (Subsystem) testing targets individual components.

D (Post-maintenance) confirms system functionality after servicing.

Security is increasingly recognized as a critical management function in global business operations. From protecting physical assets to ensuring the safety of personnel and intellectual property, security plays a vital role in risk mitigation and continuity planning. It integrates with other business areas such as compliance, human resources, and information technology.

For confined interior areas containing explosive vapors or materials, non-emitting sensors are preferred to avoid ignition risk. Passive Infrared (PIR) sensors are ideal in such environments because they detect heat signatures (infrared energy) emitted by intruders without emitting any signals or energy that could trigger an explosion.

A (Ultrasonic) and C (Capacitance) sensors emit signals.

D (Passive vibration sensors) detect vibration and are used in a different context, like surface tampering.

Throughout the life of a project, the project manager spends the most time on control activities. This includes monitoring progress, managing changes, addressing issues, ensuring compliance with scope, cost, and schedule, and keeping stakeholders informed. Control is ongoing from initiation through closeout.

A (Documentation), B (Meetings), and C (Planning) are important but represent specific tasks or phases, not the most time-consuming activity overall.

The prediction of internal crime (e.g., theft, fraud) heavily relies on historical data to identify patterns, vulnerable departments, and recurring behaviors. This data-driven approach informs proactive security strategies.

A (Background checks) are preventive, not predictive.

B and C offer useful insights but are not the primary basis for trend analysis.

Risk transfer involves shifting the financial impact of a risk to a third party, such as through an insurance policy. By purchasing insurance, the organization transfers the monetary burden of certain events (e.g., theft, damage, liability) to the insurer.

A (Avoidance) means eliminating the risk entirely.

C (Reduction) involves lowering the likelihood or impact.

D (Spreading) divides the risk among multiple entities, not full transfer.

An initial threat or hazard evaluation must include an assessment of how likely each threat is to occur. This probability, when combined with impact analysis, forms the foundation for risk assessments. Understanding likelihood allows prioritization of mitigation strategies.

A (Estimate costs) and C (Develop business case) are later steps.

D (Develop response plan) comes after risk characterization.

In major construction projects, the security consultant holds the primary responsibility for producing and maintaining the documentation for the final security system design.

The security consultant integrates the client’s requirements, risk assessments, and compliance standards into a coherent design package.

While security vendors and system engineers implement and configure components, and architects manage building design, the security consultant ensures the overall security strategy, technical specifications, and integration documentation are properly detailed for construction, procurement, and operational handover.

This includes schematics, system diagrams, installation guidelines, and operational procedures, ensuring that the system aligns with both security objectives and project standards.

This approach aligns with PSP guidance, emphasizing that oversight and documentation of integrated security systems require professional expertise in security planning, not solely technical or architectural roles.

The three keys to a successful contract or partnership in the context of security management are:

Accessibility: Open communication and availability between parties.

Meetings: Regular reviews and check-ins to ensure alignment.

Resource Management: Efficient allocation and use of both personnel and technical resources.

These three elements contribute to maintaining accountability, service quality, and responsiveness between the security provider and client.

Comprehensive Detailed Explanation:

Identity theft is the act of obtaining and using someone else ' s personal or financial information—such as social security numbers, bank details, or credit card information—without permission, often for committing fraud or other criminal activities.

Identity fraud (A) refers to the actual fraudulent acts committed after the identity is stolen.

Identity dissemination (C) and Identity distortion (D) are not standard legal or cybersecurity terms.

Annual Loss Expectancy (ALE) is calculated as:

ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO),

which reflects the impact (SLE) and the frequency (ARO) of an event. This formula is a key component in risk assessment for determining expected financial loss.

A, B, and C are partially correct but not the accepted risk formula framework.

Physical barriers are designed to defend against three main penetration techniques:

Stealth: Unauthorized entry without detection.

Deception: Gaining access through trickery or impersonation.

Force: Physical breaching of barriers or using tools or vehicles to gain entry.

Security systems are designed to detect and delay each of these methods effectively.

A and B mix categories inaccurately.

C (Vehicle) is a tool/method of force, not a category on its own.

Observability refers to how easily an adversary can detect or notice a weakness in a system, process, or environment. In risk management and security concepts often applied within Human Resource and organizational safety frameworks, observability is directly linked to the visibility of vulnerabilities. If a vulnerability is highly observable, it means that it can be easily recognized by an external or internal threat actor. This recognition increases the likelihood that the weakness may later be exploited. However, observability itself does not involve exploiting or causing the vulnerability, but rather identifying its presence. HR policies and workplace controls aim to reduce observability by implementing safeguards, training, and awareness programs to ensure that sensitive weaknesses are not easily detected by unauthorized individuals.

The owner’s formal acceptance of a security system—usually after site acceptance testing—is the point at which the warranty period typically begins. From this moment, the vendor or contractor is responsible for addressing defects or performance issues as stipulated in the contract.

B and C (Phase II references) are not standard project stages.

D (Site acceptance testing) occurs before acceptance and warranty activation.

Vicarious liability refers to an indirect legal responsibility held by an organization for the actions or omissions of its employees or agents. This is particularly relevant in the security industry when an enterprise employs or contracts security personnel. If those personnel cause harm or violate rights while performing their duties, the employer can be held liable—even if the employer did not directly engage in the act.

Strict (A) refers to liability without fault.

Negligence (B) is direct liability due to carelessness.

Loose (D) is not a recognized legal term.

Preliminary cost estimates are developed during the feasibility phase of a project. These early estimates help determine whether a project is viable and worth pursuing, guiding initial decision-making and budgeting discussions.

A (Design) and B (Development) phases involve more detailed cost estimates.

C (Execution) is when implementation begins, after funding is approved.

Under the pure comparative negligence approach, a plaintiff can recover damages even if they were primarily responsible for their own injury. For example, if the plaintiff was 90% at fault, they could still recover 10% of the damages from the defendant. This model allows for partial recovery based on proportional fault, regardless of the level of the plaintiff’s responsibility.

50/50 rule and 51 percent rule prevent recovery when the plaintiff is found equally or more at fault.

Security is not a standalone function; it must align with and support the broader mission and strategic goals of the organization. This includes protecting assets, enabling business continuity, and ensuring safety in a way that complements business objectives.

A (Quarterly cycle) is not a standard requirement.

B (Certified manager) is good practice but not a defining mandate.

D (Lowest cost) is not always ideal; effectiveness and alignment are more important than minimal cost.

An operational audit is a continuous and comprehensive review of all facets of the security operation. It evaluates whether security procedures are functioning as intended and whether resources are being used efficiently. This process identifies inefficiencies, policy violations, or procedural weaknesses over time.

References from PSP: ASIS POA – Security Operations Review; PSP Study Manual – Domain 3: Operations and Program Evaluation

Risk management is defined as the process of planning and implementing measures before a loss occurs to ensure that, should an adverse event happen, the business can continue operations with minimal disruption. It includes the design of preventive controls and the establishment of contingency plans to safeguard continuity after loss.

References from PSP: ASIS POA – Business Continuity and Risk Response Planning; PSP Guide – Continuity and Crisis Management Principles

Balanced magnetic switches are designed to be more resistant to tampering than simple magnetic switches. They include additional magnetic elements and polarity configurations that make it difficult for an intruder to manipulate the circuit with an external magnet.

A is true for both types of switches.

B and C are incorrect technical descriptions for balanced switches.

The correct answer is A. To provide connectivity.

In a physical security system, the communications subsystem serves as the link that allows different security subsystems to exchange signals, data, alarms, and control information. It supports connectivity between devices such as access control panels, intrusion detection sensors, video surveillance systems, alarm monitoring equipment, control stations, and other integrated security components.

The other options are related but too narrow:

Coordinating surveillance operations is usually a function of the video management or command-and-control system.

Emergency communications may be supported by the broader communications infrastructure, but that is not its primary role for all security subsystems.

Secure data transmission is important, especially in modern networked systems, but the basic primary function is still to provide connectivity.

Therefore, the communications subsystem’s main purpose is to provide connectivity across all security subsystems so they can operate as an integrated security system.

The recommendations from the U.S. Department of Justice Task Force on Private Security Training include:

A minimum of 8 hours of formal pre-assignment training (A),

32 hours of basic training within two months of assignment, with at least 16 hours being supervised on-the-job training (B).

These guidelines aim to professionalize private security personnel and improve effectiveness and accountability.

Privacy invasion is a legal or ethical issue, not a type of insurance policy. Common types of insurance relevant to security include:

Fidelity Bonds: Cover losses due to employee dishonesty

Surety Bonds: Provide financial assurance that obligations will be fulfilled

3-D (Dishonesty, Disappearance, and Destruction) Policies: Provide broader coverage for internal and external crimes

Privacy-related issues may be addressed under cyber liability or data breach insurance but not as a standalone policy called “Privacy Invasion.”

Comprehensive Detailed Explanation:

During the planning phase of a physical protection system, key deliverables include:

Preliminary design: Conceptual plans showing system layout and strategy.

Drawings: Visual representations that help in communicating system intent and scope.

These work products set the foundation for detailed design and implementation.

A, B, and C include elements used later in the process (procurement, budgeting).

Proprietary security services are those in which the security personnel are hired, trained, and managed directly by the organization they protect. They are part of the company’s staff and are not outsourced from external firms. Proprietary security typically ensures tighter integration with company culture and policies and offers better control over personnel and procedures.

Contract security services (Answer D) involve third-party firms providing personnel who are not employees of the protected organization.

Security enforcement (Answer B) is a general term, not a specific classification.

Pilferage (Answer C) refers to theft and is unrelated to service type.

The three types of comparative negligence statutes include:

Pure approach (A): The plaintiff’s compensation is reduced by their percentage of fault, no matter how high.

50/50 rule (B): The plaintiff can recover damages only if their fault is 50% or less.

51 percent rule (C): The plaintiff can recover only if they are less than 51% at fault.

All three are valid comparative negligence models used in different jurisdictions.

Security standards typically require that any opening in a perimeter (e.g., HVAC ducts, pipe chases, vents) be lockable or otherwise protected if the cross-sectional area is 96 square inches or greater. This threshold is based on a size that could permit unauthorized entry or object passage.

A, B, and D are incorrect measurements based on security industry benchmarks.

Security awareness training ensures that all employees understand security policies, recognize threats, and know how to respond appropriately. It is critical for creating a proactive security culture and ensuring that all layers of defense—including human factors—are effective.

A, B, and D refer to specific training content areas, but security awareness encompasses overall employee engagement and is critical for program success.

The Chief Security Officer (CSO) is responsible for overseeing an organization’s entire security posture—including physical, personnel, and sometimes information security. A crucial part of this role is ensuring that communication channels are effective. The CSO must analyze these channels regularly to ensure that the information received is accurate, relevant, timely, concise, and actionable for security operations and decision-making.

CIO (A) focuses on IT systems.

Information Security Officer (B) handles cybersecurity but may not oversee overall physical security.

Chief Minister (C) is a governmental/political role, not organizational security.

An active volumetric sensor emits energy (such as sound waves or electromagnetic fields) into a defined volume and detects changes caused by movement or presence within that space. Ultrasonic sensors are a common example:

They transmit high-frequency sound waves and measure the reflections to detect objects or intruders in a monitored area.

Infrared sensors are often passive (detecting heat) or line-of-sight, rather than volumetric.

Capacitive sensors detect changes in an electric field but are typically used for proximity or tamper detection.

Vibration sensors detect mechanical disturbances rather than volumetric intrusion.

Active volumetric sensors are widely used in intrusion detection systems for rooms, corridors, or other enclosed spaces because they monitor an entire volume rather than just a single point or surface.

Bottom of Form

Once a crime has occurred on company property, the organization is considered “on notice.” If a similar incident happens again, it can be deemed “foreseeable,” and the company may be held liable for failing to prevent it.

B and D (Inadequate security, breach of duty) may result from foreseeability, but are not the legal principle itself.

C (Legally binding) is unrelated to crime foreseeability in this context.

Business continuity involves two core stages:

Business Recovery – restoring critical business functions quickly after a disruption.

Business Resumption – full restoration of all business operations to normal levels over the long term.

This sequence ensures operational stability in the short term and complete restoration in the long term.