ASIS-PSP Physical Security Professional (PSP) Exam Questions and Answers

In loss prevention, the “common denominator” refers to a recurring factor or condition that presents an opportunity for theft, such as lack of supervision, poorly designed procedures, or inadequate physical security. Identifying and addressing these common denominators can significantly reduce incidents of pilferage or loss.

Low deterrence (A) is a result, not a proactive factor.

Confusion (B) may contribute but isn’t the primary concept here.

Reduced pilfering (D) is an outcome, not an ingredient.

This statement reflects a well-recognized trend in modern security models. As public law enforcement agencies face increasing demands and limited resources, private sector security is expected to play a larger role in crime prevention, particularly in areas like property protection, corporate investigations, and access control. This shift allows public police to focus more on violent crime and emergency response.

Comprehensive Detailed Explanation and References

Group terrorism involves an organized entity that includes a leadership hierarchy, recruitment infrastructure, training procedures, and operations planning. These groups typically have defined ideological goals and logistics networks. Examples include Hezbollah, al-Qaeda, and the FARC.

Project management principles emphasize balancing scope, time, and cost, often referred to as the project management “triple constraint” or “iron triangle.”

Scope defines the work required to complete the project successfully, including deliverables, system specifications, and operational objectives.

Time represents the project schedule and deadlines for completing tasks, phases, or milestones.

Cost encompasses budgetary limits, including labor, materials, equipment, and contingencies.

A project manager must continuously monitor and adjust these factors to ensure that changes in one area do not negatively impact the others. For example, expanding scope without adjusting time or cost can jeopardize project success. This approach aligns with PSP guidance for security system projects, where maintaining balance among scope, schedule, and budget is critical to delivering an effective and operationally viable security system.

Preventive maintenance involves proactive actions taken to ensure systems continue to operate efficiently and to prevent failures before they occur. Updating system and application software is a clear example of preventive maintenance because it improves system performance, addresses vulnerabilities, and ensures compatibility with current operational requirements. In Human Resource and organizational management contexts, preventive maintenance supports uninterrupted operations, protects organizational assets, and ensures employee safety by reducing the likelihood of system failures. In contrast, investigating problems, restoring systems, and updating documentation are reactive or corrective maintenance activities that occur after an issue has already arisen. Preventive measures like regular updates, inspections, and testing help maintain reliability and reduce downtime. Therefore, option B is correct because it reflects a proactive approach to maintaining system effectiveness.

Under the 51 percent rule, a plaintiff can recover damages only if they are 50% or less at fault. If they are 51% or more responsible, they are barred from any recovery. Thus, the correct condition is that their contribution to the negligence must be less than 51% (i.e., up to and including 50%).

Answers B, C, and D contain incorrect thresholds and wording.

Line devices transmit signals from the sensor (or alarm initiating device) to a remote monitoring or control station. These can be hardwired or use wireless transmission lines. They form the backbone of alarm communication infrastructure.

Among the listed options, asphalt has the lowest reflectance. CCTV performance depends on lighting and surface reflectivity.

Snow (A) has very high reflectance, sometimes exceeding 80%.

Sandy soil (B) and red bricks (D) reflect more light than asphalt.

Asphalt, being dark and non-reflective, absorbs more light, making it harder for cameras to capture detail unless well illuminated.

During a security survey, plan drawings provide the layout of a facility, showing the position of walls, doors, windows, corridors, and other structural elements. These drawings serve as the primary reference for determining the placement and coverage of security devices such as cameras, access control points, sensors, and alarms.

Elevation drawings depict vertical surfaces and are used primarily for understanding façade or wall-mounted equipment placement.

Details drawings provide component-level specifications but do not give the full spatial context.

Riser diagrams illustrate electrical or network paths vertically through a building and help with cabling but not with overall device location planning.

Plan drawings give a comprehensive, horizontal layout view, which is essential for surveyors to accurately locate and document all security devices in relation to the facility’s operational spaces, consistent with ASIS PSP guidance.

The value of an asset to an organization is most appropriately characterized by its replacement value, which represents the cost required to replace or restore the asset if it is lost, damaged, or compromised. In Human Resource and organizational management contexts, understanding asset value is essential for prioritizing protection measures, budgeting, and risk management planning. Replacement value provides a practical and measurable basis for decision-making, especially when allocating resources for security, insurance, and contingency planning. While surveys or industry publications may provide general insights, they do not reflect the specific operational importance of an asset within a particular organization. Cumulative value is not a standard method used in risk assessment. Therefore, option B is correct because replacement value offers a clear, objective, and widely accepted way to determine an asset’s importance.

Modern terrorism, unlike historical or localized violence, leverages advanced technologies and global networks. It necessitates comprehensive national strategies involving political decision-making, resource allocation, intelligence, law enforcement, and industry collaboration to combat the sophisticated threats posed.

Internet Protocol (IP) typically transmits data in packets that have a maximum transmission unit (MTU) of approximately 1,500 bytes (or characters) for standard Ethernet networks. This size ensures compatibility and minimizes fragmentation across various network types.

Options A, B, and D are not consistent with the standardized MTU for IP packets.

In risk assessment and security management, predictability refers to how likely it is that a person, group, or threat source will act in a certain way based on known patterns, intentions, or circumstances. This makes predictability mainly an indicator of behavior. In Human Resource and organizational risk contexts, behavior is an important factor because employee actions, workplace conduct, and responses to policies can often be anticipated from past patterns, attitudes, or warning signs. Understanding predictability helps organizations assess the likelihood of insider threats, misconduct, noncompliance, or other security-related actions. It is not primarily a measure of crisis deterrence, event history alone, or how effective countermeasures are. Instead, it focuses on the expected conduct of individuals or threat sources. Therefore, option A is the most accurate answer because predictability is fundamentally linked to behavior.

Proprietary (in-house) security often provides better control over personnel, consistency in training, greater loyalty, and better integration with the corporate culture. This can enhance overall performance and organizational prestige.

B, C, and D list some advantages but miss the full combination that best defines proprietary staffing benefits.

An organization should not choose a contract security provider based only on the lowest bid because low pricing often leads to reduced wages, fewer benefits, and limited training for security officers. In Human Resource management, compensation and employee support are directly connected to service quality, motivation, retention, and job performance. When wages are cut to win a bid, security firms may struggle to attract qualified personnel or keep experienced officers, which can weaken professionalism and reliability. Poor pay may also increase absenteeism, dissatisfaction, and turnover, all of which negatively affect security operations. The main concern is not simply contract length or administrative cost, but the decline in officer quality caused by underpricing. Therefore, option C is the correct answer because it best explains why relying only on the lowest bid can damage service effectiveness.

Proprietary security services are those in which the security personnel are hired, trained, and managed directly by the organization they protect. They are part of the company’s staff and are not outsourced from external firms. Proprietary security typically ensures tighter integration with company culture and policies and offers better control over personnel and procedures.

Contract security services (Answer D) involve third-party firms providing personnel who are not employees of the protected organization.

Security enforcement (Answer B) is a general term, not a specific classification.

Pilferage (Answer C) refers to theft and is unrelated to service type.

Usenet is a global distributed discussion system that predates modern forums and social media. It operates through a network of servers and allows users to post and read messages (articles) in organized newsgroups. It ' s one of the oldest forms of online community interaction.

Telnet (B) is a protocol for remote login.

Widespread net (C) and Web net (D) are not recognized technical terms.

When designing safety and security countermeasures for an existing (especially aging) facility, the first priority for a Physical Security Professional is to assess the current state of physical security. This includes evaluating doors, locks, windows, barriers, structural access points, and environmental design features.

Understanding what currently exists sets the foundation for integrating other systems like fire detection, access control, and intrusion detection.

Fire detection (A) is critical for life safety but not the first step in physical security design.

Access control (B) and intruder detection (D) are components of the overall physical security system and come after baseline evaluation.

Alarm monitoring systems are categorized into central station systems, local systems, proprietary systems, and auxiliary systems. Each system involves different methods of signal transmission and monitoring, including third-party monitoring centers or direct links to authorities.

Continuity planning involves developing strategies and procedures to ensure that critical infrastructure, processes, and systems continue to function or are restored promptly after a disruption. It includes emergency response, crisis management, recovery, and resumption phases.

Contingent planning (A) is not a standard term.

Resource planning (C) focuses on allocation of resources, not continuity.

Resumption planning (D) is a subset of continuity planning.

Span of control refers to the number of subordinates or direct reports that a manager or supervisor can effectively oversee. A narrower span (fewer direct reports) typically allows for closer supervision, while a wider span may require more autonomy among subordinates.

In security management, span of control helps determine appropriate team structures and resource allocation, especially in large-scale operations.

Under the 50/50 rule (also known as the " modified comparative negligence " rule), the plaintiff may recover damages only if they are 50% or less at fault. If the plaintiff ' s fault is more than 50%, they cannot recover any damages. Therefore, a person responsible for more than 50% of the negligence would be barred from recovery.

Comprehensive Detailed Explanation:

Microwave sensors, which work by emitting electromagnetic waves and detecting changes in the reflected signal, are most effective when a target moves laterally (side-to-side) across the detection zone. This movement creates the greatest frequency shift (Doppler effect), making it easier for the sensor to detect motion.

Movement directly toward or away (C) causes minimal frequency change and can go undetected.

Speed (B or D) matters, but direction relative to the sensor is the key factor for detection efficiency.

Comprehensive Detailed Explanation:

In-house or proprietary security operations are those where the security team is employed and managed internally by the company. This contrasts with contract security operations (Answer A), where a third-party company provides and manages the personnel. Proprietary systems offer more direct oversight and integration into the company’s operational protocols.

Staffing operations (Answer C) is a general HR term.

Control operations (Answer D) refers to operational functions but not specifically security staffing.

Integrity is a deeply ingrained sense of right and wrong that develops during an individual ' s formative years. It drives ethical behavior and respect for rules, even when no one is watching. In physical security and personnel management, individuals with high integrity are more likely to be trustworthy and less likely to engage in dishonest actions, even under pressure.

Line supervision is a critical security feature used to monitor the integrity of wiring between sensors and the alarm processor. When multiple interior sensors are connected, supervision must exist between the processor and each individual detection sensor to ensure that any tampering, disconnection, or fault is immediately identified. This approach enhances reliability and accountability within the system. In Human Resource and organizational security management, reliable detection systems are essential for protecting employees, assets, and facilities. If supervision were only applied to groups or loops, a failure at one sensor might go unnoticed, creating a security gap. Individual supervision ensures precise fault identification and faster response, supporting effective incident management and maintaining workplace safety. Therefore, option B is correct because it ensures maximum system integrity and performance.

A guiding principle of business continuity planning is flexibility. While the plan provides structure and direction, every crisis is unique and may require adjustments. A rigid plan may fail if it doesn ' t account for variables in real-time conditions, making adaptability a critical success factor.

A (remote site capability) may be included, but it is not a universal requirement.

C is unrealistic—it ' s not feasible to have complete instructions for every possible scenario.

D (outline format) is too minimalistic and reactive rather than proactive.

Organizational levels of terrorism are generally classified into:

Individual Terrorism (Lone-wolf actors)

Group Terrorism (Non-state groups like al-Qaeda, ISIS)

State Terrorism (When a state uses terror tactics on its own or others ' populations)

Modern terrorism refers more to the contemporary methods, tools, and global nature of terrorism—not a level of organization. Hence, it ' s not considered an " organizational level. "

In developing a maintenance plan, priority should be given to components whose failure would significantly affect the system’s performance or create a major security gap. This is a risk-based approach, ensuring that critical equipment is maintained for maximum system reliability and protection.

A and C are valid considerations but not as crucial as impact.

D addresses maintenance requirements but not prioritization.

From a management perspective, organizing a security operation involves multiple interconnected activities:

Planning and goal setting (A) to define the scope and objectives.

Establishing controls (B) such as policies, standard operating procedures, and compliance mechanisms.

Hiring personnel (C) with appropriate qualifications and placing them in roles suited to their capabilities.

All these components work together to structure and guide the security effort effectively.

Risk acceptance is the mitigation option that has no direct cost because the organization chooses to acknowledge the risk without taking additional action to reduce, transfer, or eliminate it. In Human Resource and organizational management, this approach is typically used when the cost of mitigation exceeds the potential impact of the risk or when the risk level is considered minimal. While there may still be indirect consequences if the risk materializes, no immediate financial investment is required to manage it. In contrast, risk avoidance may involve changing operations, risk limitation requires implementing controls and safeguards, and risk transference often includes costs such as insurance or outsourcing. Therefore, option B is correct because risk acceptance does not require upfront expenditure, making it the only option with no direct cost.

Auxiliary systems are fire alarm systems that are connected directly to a municipal fire alarm system, such as those operated by a local fire department. These systems provide immediate notification to the authorities in the event of an alarm activation and are commonly found in buildings located within cities with centralized emergency response networks.

Warning system (A), Main system (C), and Alert system (D) are not formal classifications of municipal-linked fire alarm systems.

A change key is designed to operate a single specific lock within a keyed system and is typically assigned to an individual user for limited access. In key control systems, which are important in organizational and Human Resource security management, different key types are used to control access levels. A change key provides the lowest level of access, ensuring that employees can only enter authorized areas relevant to their roles. This supports accountability, reduces security risks, and helps enforce workplace policies. Options A and C describe functions of master or grand master keys, which open multiple locks. Option D refers to control or core keys used for lock maintenance. Proper use of change keys helps organizations maintain structured access control and protect assets, personnel, and sensitive areas effectively.

The correct answer is D. annually.

In the ASIS PSP Body of Knowledge, lighting is specifically included as an environmental factor that impacts physical security assessment and as a structural security countermeasure. PSP also covers inspection techniques, maintenance of systems and hardware, and ongoing evaluation throughout the security system life cycle.

Exterior security lighting must be evaluated after installation to confirm that the lighting levels, coverage, shadows, glare, blind spots, and protected areas meet the intended security objective. After the initial installation survey, the lighting system should be reviewed annually to ensure it still provides effective illumination and has not been affected by lamp deterioration, damaged fixtures, vegetation growth, changed site conditions, or maintenance issues.

Security lighting guidance also supports an annual security lighting survey, especially when lighting is part of the facility’s protective security program. APTA’s security lighting recommended practice states that a security lighting survey should be performed on an annual basis or when the built environment changes.

Weekly or monthly checks may be useful for routine maintenance, damaged lamps, or outages, but the formal lighting survey after installation is normally conducted annually.

Therefore, the best answer is D. annually.

Computed Tomography CT is the correct answer because it uses a rotating X-ray source to capture multiple images of an object from different angles, creating a detailed three-dimensional view. This technology uniquely calculates a material’s mass, density, and mass absorption coefficient, making it highly effective for detecting explosives and other threats. In organizational and Human Resource related security management, advanced screening technologies like CT scanners are essential for ensuring workplace safety, especially in high-risk environments such as airports, government facilities, and corporate offices. These systems support security personnel by providing accurate threat identification, reducing human error, and improving decision-making. Other technologies like standard X-ray or backscatter systems do not provide the same level of detailed material analysis. Therefore, option B is correct because CT offers the most comprehensive detection capability.

Electronic eavesdropping involves the unauthorized interception or monitoring of digital data and communications, including tapping into communication lines. This can involve accessing private messages, data streams, or other electronic communications as they travel across networks.

War driving (B) refers to searching for unsecured Wi-Fi networks, not line tapping.

Digital beating (C) and Standard digitizing (D) are not recognized cybersecurity terms.

JPEG, MPEG, Wavelet, and H-263 are all video compression standards or techniques used to reduce the size of digital video files while maintaining acceptable quality. Compression is essential in organizational environments because it allows efficient storage, faster transmission, and easier management of video data, especially in security systems such as surveillance and monitoring. From a Human Resource and operational management perspective, efficient video compression supports better use of technological resources, reduces storage costs, and ensures that security personnel can quickly access and review footage when needed. These formats do not represent storage devices, transmission methods alone, or signal types; instead, they define how video data is encoded and compressed. Therefore, option B is correct because all listed technologies are forms of video compression.

In major construction projects, the security consultant holds the primary responsibility for producing and maintaining the documentation for the final security system design.

The security consultant integrates the client’s requirements, risk assessments, and compliance standards into a coherent design package.

While security vendors and system engineers implement and configure components, and architects manage building design, the security consultant ensures the overall security strategy, technical specifications, and integration documentation are properly detailed for construction, procurement, and operational handover.

This includes schematics, system diagrams, installation guidelines, and operational procedures, ensuring that the system aligns with both security objectives and project standards.

This approach aligns with PSP guidance, emphasizing that oversight and documentation of integrated security systems require professional expertise in security planning, not solely technical or architectural roles.

Security is increasingly recognized as a critical management function in global business operations. From protecting physical assets to ensuring the safety of personnel and intellectual property, security plays a vital role in risk mitigation and continuity planning. It integrates with other business areas such as compliance, human resources, and information technology.

Controlled areas are secure zones that restrict access to authorized personnel and vehicles only. These areas may include military zones, secure corporate facilities, or sensitive operational spaces where access control is enforced through badges, guards, surveillance, or barriers.

Terminal operations (A) refers to logistical or transportation hubs.

Surveillance (B) is a monitoring method, not a restricted area itself.

Total programs (C) is not a recognized security term.

The most effective approach to risk management emphasizes proactive measures taken before a loss occurs. Implementing an efficient before-the-loss arrangement involves:

Identifying potential threats and vulnerabilities

Prioritizing assets and exposures

Designing protective measures and contingency plans

Allocating resources to minimize potential operational, financial, and safety impacts

Reactive measures, such as arranging after-the-loss recovery or focusing exclusively on loss-prevention techniques, do not comprehensively address risk and may leave organizations exposed. Calculated-risk theory provides a framework for decision-making but must be applied within a before-the-loss strategy to optimize mitigation and resource allocation.

This aligns with ASIS PSP guidance, which underscores the importance of anticipating risks and implementing protective measures in advance rather than relying primarily on post-loss actions.

The three types of comparative negligence statutes include:

Pure approach (A): The plaintiff’s compensation is reduced by their percentage of fault, no matter how high.

50/50 rule (B): The plaintiff can recover damages only if their fault is 50% or less.

51 percent rule (C): The plaintiff can recover only if they are less than 51% at fault.

All three are valid comparative negligence models used in different jurisdictions.

A Business Impact Analysis is the correct process because it evaluates how disruptive events can affect critical operations, resources, and organizational continuity. While a risk assessment identifies threats, vulnerabilities, and likelihood, a Business Impact Analysis goes further by examining the operational consequences if a disruption actually occurs. In Human Resource and organizational management, this is important because security incidents can affect employee safety, staffing, communication, payroll, access control, and essential workplace functions. The analysis helps management prioritize critical services, allocate resources, and prepare recovery strategies to reduce downtime and organizational loss. The other options do not serve the same forward-looking planning purpose. Therefore, option D is correct because a Business Impact Analysis complements risk assessment by focusing on the real business and workforce impact of potentially disruptive events.

Smoldering burning is the final phase of a fire where visible flames are no longer present, but extreme heat persists. This occurs when the available fuel is nearly consumed, or oxygen is limited, creating a high-temperature environment without active flames. It poses a serious re-ignition risk.

Ignition stage (B) is the beginning of the fire.

Last stage (C) is too vague.

Incipient stage (D) refers to the early development before flames appear.

Metal halide lamps provide excellent color rendering that closely resembles natural daylight, making them ideal for enhancing image quality in CCTV systems. However, they are also more expensive to install and maintain compared to other types such as high-pressure sodium or mercury vapor.

A (Mercury vapor) and D (Low-pressure sodium) offer poor color rendering.

B (High-pressure sodium) is efficient but has a yellow hue that distorts colors.

The actions described represent risk reduction because the organization is implementing measures to decrease the likelihood and impact of theft rather than eliminating the activity entirely. Moving the coat department, installing surveillance systems, using anti-theft tags, and limiting access to merchandise are all strategies that reduce vulnerability and deter potential offenders. In Human Resource and organizational management, risk reduction is a common approach that balances operational needs with security controls, allowing business activities to continue while minimizing threats. Risk avoidance would involve eliminating the activity altogether, such as no longer selling coats, while risk transfer would involve shifting responsibility, such as through insurance. Risk acceptance would mean taking no action. Therefore, option B is correct because the organization is actively reducing exposure to theft through multiple preventive measures.

Telnet is a network protocol that allows users to connect to remote computers and access their resources, typically via command-line interface, assuming they have proper credentials. While outdated for secure applications (due to lack of encryption), it was widely used for remote access to systems.

Cabinet (A) and Telecom (C) are unrelated.

“None of the above” (D) is incorrect because Telnet is the correct protocol.

Professional development combines education, training, experience, and personal commitment to improve an employee’s knowledge, skills, and overall effectiveness. In Human Resource management, these elements are essential for strengthening competencies that employees already possess while also helping them adapt to new responsibilities and changing workplace demands. The main purpose of professional development is not to guarantee higher salaries, push employees toward graduate study, or encourage them to leave their jobs. Instead, it focuses on enhancing performance, building confidence, and increasing long-term value to the organization. Through continuous learning and applied experience, personnel become more capable, productive, and prepared for advancement. Therefore, option A is correct because professional development primarily sharpens and enhances existing competencies, which is one of the central goals of HR training and career development programs.

Conversion is a civil tort that occurs when one party wrongfully possesses or interferes with another’s personal property (chattel) to the extent that the owner ' s use or rights are seriously restricted or denied. It’s essentially a civil version of theft.

Restriction (A), Transfer (B), and Constraint (C) are not legally specific terms for this tort.

PIR (Passive Infrared) detectors are most effective when motion occurs across the sensor’s field of view. This maximizes the differential detection of body heat moving against the ambient background.

B and C (Movement toward/away) produce weaker thermal contrasts.

A (Defeat attempts) is a risk but not a mounting consideration.

One of the key indicators of effective management is the ability to delegate responsibilities. Delegation allows managers to focus on strategic oversight rather than becoming bogged down in tasks that can be handled at lower levels. This empowers staff, improves efficiency, and enhances organizational agility.

Managers who fail to delegate often become bottlenecks, negatively impacting team performance.

Nuisance alarms, particularly from doors, are often caused by mechanical failures such as worn hinges, faulty magnetic switches, or misaligned contacts. Regular inspections and maintenance are the most effective way to reduce false alarms.

Signage (A) helps inform but doesn’t fix the mechanical issue.

Patrols (C) are reactive, not preventative.

Janitorial scheduling (D) can reduce traffic but doesn’t address faulty hardware.

Comprehensive Detailed Explanation:

A security system acceptance test verifies that the system has been installed according to the design and is operating properly. This includes ensuring cameras are correctly aimed, focused, and provide the intended coverage and image quality. This practical verification is critical for performance validation.

B and C may be part of training or specific functionality checks but are not core acceptance test items.

D refers to reliability testing, which is separate from initial acceptance.

Risk assessment is a foundational step within the risk management process—not an alternative to managing risk. Alternatives to optimize risk management include:

Risk avoidance: eliminating the activity causing the risk

Risk transfer: shifting the risk to another party (e.g., through insurance)

Risk spreading: distributing the risk to reduce overall impact

Risk assessment, in contrast, is the evaluation of threats and vulnerabilities and precedes these treatment decisions.

References from PSP: Risk Treatment Options – ASIS POA; PSP Study Guide – Risk Management and Analysis

Remote access control using CCTV requires two-way communication to authenticate identity, provide instructions, and ensure that individuals requesting entry can be properly engaged. This supports access decisions made by personnel monitoring remotely.

A and D (monitoring and visual analysis) are important but secondary to communication.

C (constant camera display) is inefficient and not a requirement if smart alerting or switching is used.

An Invitation for Bid (IFB) is a procurement method used when requirements are clearly defined and price is the main selection criterion. It typically requires bidders to submit pricing in a specific format so that proposals can be directly compared.

A, B, and C relate more to Requests for Proposals (RFPs), where qualitative evaluation (e.g., technical capability) plays a bigger role.

The relationship between public law enforcement and private security has historically faced strain due to several key issues:

Perceived competition (A): Concerns over overlapping roles and professional rivalry.

Borderline responsibilities (B): Unclear jurisdiction or operational boundaries can lead to friction.

Moonlighting policies (C): Concerns about law enforcement officers working off-duty in private roles may create conflicts of interest.

All of these issues contribute to the strained relationship.

A Business Impact Analysis (BIA) identifies critical functions and assesses the financial and operational impact of business disruptions. It helps prioritize recovery efforts and supports continuity planning by quantifying potential losses.

Enterprise impact analysis (A) and Managerial impact analysis (B) are not formal terms.

Critical process impact (C) is a component considered in the BIA but not the term itself.

Fidelity bonds specifically cover losses resulting from dishonest acts committed by employees, such as theft, fraud, or embezzlement. These are commonly used in financial institutions and other sectors where employees handle cash or sensitive assets.

Comprehensive Detailed Explanation:

A project is defined as a temporary endeavor undertaken to create a unique product, service, or result. In security, examples include designing and installing a new access control system or conducting a vulnerability assessment.

A (Scope of work) outlines what a project includes.

B (Work breakdown structure) is a tool used in managing a project.

D (System) refers to a set of components working together, not the temporary process to build it.

Comprehensive Detailed Explanation:

One of the key principles of good security reporting is objectivity, not subjectivity. Reports should be clear, concise, timely, and objective to ensure factual, actionable information. Subjectivity introduces bias and undermines the reliability of reports.

A (Clarity), B (Timeliness), and D (Conciseness) are all core principles of effective reporting.

Recovery of critical processes depends heavily on identifying and assessing the resources needed—such as personnel, facilities, IT systems, and communication tools. Without a proper resource assessment, recovery plans may fail to address key operational dependencies.

Comprehensive Detailed Explanation:

Specifications are considered the cornerstone of any construction project because they define the materials, workmanship, quality standards, and installation requirements. They ensure consistency, compliance with design intent, and are the foundation upon which contractors bid and work.

A (Drawings) show layout but don’t specify materials or quality.

B (Guidelines) are general and not enforceable.

C (Procedures) guide execution but are not foundational to the build.

An Invitation to Bid (ITB) is typically used when the buyer has clearly defined requirements and a good understanding of the market offerings. It focuses on obtaining competitive pricing for known solutions and is suitable for well-specified projects where minimal deviation is expected.

B (Request for proposals) is used when buyer needs input on how to meet requirements.

C (Sole source) limits competition and is only used under specific conditions.

D (Request for quote) is generally used for lower-cost, commodity items.

A deadbolt lock must have sufficient bolt projection, known as the throw, to resist forced entry techniques such as jamb spreading. The recommended minimum throw is 1 inch because it ensures that the bolt extends deeply into the door frame, increasing resistance against prying or forced separation of the door and frame. In organizational and Human Resource security management, proper physical security measures are essential for protecting employees, assets, and sensitive areas. Installing locks with inadequate throw length may create vulnerabilities that can be exploited easily. While shorter throws may offer basic locking, they do not provide the level of resistance required for secure environments. Therefore, selecting a deadbolt with at least a 1-inch throw supports stronger access control and contributes to overall workplace safety and risk reduction.

Comprehensive Detailed Explanation:

Pandemics primarily impact human health and workforce availability rather than directly damaging physical infrastructure. The effects on infrastructure are typically secondary, such as reduced staffing at utilities or service providers, rather than structural destruction (as in natural disasters).

Infrastructure remains physically intact, but operations may be disrupted due to workforce shortages.

Comprehensive Detailed Explanation:

A dead latch prevents the latch from being depressed when the door is closed. However, if the latch is too short, it may not extend far enough into the door frame to withstand forced entry attempts, such as prying between the door and frame. This can allow an intruder to manipulate or bypass the lock.

A, C, and D refer to components that don’t typically relate to the dead latch’s primary vulnerability.

A methodical examination in security management serves multiple purposes:

Identifying deviations from policies and procedures

Detecting vulnerabilities or loopholes

Improving operational effectiveness while maintaining or enhancing security

This approach is used in audits, inspections, and evaluations to enhance overall security posture without compromising performance.

References from PSP: ASIS POA – Security Audits and Evaluations; PSP Guide – Program Effectiveness and Risk Review

Holography on ID badges provides a unique, hard-to-replicate visual feature that significantly reduces the chances of badge counterfeiting. Holograms are difficult to duplicate with standard printing technologies, thus enhancing the integrity of badge-based access control systems.

Theft (A) and Intrusion (C) are indirect risks that holography helps mitigate by reducing counterfeiting.

Security (D) is a broad concept rather than a specific risk being addressed.

System integration combines technology, procedures, and people—i.e., personnel—to create a cohesive and effective security solution. Personnel are essential for operating, monitoring, and responding to events within the system.

A (Safety) and D (Management) are broader organizational functions.

B (Equipment) is a part of the technology component, already implied.

Natural surveillance is a CPTED principle that enhances visibility in public or semi-public spaces to deter crime. Positioning kitchen windows to overlook a playground increases the likelihood of observation, reducing the opportunity for illicit behavior and enhancing safety.

A (Defensible space) is a broader concept that includes natural surveillance.

B (Territoriality) focuses on expressing ownership of space.

C (Overwatch) is a military/security term not directly used in CPTED.

Post orders are written instructions for security personnel detailing duties, responsibilities, and conduct at a specific post. These orders must clearly express the policies and expectations of the protected organization, ensuring alignment with security protocols and business objectives.

A (Reviewing shift log) is a task, not a policy directive.

C (Verbal instructions override written) contradicts best practice.

D (Policies of local authorities) may influence actions but do not replace enterprise policies in post orders.

An active volumetric sensor emits energy (such as sound waves or electromagnetic fields) into a defined volume and detects changes caused by movement or presence within that space. Ultrasonic sensors are a common example:

They transmit high-frequency sound waves and measure the reflections to detect objects or intruders in a monitored area.

Infrared sensors are often passive (detecting heat) or line-of-sight, rather than volumetric.

Capacitive sensors detect changes in an electric field but are typically used for proximity or tamper detection.

Vibration sensors detect mechanical disturbances rather than volumetric intrusion.

Active volumetric sensors are widely used in intrusion detection systems for rooms, corridors, or other enclosed spaces because they monitor an entire volume rather than just a single point or surface.

Bottom of Form

Floodlights are wide-beam lighting devices used to extend horizontal illumination across large areas, particularly along perimeter barriers. Their design makes them effective in lighting long stretches of fencing or property lines to deter and detect intruders. Unlike spotlights or search lights, floodlights disperse light broadly and evenly, reducing shadows and blind spots.

" Search lights " produce narrow beams for focused scanning.

" Perimeter lighting " is a general concept, not a specific lighting unit.

" Fresnel lenses " are components used in optics and are not lighting units.

Ethernet was developed in the early 1970s by Robert Metcalfe and his team at Xerox Corporation’s Palo Alto Research Center (PARC). It became the foundational technology for local area networks (LANs) and remains widely used in networking today.

IBM (B) developed other networking technologies but not Ethernet.

Microsoft (C) is a software company and did not develop Ethernet.

Physical security refers to measures taken to protect personnel, equipment, and property from threats such as theft, vandalism, and natural disasters. This includes the use of locks, barriers, surveillance systems, access controls, and emergency response planning. It is a foundational element of organizational security strategy.

The standard life cycle of a security project includes:

Feasibility – Determine whether the project should proceed.

Design – Develop system specifications and plans.

Execution – Install and implement the system.

Closeout – Finalize and evaluate project completion, transfer documentation, and training.

A, B, and D include non-standard or loosely defined stages.

The Pass-Exchange System enhances security by requiring that the employee exchanges one pass for another at a control point before entering a more secure or restricted area. This ensures that access is tightly monitored and controlled on a zone-by-zone basis.

Risk management is defined as the process of planning and implementing measures before a loss occurs to ensure that, should an adverse event happen, the business can continue operations with minimal disruption. It includes the design of preventive controls and the establishment of contingency plans to safeguard continuity after loss.

References from PSP: ASIS POA – Business Continuity and Risk Response Planning; PSP Guide – Continuity and Crisis Management Principles

Crisis management plans are primarily concerned with:

Crisis management team structure (A)

Disaster operations and coordination (B)

Media communication strategies (C)

While vital records (D) are important to business continuity planning, they are not a core function of crisis management, which focuses more on command, communication, and high-level decision-making during emergencies.

In communism, the overthrow of capitalism is based on class struggle between the proletariat and bourgeoisie. Radical Islam is not centered around class conflict but rather on religious ideology and perceived moral decay. While radical Islamists may oppose Western or Russian systems, it is not explicitly framed as a class-based struggle akin to Marxist theory.

Screening is the process of identifying the most suitable candidates for a job, factoring in both qualifications (skills and experience) and personal integrity. This may involve background checks, interviews, and reference verification to ensure candidates are reliable and trustworthy.

Vetting (C) is often used interchangeably but generally refers more narrowly to background checks.

Recruitment (B) is the broader process of attracting candidates.

Inspection (A) refers to a physical or procedural review, not personnel selection.

Private security functions are generally client-centered—focused on protecting the assets, people, and interests of a private entity or organization. In contrast, public law enforcement is tasked with serving the community at large, maintaining public order, and enforcing laws for societal benefit.

This fundamental difference in mission and orientation underpins many of the operational and strategic differences between the two sectors.

The owner’s formal acceptance of a security system—usually after site acceptance testing—is the point at which the warranty period typically begins. From this moment, the vendor or contractor is responsible for addressing defects or performance issues as stipulated in the contract.

B and C (Phase II references) are not standard project stages.

D (Site acceptance testing) occurs before acceptance and warranty activation.

Risk avoidance means eliminating a threat entirely by discontinuing the activity or removing the condition that creates the risk. For example, if transporting valuable goods through a high-risk area poses too much danger, a company might choose to stop shipments through that route altogether.

References from PSP: Risk Treatment Options – ASIS POA; PSP Study Guide – Security Strategy Planning

Legal encyclopedias are comprehensive reference works that summarize legal principles and doctrines across a wide range of topics. They often include discussions of cases where these principles apply and are used by legal professionals to understand broad areas of law before delving into specific statutes or case law.

Legal document (B) is a broad term and not specific to educational or reference materials.

Formal memorandum (C) is used for legal opinion or communication, not for general legal research.

Observability refers to how easily an adversary can detect or notice a weakness in a system, process, or environment. In risk management and security concepts often applied within Human Resource and organizational safety frameworks, observability is directly linked to the visibility of vulnerabilities. If a vulnerability is highly observable, it means that it can be easily recognized by an external or internal threat actor. This recognition increases the likelihood that the weakness may later be exploited. However, observability itself does not involve exploiting or causing the vulnerability, but rather identifying its presence. HR policies and workplace controls aim to reduce observability by implementing safeguards, training, and awareness programs to ensure that sensitive weaknesses are not easily detected by unauthorized individuals.

Scavenging refers to the process of retrieving residual data from system memory (such as RAM) or buffers. This data remains until it is overwritten or the system is powered off. Scavenging can be used by attackers to recover sensitive information such as passwords or encryption keys.

Random memory (A) is not a valid term.

Awaiting memory (C) and Search memory (D) are not industry terms.

The correct answer is C. Equipment performance testing.

In PSP physical security implementation, testing is used to verify that installed security equipment and systems actually perform according to required functional and performance objectives. The ASIS PSP Body of Knowledge includes functional requirements, performance requirements, success metrics, commissioning, and final acceptance testing as part of physical security system design and implementation.

Equipment performance testing is the specific type of testing used to determine whether equipment or a system is functional, has adequate sensitivity, and meets its design and performance objectives. This matches the wording of the question directly. Physical security testing guidance also describes security system performance testing as determining whether security equipment is functional, has adequate sensitivity, and meets design and performance objectives under operating conditions.

The other options are not the best answer:

A. Factory acceptance testing is normally conducted before delivery or installation to verify equipment at the factory or vendor stage.

B. Reliability performance testing focuses more on dependability, availability, or continued operation over time.

D. Site acceptance testing verifies the installed system at the actual site, but the wording about functionality, sensitivity, and design/performance objectives specifically describes equipment performance testing.

Therefore, the correct answer is C. Equipment performance testing.

" As-built " drawings are finalized versions of project design plans that reflect any changes or deviations made during installation or construction. They are essential for future maintenance, troubleshooting, and upgrades, and are a standard deliverable at project completion.

A (Archival) and B (Post-construction) are not formal document types.

C (Floorplan) is a general drawing, not specific to project finalization.

An Uninterruptible Power Supply (UPS) is the best solution to immediately mitigate the risk of power loss in a computer. It provides backup power instantly upon power failure, allowing safe shutdown or continued operation for a limited period.

A (Surge protector) protects against voltage spikes but doesn’t provide backup power.

C (Emergency generator) has a startup delay and is more suitable for large systems.

D (Batteries) are components of a UPS, not a standalone mitigation.

Warm sites are backup facilities that are partially equipped and can be brought online relatively quickly in the event of a disaster. They typically have necessary infrastructure (e.g., power, networking) and some hardware but are missing the primary computer systems or up-to-date data.

Hot sites (A) are fully configured and ready for immediate use.

Cold sites (C) are empty facilities with just space and basic utilities.

Frequent sites (D) is not a recognized term.

A study by BDP International found that 35 percent of shippers were accounting for additional time to comply with the Advanced Manifest System (AMS), a U.S. Department of Homeland Security requirement that came into effect in February 2003. AMS mandates that import manifest information must be submitted at least 24 hours before the cargo is loaded onto U.S.-bound vessels at foreign ports.

An intentional tort occurs when a person deliberately engages in actions that are likely to cause harm or when the person knowingly performs an act that they can reasonably foresee will result in damage. Examples include assault, battery, false imprisonment, and trespassing.

Active resister (A) and Lack of control (B) are not legal terms related to tort liability.

" International tort " is a misspelling; the correct term is " intentional tort. "

Security awareness training ensures that all employees understand security policies, recognize threats, and know how to respond appropriately. It is critical for creating a proactive security culture and ensuring that all layers of defense—including human factors—are effective.

A, B, and D refer to specific training content areas, but security awareness encompasses overall employee engagement and is critical for program success.

A performance-based specification defines what the system must achieve (e.g., detection rate, response time), without specifying how to achieve it. This allows vendors flexibility in choosing technologies that meet required outcomes.

B (Feature-based) and C (Results-based) are loosely defined or incorrect terms in procurement standards.

D (Cost-based) focuses on budget, not system performance.

The correct answer is C. Performance test.

In PSP physical security system implementation, testing is used to verify whether security equipment and systems meet required performance requirements and success metrics. The ASIS PSP Body of Knowledge includes performance requirements, success metrics, commissioning, final acceptance testing, and life-cycle evaluation as part of physical security system design and implementation.

A performance test determines measurable operating parameters of the system or equipment. For intrusion detection sensors, these parameters can include probability of detection, false alarm rate, nuisance alarm rate, sensitivity, detection coverage, and other measurable performance characteristics. Sandia’s physical security testing guidance also identifies NAR/FAR — nuisance alarm rate/false alarm rate and probability of sensing as key sensor performance metrics collected from test results.

The other options are not the best answer:

A. Safety test focuses on whether testing or equipment creates unsafe conditions.

B. Evaluation test is broader and is used to validate overall PPS effectiveness, not mainly to determine specific parameters like nuisance alarm rate.

D. Post-maintenance test is conducted after maintenance to confirm the system still works properly.

Therefore, the correct answer is C. Performance test.

A clearly defined and executed procurement contract is critical to successful implementation of a physical security construction project. It outlines scope, deliverables, timelines, cost structures, and responsibilities, ensuring all parties operate with aligned expectations and accountability.

A (RFQ) is a pricing request, not a contract.

B (BIA) informs continuity planning, not project execution.

D (Cost analysis) is useful but not foundational for execution.

In the PSP methodology, the preliminary design phase includes both threat assessments and vulnerability analyses.

Threat assessment identifies potential adversaries, hazards, and scenarios that could negatively impact the facility or operations.

Vulnerability analysis examines weaknesses in systems, processes, and physical infrastructure that could be exploited by threats.

These analyses inform the design of security measures by determining risk exposure and guiding the selection of protective layers. While operating security reviews and security systems architecture focus on implementation and operational evaluation, the preliminary design phase is where risks are systematically identified and addressed in the system concept and specifications, consistent with ASIS PSP guidance.

Mainframes are high-capacity computers known for their powerful processing speed, extensive data storage, and ability to support hundreds or thousands of simultaneous users. They are typically used by large organizations for mission-critical applications such as bulk data processing, enterprise resource planning, and transaction processing.

Workstations (A) are personal or high-performance single-user computers.

Main computers (B) is not a formal term.

Supercomputers (C) are used for highly complex calculations, not general-purpose multi-user environments.

The Chief Security Officer (CSO) is responsible for overseeing an organization’s entire security posture—including physical, personnel, and sometimes information security. A crucial part of this role is ensuring that communication channels are effective. The CSO must analyze these channels regularly to ensure that the information received is accurate, relevant, timely, concise, and actionable for security operations and decision-making.

CIO (A) focuses on IT systems.

Information Security Officer (B) handles cybersecurity but may not oversee overall physical security.

Chief Minister (C) is a governmental/political role, not organizational security.

In the context of risk management:

A hazard is a condition or factor that increases the likelihood or severity of a peril (a cause of loss).

For example, oily floors (hazard) increase the chance of slips and falls (peril).

A (possible occurrence) and B (probable occurrence) describe likelihood, not hazard.

C (difference between actual and expected losses) refers to variance, not hazard.

When issuing weapons to security personnel, policies must clearly define the conditions under which the equipment may be used. This ensures legal compliance, accountability, and safety. Proper use-of-force guidelines are critical in managing liability and operational control.

A (Public perception) is important but secondary.

B and C may be relevant to personnel qualification but not to issuance policies themselves.

The correct answer is A. Post.

In the ASIS PSP Body of Knowledge, general, post, and special orders are specifically included under the implementation of physical security measures and requirements for security personnel.

Post orders are written instructions for security officers assigned to a specific post or guard station. They explain the officer’s duties, procedures, responsibilities, emergency actions, reporting requirements, patrol expectations, access control duties, and other site-specific instructions.

The wording in the question closely matches the purpose of post orders because they:

address specific duties or subjects in clear language,

are available at the guard post or guard station,

guide officers during daily operations, and

provide the foundation for site-specific training.

The other options are not the best answer:

Special orders usually address temporary, unusual, or individual assignments.

General orders apply broadly to security personnel and are not usually limited to one guard station.

Standing orders may be continuing instructions, but the site-specific document kept at a guard station for officer duties and training is best described as post orders.

Therefore, the correct answer is A. Post.

Comprehensive Detailed Explanation:

Pre-qualifying vendors ensures that only those with the necessary experience, resources, and qualifications are invited to bid on a project. This avoids wasted effort on unqualified proposals and increases the likelihood of successful project execution.

A (Code enforcement) and D (Spec compliance) happen during later review stages.

C (Financial stability) is one part of the evaluation but not the sole goal.

Comprehensive Detailed Explanation

When multiple areas of a facility or operation undergo programmed supervision, their findings contribute to an aggregate operational audit. When these audits are viewed collectively, they provide a comprehensive view of the organization’s overall operational effectiveness and compliance. This holistic oversight is critical for enterprise-level security governance.

References from PSP: ASIS POA – Aggregated Security Review and Audit Integration; PSP Manual – Company-wide Program Evaluation

When a bomb threat targets a specific floor, safety protocols typically mandate evacuation of the identified floor and the floors immediately above and below. This accounts for the potential blast radius and structural impact, ensuring personnel safety in adjacent vulnerable areas.

A is too vague.

C and D (all floors above or below) may be excessive unless threat specifics demand it.

Balanced magnetic switches are designed to be more resistant to tampering than simple magnetic switches. They include additional magnetic elements and polarity configurations that make it difficult for an intruder to manipulate the circuit with an external magnet.

A is true for both types of switches.

B and C are incorrect technical descriptions for balanced switches.

For confined interior areas containing explosive vapors or materials, non-emitting sensors are preferred to avoid ignition risk. Passive Infrared (PIR) sensors are ideal in such environments because they detect heat signatures (infrared energy) emitted by intruders without emitting any signals or energy that could trigger an explosion.

A (Ultrasonic) and C (Capacitance) sensors emit signals.

D (Passive vibration sensors) detect vibration and are used in a different context, like surface tampering.