ASIS-PSP Sample Questions Answers

Comprehensive Detailed Explanation:

Pre-qualifying vendors ensures that only those with the necessary experience, resources, and qualifications are invited to bid on a project. This avoids wasted effort on unqualified proposals and increases the likelihood of successful project execution.

A (Code enforcement) and D (Spec compliance) happen during later review stages.

C (Financial stability) is one part of the evaluation but not the sole goal.

Conversion is a civil tort that occurs when one party wrongfully possesses or interferes with another’s personal property (chattel) to the extent that the owner ' s use or rights are seriously restricted or denied. It’s essentially a civil version of theft.

Restriction (A), Transfer (B), and Constraint (C) are not legally specific terms for this tort.

Comprehensive Detailed Explanation:

Lux is the SI unit of illuminance and is used to measure the amount of light that falls on a surface. It quantifies how much luminous flux is spread over a given area. One lux equals one lumen per square meter. It is critical in physical security when designing lighting for surveillance, perimeter control, or safety.

A is too general.

C (Luminare) refers to a complete lighting unit.

D refers to fluorescent tube operation, not illumination measurement.

The correct answer is D. On-the-job training.

In the ASIS PSP Body of Knowledge, implementation of physical security measures includes developing requirements for security personnel, including roles, responsibilities, professional development, training, certification, post orders, and special orders.

The ASIS Private Security Officer Selection and Training Guideline defines training as a method or process of instruction used to make a person fit, qualified, or proficient. It also emphasizes that security officers should demonstrate their ability through written and/or performance examinations.

On-the-job training best promotes transfer of learning because the student applies the instructor’s guidance directly in the real working environment. It connects knowledge with actual protection officer duties, procedures, patrol expectations, emergency response actions, access control practices, and site-specific post orders.

Lecture, case studies, and literature reviews can support learning, but they are less direct. Lecture mainly gives information, case studies improve judgment, and literature reviews build background knowledge. However, on-the-job training provides practical application, immediate feedback, and performance-based learning.

Therefore, the best answer is D. On-the-job training.

Focal length is the primary factor in determining the magnification and field of view in a camera lens. A longer focal length results in a narrower field of view and greater magnification of distant objects. Conversely, a shorter focal length gives a wider field of view with less magnification.

A (Image device) and B/C (Lens or image format) influence compatibility and image quality, but do not directly affect magnification.

System integration combines technology, procedures, and people—i.e., personnel—to create a cohesive and effective security solution. Personnel are essential for operating, monitoring, and responding to events within the system.

A (Safety) and D (Management) are broader organizational functions.

B (Equipment) is a part of the technology component, already implied.

The critical detection point in a Physical Protection System (PPS) occurs when the remaining distance or time an adversary must cover before reaching the target exceeds the security response time. This ensures that detection happens early enough for responders to act and intervene before the attacker reaches the asset.

B and C refer to detection and interruption probabilities, which are important metrics but not the defining threshold for the critical detection point.

D (Remaining delay time) factors into the protection layers but does not define the detection threshold.

Risk assessment is a foundational step within the risk management process—not an alternative to managing risk. Alternatives to optimize risk management include:

Risk avoidance: eliminating the activity causing the risk

Risk transfer: shifting the risk to another party (e.g., through insurance)

Risk spreading: distributing the risk to reduce overall impact

Risk assessment, in contrast, is the evaluation of threats and vulnerabilities and precedes these treatment decisions.

References from PSP: Risk Treatment Options – ASIS POA; PSP Study Guide – Risk Management and Analysis

A successful hybrid security operation integrates both proprietary and contract components effectively. For optimal performance, it should include:

An engaged corporate liaison (A) to ensure communication and alignment with internal needs,

Consistent contract management support (B) for service oversight and accountability,

Accurate quality measurements (C) to monitor effectiveness and performance.

Combining these elements ensures that both internal and contracted personnel function cohesively and according to the organization ' s goals.

Risk avoidance means eliminating a threat entirely by discontinuing the activity or removing the condition that creates the risk. For example, if transporting valuable goods through a high-risk area poses too much danger, a company might choose to stop shipments through that route altogether.

References from PSP: Risk Treatment Options – ASIS POA; PSP Study Guide – Security Strategy Planning

Comprehensive Detailed Explanation:

A cost-effective system integration design must balance the level of risk with the controls implemented to mitigate that risk. This balance ensures that resources are used efficiently while maintaining acceptable protection levels.

A, B, and C are relevant considerations, but only D represents the fundamental balance in security system design.

Pre-action sprinkler systems are designed to prevent accidental water discharge. These systems include a detection component (such as smoke or heat detectors) that must activate before the water enters the pipes. They are often used in areas where water damage would be catastrophic (e.g., data centers, museums).

Discovery system (A), Exposure (B), and Post-action system (C) are not standard terms in fire suppression.

“Post-action system” is incorrect; the correct terminology is “pre-action system.”

An alarm sensor (also called a detector or initiating device) detects specific changes such as motion, temperature, or opening/closing of entry points. It is the primary component in any detection system and initiates the alarm response.

When an organization employs contract security services, the administrative workload related to hiring, payroll, training, and scheduling shifts to the service provider. This is a significant benefit for companies looking to reduce internal administrative burdens and focus on core operations.

Proprietary (C) systems require the organization to manage all aspects of employment.

Union (A) and Security (B) are unrelated to the comparison of administrative workload between contract and proprietary services.

Integrity, in the context of information security, refers to ensuring data is accurate, consistent, and unaltered by unauthorized actions. Maintaining integrity prevents data manipulation or corruption, ensuring reliability for organizational decision-making.

Analysis (A) is the process of evaluating data.

Security (C) is a broader term encompassing integrity, confidentiality, and availability.

Availability (D) ensures access but does not guard against data tampering.

In developing a maintenance plan, priority should be given to components whose failure would significantly affect the system’s performance or create a major security gap. This is a risk-based approach, ensuring that critical equipment is maintained for maximum system reliability and protection.

A and C are valid considerations but not as crucial as impact.

D addresses maintenance requirements but not prioritization.

Ethernet uses a method called Carrier Sense Multiple Access with Collision Detection (CSMA/CD). Before transmitting data, a device listens (senses) the network to ensure it is not currently in use. If the line is clear, it transmits. If another device transmits at the same time, a collision occurs, and both devices wait a random time before retrying.

File Transfer Protocol (A) governs file exchange, not network access control.

Buses (B) refer to physical data pathways, not protocols.

Detention differs from arrest in legal terms. Merchants and security personnel may temporarily detain someone suspected of theft under " shopkeeper ' s privilege " laws. This must be done with reasonable cause, for a reasonable period, and without excessive force. Arrest involves formal legal procedures and typically requires law enforcement authority.

In risk evaluation, vulnerability refers to the state of being open or susceptible to harm, damage, or exploitation. It identifies weaknesses in systems, processes, or human behavior that can be taken advantage of by a threat. In Human Resource and organizational risk management, vulnerabilities may include lack of training, poor supervision, weak policies, or gaps in security awareness among employees. These weaknesses increase the chances that a threat can successfully cause harm. A threat represents a potential danger, likelihood measures the probability of occurrence, and criticality reflects the importance of assets or operations. However, vulnerability specifically focuses on exposure to risk. Understanding vulnerabilities allows HR and management to implement targeted controls such as training programs, policy improvements, and monitoring systems to reduce organizational risk and enhance workplace safety.

An Invitation for Bid (IFB) is a procurement method used when requirements are clearly defined and price is the main selection criterion. It typically requires bidders to submit pricing in a specific format so that proposals can be directly compared.

A, B, and C relate more to Requests for Proposals (RFPs), where qualitative evaluation (e.g., technical capability) plays a bigger role.

Case law is the result of judicial decisions and precedents established through court interpretations of existing laws, whether based on common law (historical precedents from English law) or statutory law (laws passed by legislatures). It forms part of the legal framework in many jurisdictions and evolves through court rulings.

Criminal law (A) defines offenses and penalties.

Constitution law (D) governs foundational legal principles.

Offended suit (B) is not a recognized legal term.

The first step in a risk analysis is to identify or recognize potential threats. Before assessing vulnerabilities or selecting countermeasures, a security practitioner must know what they are defending against. This forms the foundation for the rest of the risk assessment process.

A (Selecting countermeasures) is done after analyzing risks.

B (Vulnerability assessment) follows threat identification.

C (Determining costs) happens later in the risk evaluation phase.

Fail-safe locks are designed to unlock automatically when power is removed. This ensures people can exit during emergencies such as fire alarms or power outages. It is a critical safety requirement in most building codes.

A may be true for integrated systems but doesn’t define fail-safe.

B describes fail-secure, which keeps the door locked during power failure.

D (Tamper resistance) relates to durability, not fail-safe function.

A contingent event is one that may or may not occur and is typically dependent on other conditions or events. In risk and continuity planning, a contingent event is considered in scenarios such as equipment failure, natural disasters, or cyberattacks. Preparing for such events is central to contingency planning.

Critical processes (B) are the operations needing continuity.

Conditional delegation (C) refers to assigning authority under specific conditions.

Emergency response (D) is the action taken, not the uncertain event itself.

A methodical examination in security management serves multiple purposes:

Identifying deviations from policies and procedures

Detecting vulnerabilities or loopholes

Improving operational effectiveness while maintaining or enhancing security

This approach is used in audits, inspections, and evaluations to enhance overall security posture without compromising performance.

References from PSP: ASIS POA – Security Audits and Evaluations; PSP Guide – Program Effectiveness and Risk Review

Communism promotes state or collective ownership of property as a political and economic ideology. Radical Islam, while it may advocate for community-oriented economic practices (e.g., zakat, or almsgiving), does not follow the same foundational principles of property ownership as communism. The idea of " sharing property " in radical Islam is not analogous to " common property " in communism.

Security standards typically require that any opening in a perimeter (e.g., HVAC ducts, pipe chases, vents) be lockable or otherwise protected if the cross-sectional area is 96 square inches or greater. This threshold is based on a size that could permit unauthorized entry or object passage.

A, B, and D are incorrect measurements based on security industry benchmarks.

The first step in planning any new security initiative is to gain the support of upper management because organizational commitment is essential for success. In Human Resource and organizational management practices, leadership approval ensures that adequate resources, authority, and strategic alignment are available before any detailed planning begins. Without management support, efforts such as budgeting, conducting surveys, or selecting equipment may lack direction, funding, or long-term sustainability. Securing executive backing also helps in establishing policies, enforcing compliance, and promoting a culture of safety and accountability within the workplace. Once leadership support is obtained, the organization can proceed with risk assessments, budgeting, and implementation planning in a structured and effective manner.

Preventive maintenance involves proactive actions taken to ensure systems continue to operate efficiently and to prevent failures before they occur. Updating system and application software is a clear example of preventive maintenance because it improves system performance, addresses vulnerabilities, and ensures compatibility with current operational requirements. In Human Resource and organizational management contexts, preventive maintenance supports uninterrupted operations, protects organizational assets, and ensures employee safety by reducing the likelihood of system failures. In contrast, investigating problems, restoring systems, and updating documentation are reactive or corrective maintenance activities that occur after an issue has already arisen. Preventive measures like regular updates, inspections, and testing help maintain reliability and reduce downtime. Therefore, option B is correct because it reflects a proactive approach to maintaining system effectiveness.

A trapdoor (also known as a backdoor) is a hidden method used by developers or attackers to bypass normal authentication or access controls in software. However, in technical distinction, a “trapdoor” refers more to unintentional or overlooked access, while “backdoor” is often intentional. For this question, since it emphasizes “unintentional access,” trapdoor is the best fit.

Bomb (A): Refers to logic bombs—malicious code triggered by specific conditions.

Backdoor (C): Usually intentionally left in place by developers or attackers.

Trojan Horse (D): Malware disguised as legitimate software.

A hybrid staffing model uses both proprietary and contract security personnel. In this scenario:

Proprietary staff can be assigned to sensitive and top-secret projects for tighter control, loyalty, and internal vetting.

Contract staff can manage less critical areas such as visitor parking, reducing cost.

This model is both secure and cost-effective, offering flexibility and risk-based deployment.

B (Contract) is cost-effective but lacks control for sensitive tasks.

C (Proprietary) is highly secure but more expensive.

D (Total systems) is not a staffing strategy.

A performance-based specification defines what the system must achieve (e.g., detection rate, response time), without specifying how to achieve it. This allows vendors flexibility in choosing technologies that meet required outcomes.

B (Feature-based) and C (Results-based) are loosely defined or incorrect terms in procurement standards.

D (Cost-based) focuses on budget, not system performance.

Continuity planning involves developing strategies and procedures to ensure that critical infrastructure, processes, and systems continue to function or are restored promptly after a disruption. It includes emergency response, crisis management, recovery, and resumption phases.

Contingent planning (A) is not a standard term.

Resource planning (C) focuses on allocation of resources, not continuity.

Resumption planning (D) is a subset of continuity planning.

Risk transfer refers to shifting the financial burden of potential losses from an organization to a third party, typically through insurance. By paying a premium, the company secures coverage that will compensate for specific losses, thereby reducing its own financial exposure.

References from PSP: ASIS POA – Risk Management and Insurance Strategies; PSP Study Manual – Financial Risk Treatment Options

Best practices for data backup recommend redundancy and geographical separation to ensure recovery in various disaster scenarios. Ideally, four sets of backup files should be maintained:

One on-site for quick access and recovery,

Three off-site (including possibly in different physical locations or cloud storage) for protection against local disasters like fire or floods.

Arrest refers to the legal act of taking a person into custody. One of the essential legal requirements following an arrest is that the individual must be handed over to law enforcement or judicial authorities without unreasonable delay. This is to protect the constitutional rights of the detainee and avoid unlawful detention.

Detain (B) and Detention (C) refer to temporary restraint without full arrest.

Threatening loss (D) is unrelated.

Intangible assets are non-physical resources that carry value for an organization and require protection despite lacking a tangible form. Patents are a classic example because they represent proprietary technology or intellectual property, which can provide competitive advantage and legal protection.

Reputation and digital files may hold value, but in PSP asset valuation, patents are specifically recognized as legal intangible assets with quantifiable ownership rights.

Obsolete equipment is a tangible, depreciated asset and does not qualify as intangible.

Properly identifying and valuing intangible assets like patents ensures that security strategies address not only physical property but also intellectual and proprietary assets, aligning with PSP guidance on comprehensive asset protection.

Proprietary security services are those in which the security personnel are hired, trained, and managed directly by the organization they protect. They are part of the company’s staff and are not outsourced from external firms. Proprietary security typically ensures tighter integration with company culture and policies and offers better control over personnel and procedures.

Contract security services (Answer D) involve third-party firms providing personnel who are not employees of the protected organization.

Security enforcement (Answer B) is a general term, not a specific classification.

Pilferage (Answer C) refers to theft and is unrelated to service type.

Security consultants are often retained to provide strategic input on staffing needs, policy design, and technology integration. Their advice helps organizations make informed decisions regarding the deployment of personnel, the structure of policies, and the selection of physical and electronic security systems.

The three most common categories of risk in organizational security are:

Personnel: Risks to human safety and behavior.

Property: Risks to physical and digital assets.

Liability: Legal exposure due to negligence or failure to act.

This classification helps align mitigation strategies and insurance planning.

A and D incorrectly list “hazards” as a category rather than a risk source.

B omits personnel, a critical category.

For confined interior areas containing explosive vapors or materials, non-emitting sensors are preferred to avoid ignition risk. Passive Infrared (PIR) sensors are ideal in such environments because they detect heat signatures (infrared energy) emitted by intruders without emitting any signals or energy that could trigger an explosion.

A (Ultrasonic) and C (Capacitance) sensors emit signals.

D (Passive vibration sensors) detect vibration and are used in a different context, like surface tampering.

The prediction of internal crime (e.g., theft, fraud) heavily relies on historical data to identify patterns, vulnerable departments, and recurring behaviors. This data-driven approach informs proactive security strategies.

A (Background checks) are preventive, not predictive.

B and C offer useful insights but are not the primary basis for trend analysis.

Internet Protocol (IP) typically transmits data in packets that have a maximum transmission unit (MTU) of approximately 1,500 bytes (or characters) for standard Ethernet networks. This size ensures compatibility and minimizes fragmentation across various network types.

Options A, B, and D are not consistent with the standardized MTU for IP packets.

Security input is most effective when introduced during the initial design phase of a facility. This allows for integration of security considerations into architectural planning, site layout, and system infrastructure before major design decisions are finalized.

A and B are too late in the process.

D (Concept presentation) is usually too early and conceptual for detailed security input.

Gopher is a hypertext-based information retrieval tool that predates the World Wide Web. It uses a series of text-based menus to allow users to navigate and access various types of textual information hosted on servers. It was one of the first attempts at organizing and accessing online information in a user-friendly way.

Consortium (A) refers to a group or association, not a technology.

Hyper-text based tool (B) is descriptive but not the specific name of the system.

Symantec (C) is a cybersecurity software company, unrelated to menu-based text access systems.

When a contractor must perform work beyond the original scope of the contract, they submit a change-order request. This formal document details the additional work, associated costs, and justification, and requires approval from the project manager before proceeding.

A (Schedule-of-values request) is related to progress payments.

C (Scope change request) is typically initiated by the client.

D (Justification for change) might support a change-order, but it is not a formal request document.

Magnetometers, used in security screening for detecting metallic objects, typically operate using two main methods:

Continuous-wave: Emits a constant electromagnetic field to detect disruptions caused by metal.

Pulsed-field: Emits bursts of energy and analyzes the return signals to identify metal objects.

These methods allow both walk-through and handheld devices to detect ferrous and non-ferrous metals.

A, C, and D include terms not applicable to standard magnetometer operation.

Within the PSP framework and project management methodology, the design phase is where technical and cost evaluations are conducted. During this phase, the security system’s requirements are translated into detailed specifications, including system architecture, component selection, and preliminary layouts.

Technical evaluation assesses whether proposed systems, devices, or configurations meet operational and functional requirements, including performance, scalability, and compliance with standards.

Cost evaluation ensures that proposed solutions align with the organization’s budget and provides a basis for cost-benefit analysis.

These evaluations inform decision-making before procurement and installation, reducing risk of over-specification, underperformance, or budget overruns. In contrast, planning defines objectives and scope, procurement executes purchase decisions, and installation implements the system according to the design.

Post-implementation evaluation testing should be performed at least annually to assess whether the security system continues to meet operational requirements. It also ensures that performance standards are upheld, and helps identify any necessary updates or improvements.

A, B, and C are more frequent than typical industry best practice unless special conditions apply.

Assault is defined as the intentional act of creating a reasonable apprehension or fear of imminent harmful or offensive contact in another person. It does not require physical contact; the threat alone—if credible and intentional—is sufficient. This differentiates it from battery, which involves actual contact.

Stabbing (B) involves physical harm.

Battering (C) is a form of battery, which requires actual physical contact.

None of the above (D) is incorrect, as assault is the proper term.

A felony is a serious criminal offense that is punishable by death or imprisonment for more than one year. This classification contrasts with misdemeanors, which are less serious offenses typically punishable by fines or imprisonment of less than one year.

Misdemeanor (D) is a lesser offense.

Corruption (A) can be a felony but is a specific type of offense.

Misguidance (C) is not a recognized legal category.

An “innocuous virus” is not a formally recognized type of computer virus. All viruses, by definition, are considered malicious because they replicate without authorization and potentially cause harm, whether immediate or latent.

Common types of viruses include:

Humorous (B): A virus designed to prank users without causing real harm (e.g., funny messages).

Hostile (C): Actively destructive or malicious.

Altering (D): Modifies system files or behaviors.

" Innocuous virus " (A) is a misnomer, making it the correct choice as " not " a virus type.

Reserves are security personnel who are not assigned to fixed posts or patrol routes but are instead held in readiness to respond when assistance is needed. They may be used during emergencies, staffing shortages, or heightened security alerts. Their role is crucial in maintaining flexibility in a security force structure.

The primary function of an electronic security system during an attempted or successful penetration is to notify personnel so that appropriate action can be taken. While alarms, countermeasures, and system integrations are important components, they are all secondary to ensuring that responsible individuals are informed promptly. In Human Resource and organizational security management, timely notification enables trained personnel to respond effectively, follow established procedures, and minimize potential damage or risk. Without proper notification, alarms alone may not lead to action, and automated responses may not address the situation appropriately. Effective communication and response coordination are critical aspects of workplace safety and incident management. Therefore, notifying personnel is the most essential function, making option B the correct answer.

ern trends in the private security industry focus on:

Regulating training and licensing standards (Answer A),

Attracting better-qualified individuals to raise professionalism (Answer B).

Disarming security personnel (Answer C) is generally not a trend. In fact, depending on threat levels and environments, armed security may be increased rather than reduced.

A pre-bid conference allows all prospective bidders to gain a clear and consistent understanding of the project requirements, including walkthroughs of affected facilities. This helps ensure uniformity in bid proposals and reduces ambiguity or scope misinterpretation.

A (Engineering evaluation) is internal and technical.

C (Invitation for bid) is a document, not an event.

D (Procurement meeting) is not a standard pre-bid process phase.

Comprehensive Detailed Explanation:

Nuisance alarm rate is a measure of system reliability and is calculated by tracking the number of false or unwanted alarms over a specified time. This metric is crucial for tuning sensor performance and reducing unnecessary responses.

A, B, and C provide insights but are not standard methods of calculating nuisance alarm rate.

A bidder instruction document typically requests verification of a contractor ' s relevant experience and professional licenses. This ensures the vendor is qualified and legally authorized to perform the work.

A, C, and D include valid components but do not reflect the standard combination used for qualification.

Under the 50/50 rule (also known as the " modified comparative negligence " rule), the plaintiff may recover damages only if they are 50% or less at fault. If the plaintiff ' s fault is more than 50%, they cannot recover any damages. Therefore, a person responsible for more than 50% of the negligence would be barred from recovery.

When selecting countermeasures, the most important factor is the overall risk posed to the asset or operation. This includes both the likelihood of a threat and the potential impact. Cost, criticality, and probability are components of the risk equation but are not stand-alone decision criteria.

A (Cost) is important for feasibility but follows risk evaluation.

B (Probability) and C (Criticality) contribute to risk but don’t outweigh it individually.

Physical barriers are designed to defend against three main penetration techniques:

Stealth: Unauthorized entry without detection.

Deception: Gaining access through trickery or impersonation.

Force: Physical breaching of barriers or using tools or vehicles to gain entry.

Security systems are designed to detect and delay each of these methods effectively.

A and B mix categories inaccurately.

C (Vehicle) is a tool/method of force, not a category on its own.

Controlled areas are secure zones that restrict access to authorized personnel and vehicles only. These areas may include military zones, secure corporate facilities, or sensitive operational spaces where access control is enforced through badges, guards, surveillance, or barriers.

Terminal operations (A) refers to logistical or transportation hubs.

Surveillance (B) is a monitoring method, not a restricted area itself.

Total programs (C) is not a recognized security term.

Conspiracy in the context of theft or fraud refers to two or more individuals collaborating—often using confusion or chaos in the environment—to execute or conceal a theft. This is especially common in employee-customer collusion or multi-person theft scenarios.

Accountability (B) reduces confusion.

Invoicing (C) is a documentation process.

Proliferation (D) means rapid increase, not relevant here.

The four common types of physical lock-down systems for protecting hardware, especially in IT environments, include:

Cages: Enclosures for servers or critical equipment.

Plates: Lock-down plates secured to desks or floors.

Cables: Security cables to tether devices.

Alarms: Motion or tamper-detection systems.

These measures are used to deter theft and unauthorized physical access.

Class K fires involve cooking oils, grease, and fats typically found in commercial kitchens. These fires require specific extinguishers that saponify the oil, cooling and smothering the flames. Class K extinguishers often contain wet chemical agents.

Class C (A) involves energized electrical equipment.

Class D (B) involves combustible metals.

Class L (D) is not a recognized fire class.

Comprehensive Detailed Explanation:

One of the key principles of good security reporting is objectivity, not subjectivity. Reports should be clear, concise, timely, and objective to ensure factual, actionable information. Subjectivity introduces bias and undermines the reliability of reports.

A (Clarity), B (Timeliness), and D (Conciseness) are all core principles of effective reporting.

Infrared sensors can function as both passive and active types:

Passive Infrared (PIR): Detects natural heat (infrared radiation) from people or animals.

Active Infrared: Emits infrared beams and detects interruptions in the beam (e.g., photoelectric sensors).

This dual use allows infrared to serve a variety of security applications.

A (Microwave) is strictly active.

C (Vibration) and D (Pressure) are passive only.

Comprehensive Detailed Explanation:

Specifications are considered the cornerstone of any construction project because they define the materials, workmanship, quality standards, and installation requirements. They ensure consistency, compliance with design intent, and are the foundation upon which contractors bid and work.

A (Drawings) show layout but don’t specify materials or quality.

B (Guidelines) are general and not enforceable.

C (Procedures) guide execution but are not foundational to the build.

An Uninterruptible Power Supply (UPS) is the best solution to immediately mitigate the risk of power loss in a computer. It provides backup power instantly upon power failure, allowing safe shutdown or continued operation for a limited period.

A (Surge protector) protects against voltage spikes but doesn’t provide backup power.

C (Emergency generator) has a startup delay and is more suitable for large systems.

D (Batteries) are components of a UPS, not a standalone mitigation.

In selecting video surveillance cameras, the primary criterion is the ability to clearly identify objects or individuals within the monitored area, which is directly determined by the horizontal resolution.

Horizontal resolution represents the number of distinct points of information captured across the width of the scene and dictates the level of detail available for identification.

Pixel count or chip output alone does not guarantee usable image quality; it must be supported by optics and scene coverage.

Sensitivity affects performance in low-light conditions but is secondary when the main goal is resolution-based identification.

Focal length adjusts the field of view but does not replace the need for sufficient horizontal resolution to meet identification objectives.

ASIS PSP guidance stresses that camera selection should align with the operational purpose, ensuring captured video meets evidentiary and situational awareness requirements while optimizing system design and cost efficiency.

A change key is designed to operate a single specific lock within a keyed system and is typically assigned to an individual user for limited access. In key control systems, which are important in organizational and Human Resource security management, different key types are used to control access levels. A change key provides the lowest level of access, ensuring that employees can only enter authorized areas relevant to their roles. This supports accountability, reduces security risks, and helps enforce workplace policies. Options A and C describe functions of master or grand master keys, which open multiple locks. Option D refers to control or core keys used for lock maintenance. Proper use of change keys helps organizations maintain structured access control and protect assets, personnel, and sensitive areas effectively.

Proprietary security officers are employed directly by the organization they protect, which often leads to:

Higher loyalty to the organization (B),

Stronger identification with company values,

Higher prestige and potential quality of personnel (A, D).

However, this close affiliation can reduce impartiality, especially in situations involving internal investigations or enforcement actions against coworkers or executives.

Modern terrorism, unlike historical or localized violence, leverages advanced technologies and global networks. It necessitates comprehensive national strategies involving political decision-making, resource allocation, intelligence, law enforcement, and industry collaboration to combat the sophisticated threats posed.

Comprehensive Detailed Explanation:

The " Theft Triangle " is a concept used in physical security and loss prevention to illustrate the three primary elements that must exist for theft to occur: motive, desire, and opportunity.

Motive: The reason someone considers committing theft (e.g., financial hardship).

Desire: The internal emotional or psychological urge to obtain something.

Opportunity: The circumstances or vulnerabilities that allow the act to occur.

All three must typically be present for theft to happen. This model is used in behavioral risk assessments and insider threat prevention strategies.

Crisis management plans are primarily concerned with:

Crisis management team structure (A)

Disaster operations and coordination (B)

Media communication strategies (C)

While vital records (D) are important to business continuity planning, they are not a core function of crisis management, which focuses more on command, communication, and high-level decision-making during emergencies.

Exterior lighting systems should be formally evaluated at installation and then at least annually to ensure proper function, coverage, and maintenance. Routine checks may occur more frequently, but full surveys are typically annual unless conditions dictate otherwise.

A, B, and C may be appropriate for operational checks, but not full surveys.

In the context of physical security, predictability typically refers to human behavior patterns that adversaries could exploit. For example, predictable patrol schedules or access procedures can be observed and defeated. Reducing predictability enhances security by complicating an attacker’s planning process.

A (Accuracy) and B (Effectiveness) relate to system performance.

D (Efficiency) relates to resource use, not vulnerability.

A comprehensive contingency planning program consists of:

Emergency Response: Immediate actions during a crisis to protect life and property.

Crisis Management: Command structure and coordination during an event.

Business Continuity: Efforts to maintain or quickly restore essential functions.

Together, these components form a resilient framework for organizational preparedness.

Private security refers to individuals or organizations that offer security-related services for compensation. This includes both self-employed individuals (such as independent security consultants or contractors) and funded business entities (such as security companies or firms) that provide services to private clients for a fee. These services may include guarding, patrolling, risk assessments, investigations, alarm monitoring, or other protective activities.

A security system’s power supply must be sized with headroom to accommodate additional devices, future expansion, and potential peak loads. ASIS PSP guidance recommends that the system load should not exceed 60% of the total power capacity.

Loading above this threshold can reduce system reliability, limit the ability to add new devices, and stress power components, potentially shortening equipment lifespan.

Maintaining a margin ensures that batteries and power supplies can support the system under normal and emergency conditions, including temporary peak loads.

This practice aligns with standard design principles for redundancy, scalability, and safe operation of integrated security systems.

The primary objective of a CCTV system is deterrence—by making individuals aware they are being monitored, it discourages unauthorized or criminal behavior. While recording for evidence and employee monitoring are benefits, they are secondary.

A (Reducing guard costs) may be a benefit but is not the main objective.

C (Evidence collection) supports post-incident action but doesn’t directly deter behavior.

D (Watching employees) is an application, not the core goal.

Asset value in risk management is determined by considering criticality, ease of replacement, and some measure of value. Criticality refers to how important the asset is to organizational operations, including its impact on productivity, safety, and continuity. Ease of replacement evaluates how quickly and easily the asset can be restored or substituted if lost. The measure of value includes financial worth as well as operational or strategic importance. In Human Resource and organizational contexts, this is especially relevant when assessing both physical assets and human capital, as employee roles and skills may be difficult to replace and highly critical to operations. Original cost alone does not reflect true importance, making it less useful. Therefore, option D is correct because it includes the most relevant and comprehensive factors for determining asset value.

When designing safety and security countermeasures for an existing (especially aging) facility, the first priority for a Physical Security Professional is to assess the current state of physical security. This includes evaluating doors, locks, windows, barriers, structural access points, and environmental design features.

Understanding what currently exists sets the foundation for integrating other systems like fire detection, access control, and intrusion detection.

Fire detection (A) is critical for life safety but not the first step in physical security design.

Access control (B) and intruder detection (D) are components of the overall physical security system and come after baseline evaluation.

Vicarious liability arises when one party (often an employer or principal) is held legally responsible for the actions of another party (such as an employee or agent), particularly when the controlling party has authority over the actions being performed. This principle is central to agency law and is especially relevant in security services and corporate liability cases.

Compliance liability (A), Active liability (C), and Passive liability (D) are not formal legal terms in this context.

Risk transfer involves shifting the financial impact of a risk to a third party, such as through an insurance policy. By purchasing insurance, the organization transfers the monetary burden of certain events (e.g., theft, damage, liability) to the insurer.

A (Avoidance) means eliminating the risk entirely.

C (Reduction) involves lowering the likelihood or impact.

D (Spreading) divides the risk among multiple entities, not full transfer.

Annual Loss Expectancy (ALE) is calculated as:

ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO),

which reflects the impact (SLE) and the frequency (ARO) of an event. This formula is a key component in risk assessment for determining expected financial loss.

A, B, and C are partially correct but not the accepted risk formula framework.

A tort is a civil wrong for which a remedy may be obtained in the form of damages. It is based on the idea that individuals owe certain duties to others and can be held liable when they breach those duties, resulting in harm or injury.

Transitivity (A), Reassembly (C), and Procurement (D) are not related to civil legal liability.

If stairwells are used regularly for inter-floor travel and permitted by local code, the best practice is to maintain both life safety and security. This can be done by installing approved access control devices (e.g., card readers) and two-way communication systems (intercoms) to manage access while allowing emergency use.

A (Fail-secure locks) could pose a safety risk in emergencies.

B (Unlocked doors) may violate building security policies.

C (Selective unlocking) is inconsistent and may cause confusion during emergencies.

Wide Area Networks (WANs), like LANs, allow multiple devices to share communication lines. In WANs, technologies such as packet switching, virtual circuits, and multiplexing are used to let multiple users communicate over shared infrastructure. This is essential for scalability and efficiency across geographically dispersed locations.

Balanced magnetic switches are designed to be more resistant to tampering than simple magnetic switches. They include additional magnetic elements and polarity configurations that make it difficult for an intruder to manipulate the circuit with an external magnet.

A is true for both types of switches.

B and C are incorrect technical descriptions for balanced switches.

Infrared beam sensors are typically used to detect movement across open areas and are line-of-sight devices. They are not well-suited for enclosed or small, solid objects like safes. They can be easily bypassed or may not be triggered when tampering with a safe that doesn’t break the beam.

A, B, and D are more effective around physical objects:

Capacitance can detect touch or presence.

Microwave can detect motion or disturbance.

Fiber optic cable can detect physical interaction or tampering.

In the context of risk management:

A hazard is a condition or factor that increases the likelihood or severity of a peril (a cause of loss).

For example, oily floors (hazard) increase the chance of slips and falls (peril).

A (possible occurrence) and B (probable occurrence) describe likelihood, not hazard.

C (difference between actual and expected losses) refers to variance, not hazard.

According to best practices, the vendor should offer a warranty that includes full maintenance of the equipment because the vendor is typically responsible for delivering the complete solution, including installation, integration, and ongoing support. In Human Resource and organizational management contexts, having a single accountable party ensures clarity, efficiency, and reliable service. Vendors coordinate between manufacturers, technicians, and service providers, making them best positioned to manage maintenance responsibilities and ensure system performance. This arrangement also simplifies communication and accountability, which is important for minimizing downtime and maintaining workplace safety. Manufacturers may provide product warranties, but they usually do not handle full system maintenance. Therefore, option A is correct because the vendor ensures comprehensive support and aligns with best practices in system lifecycle management.

Proximity badges use radio-frequency identification (RFID) technology, allowing them to be read without physical contact. When held near a reader, the embedded chip transmits its identifier wirelessly.

A: Embedded parallel wires are characteristic of older magnetic stripe cards.

C: Proximity cards contain ID numbers, not personal data.

D: Optical sensors apply to barcoded or Wiegand cards, not proximity cards.

Comprehensive Detailed Explanation:

To implement effective preventive maintenance, you must have access to the manufacturer ' s specifications for each component. These specifications provide details such as recommended maintenance intervals, acceptable tolerances, environmental operating conditions, and part replacement guidelines.

A (MTBF), B (Performance reports), and C (Failure rates) are useful for analysis, but the foundational document for preventive action is the manufacturer’s specification.

A network security policy defines the scope of security measures within an organization’s network. It sets the rules for behavior, outlines acceptable use, identifies protected resources, defines responses to security breaches, and lays out disciplinary measures for violations.

Physical security (A) focuses on tangible access control.

Forensic investigations (C) deal with post-incident evidence gathering.

Spam filtering (D) is a specific technical control, not a policy framework.

Microwave sensors are active volumetric sensors that transmit microwave signals and detect motion based on frequency changes. For optimal coverage and effectiveness, they are typically mounted near the ceiling of the protected area. This elevated placement allows the sensor to cover a wider detection zone and reduces interference from obstacles such as furniture or equipment. In workplace security and Human Resource safety management, proper sensor placement is essential to ensure reliable detection and minimize false alarms. Mounting sensors too low can limit their range and increase the likelihood of obstructions affecting performance. Positioning them at ceiling level enhances monitoring efficiency and supports a safer working environment by ensuring comprehensive coverage. Therefore, option D is correct because it provides the most effective installation position for microwave sensors.

Intrusion sensor performance is commonly evaluated using three key criteria: probability of detection, nuisance alarm rate, and vulnerability to defeat. Probability of detection measures how effectively the sensor identifies actual intrusions. Nuisance alarm rate refers to the frequency of false or unnecessary alarms, which can reduce trust in the system and lead to complacency among personnel. Vulnerability to defeat assesses how easily the sensor can be bypassed or compromised by an intruder. From a Human Resource and organizational management perspective, these factors are critical because they directly influence employee response, security awareness, and overall workplace safety. High false alarm rates may lead to reduced attentiveness among staff, while poor detection capability or high vulnerability can expose the organization to risks. Therefore, option D correctly represents the standard performance criteria.

Hold harmless clauses are contractual provisions that attempt to shift liability from one party to another—typically from the hiring organization to the contractor. However, under the principle of non-delegable duty, courts often do not honor these clauses when essential legal responsibilities (like ensuring public safety) are involved. This reinforces that certain legal obligations cannot be waived or outsourced.

Options A and B are not recognized legal phrases.

The most effective method to prevent prying up the bottom of a fence is to install a bottom rail with minimal ground clearance. This approach directly addresses the vulnerability by eliminating the gap that intruders could exploit. Leaving no more than 2 inches of space ensures that tools cannot easily be inserted to lift or bend the fence fabric. In security management practices, which often intersect with Human Resource responsibilities for workplace safety, physical barriers must be designed to reduce opportunities for tampering. Simply increasing fabric strength does not prevent leverage at the base, and burying the fence in concrete is less practical and more costly. Razor ribbon may deter but does not eliminate the structural weakness. Therefore, installing a bottom rail is the most efficient and reliable preventive measure.

The three primary types of cost estimates used during the implementation of a physical protection system are:

Budgetary: Initial estimate for planning and approval.

Preliminary design: Estimate based on conceptual design.

Final design: Detailed cost based on approved construction documents and specifications.

This staged estimation approach helps refine costs as the design evolves.

Other options mention contingency or maintenance, which are important but not considered one of the three standard estimating stages.

Auxiliary systems are fire alarm systems that are connected directly to a municipal fire alarm system, such as those operated by a local fire department. These systems provide immediate notification to the authorities in the event of an alarm activation and are commonly found in buildings located within cities with centralized emergency response networks.

Warning system (A), Main system (C), and Alert system (D) are not formal classifications of municipal-linked fire alarm systems.

Professional development combines education, training, experience, and personal commitment to improve an employee’s knowledge, skills, and overall effectiveness. In Human Resource management, these elements are essential for strengthening competencies that employees already possess while also helping them adapt to new responsibilities and changing workplace demands. The main purpose of professional development is not to guarantee higher salaries, push employees toward graduate study, or encourage them to leave their jobs. Instead, it focuses on enhancing performance, building confidence, and increasing long-term value to the organization. Through continuous learning and applied experience, personnel become more capable, productive, and prepared for advancement. Therefore, option A is correct because professional development primarily sharpens and enhances existing competencies, which is one of the central goals of HR training and career development programs.

Security is increasingly recognized as a critical management function in global business operations. From protecting physical assets to ensuring the safety of personnel and intellectual property, security plays a vital role in risk mitigation and continuity planning. It integrates with other business areas such as compliance, human resources, and information technology.

The correct answer is C. Equipment performance testing.

In PSP physical security implementation, testing is used to verify that installed security equipment and systems actually perform according to required functional and performance objectives. The ASIS PSP Body of Knowledge includes functional requirements, performance requirements, success metrics, commissioning, and final acceptance testing as part of physical security system design and implementation.

Equipment performance testing is the specific type of testing used to determine whether equipment or a system is functional, has adequate sensitivity, and meets its design and performance objectives. This matches the wording of the question directly. Physical security testing guidance also describes security system performance testing as determining whether security equipment is functional, has adequate sensitivity, and meets design and performance objectives under operating conditions.

The other options are not the best answer:

A. Factory acceptance testing is normally conducted before delivery or installation to verify equipment at the factory or vendor stage.

B. Reliability performance testing focuses more on dependability, availability, or continued operation over time.

D. Site acceptance testing verifies the installed system at the actual site, but the wording about functionality, sensitivity, and design/performance objectives specifically describes equipment performance testing.

Therefore, the correct answer is C. Equipment performance testing.

The multifactor approach examines terrorism through multiple dimensions, including psychological, sociological, ideological, and organizational factors. It analyzes how individuals are recruited, indoctrinated, and motivated within terrorist networks. This is key in understanding the behavioral patterns and lifecycle of a terrorist.

Business continuity involves two core stages:

Business Recovery – restoring critical business functions quickly after a disruption.

Business Resumption – full restoration of all business operations to normal levels over the long term.

This sequence ensures operational stability in the short term and complete restoration in the long term.

The three types of comparative negligence statutes include:

Pure approach (A): The plaintiff’s compensation is reduced by their percentage of fault, no matter how high.

50/50 rule (B): The plaintiff can recover damages only if their fault is 50% or less.

51 percent rule (C): The plaintiff can recover only if they are less than 51% at fault.

All three are valid comparative negligence models used in different jurisdictions.

Programmed supervision is a structured process that ensures supervisors or designated personnel systematically check critical functions or areas for compliance, performance, and accountability. It involves scheduled tasks or checkpoints and is a key mechanism in ongoing quality and security assurance.

References from PSP: ASIS POA – Security Management Controls; PSP Study Guide – Inspection and Supervision Systems