ASIS-PSP Physical Security Professional (PSP) Exam Questions and Answers

An electric strike allows for remote electrical locking and unlocking while still permitting free mechanical egress from the protected (inside) side of the door. This is essential for life safety and code compliance, especially in commercial and public buildings.

A (Vertical pin) is a mechanical lock component, not an electric device.

B (Electromagnetic) locks typically require power to release and may not allow mechanical egress without integration.

D (Delayed egress) restricts exit temporarily, which may violate free egress rules depending on application.

" As-built " drawings are finalized versions of project design plans that reflect any changes or deviations made during installation or construction. They are essential for future maintenance, troubleshooting, and upgrades, and are a standard deliverable at project completion.

A (Archival) and B (Post-construction) are not formal document types.

C (Floorplan) is a general drawing, not specific to project finalization.

Security is increasingly recognized as a critical management function in global business operations. From protecting physical assets to ensuring the safety of personnel and intellectual property, security plays a vital role in risk mitigation and continuity planning. It integrates with other business areas such as compliance, human resources, and information technology.

Communism promotes state or collective ownership of property as a political and economic ideology. Radical Islam, while it may advocate for community-oriented economic practices (e.g., zakat, or almsgiving), does not follow the same foundational principles of property ownership as communism. The idea of " sharing property " in radical Islam is not analogous to " common property " in communism.

Workstations can serve as basic servers in small networks. While they are typically used for individual tasks, they can be configured to act as servers for file sharing, printing, or hosting lightweight applications without needing specialized installation or infrastructure.

Minicomputers (B) are outdated mid-range systems.

Supercomputers (C) are specialized, high-cost systems for massive computations, not typical servers.

“None of the above” (D) is incorrect because workstations can indeed be used as servers.

Nuisance alarms, particularly from doors, are often caused by mechanical failures such as worn hinges, faulty magnetic switches, or misaligned contacts. Regular inspections and maintenance are the most effective way to reduce false alarms.

Signage (A) helps inform but doesn’t fix the mechanical issue.

Patrols (C) are reactive, not preventative.

Janitorial scheduling (D) can reduce traffic but doesn’t address faulty hardware.

Under the pure comparative negligence approach, a plaintiff can recover damages even if they were primarily responsible for their own injury. For example, if the plaintiff was 90% at fault, they could still recover 10% of the damages from the defendant. This model allows for partial recovery based on proportional fault, regardless of the level of the plaintiff’s responsibility.

50/50 rule and 51 percent rule prevent recovery when the plaintiff is found equally or more at fault.

The planning phase of a security system project results in key deliverables such as stakeholder identification, project requirements, timelines (meeting schedules), and budget forecasts (cost estimates). These form the foundation for design and implementation.

B, C, and D include inputs or analysis components, but they are not final outputs of the planning phase.

An intentional tort occurs when a person deliberately engages in actions that are likely to cause harm or when the person knowingly performs an act that they can reasonably foresee will result in damage. Examples include assault, battery, false imprisonment, and trespassing.

Active resister (A) and Lack of control (B) are not legal terms related to tort liability.

" International tort " is a misspelling; the correct term is " intentional tort. "

Arrest refers to the legal act of taking a person into custody. One of the essential legal requirements following an arrest is that the individual must be handed over to law enforcement or judicial authorities without unreasonable delay. This is to protect the constitutional rights of the detainee and avoid unlawful detention.

Detain (B) and Detention (C) refer to temporary restraint without full arrest.

Threatening loss (D) is unrelated.

X.25 is a standard protocol suite developed by the Consultative Committee for International Telephone and Telegraph (CCITT), now known as ITU-T. It is one of the earliest protocols used for WAN communications, enabling reliable data transfer across public networks using packet switching.

XA.10 (B), CXA 1.23 (C), and X.20 (D) are not recognized standards for WAN protocols.

Comprehensive Detailed Explanation:

When assessing bombing risk, proximity to high-value or symbolic targets is a significant factor. Even if the facility itself isn’t a primary target, it may suffer collateral damage due to its location near another targeted building. This is a key aspect of blast risk assessments.

A and C (urban area, high occupancy) increase general risk but are not definitive on their own.

D (domestic/international tenants) may affect threat level but is less relevant than target adjacency.

In biometric systems:

False Acceptance Rate (FAR) represents unauthorized access.

False Rejection Rate (FRR) represents inconvenience to legitimate users.

From a security perspective, a low FAR is more critical because it ensures that unauthorized individuals are not granted access. A higher FRR can be tolerated in high-security environments, as it affects convenience rather than security.

A (low/low) is ideal but harder to achieve.

C and D (high FAR) compromise security.

The statement is incorrect. The correct definitions are:

Libel is written defamation—false and damaging statements published in writing or other fixed mediums.

Slander is oral defamation—spoken false statements meant to damage someone’s reputation.

So, libel is not oral; slander is.

An intangible asset is non-physical but adds value to an organization. A company’s reputation is a prime example—it influences customer trust, brand strength, and business continuity, especially in crisis situations.

A (Patents) are intellectual property, which are intangible but categorized differently.

C (Digital files) are tangible in terms of data assets.

D (Obsolete equipment) is a tangible depreciated asset.

In risk management, " criticality " refers to the importance of an asset or process and the potential impact its loss would have—often measured in financial terms. It guides prioritization for protection and recovery planning.

B (Continuity) relates to maintaining operations.

C (Probability) measures likelihood of occurrence.

D (Vulnerability) describes exposure to risk, not financial impact.

Focal length is the primary factor in determining the magnification and field of view in a camera lens. A longer focal length results in a narrower field of view and greater magnification of distant objects. Conversely, a shorter focal length gives a wider field of view with less magnification.

A (Image device) and B/C (Lens or image format) influence compatibility and image quality, but do not directly affect magnification.

An integrated approach to managing security risk includes both investment in proactive loss prevention techniques and the financial risk transfer method of insurance. Loss prevention helps reduce the probability and impact of incidents, while insurance ensures that if a loss does occur, the financial consequences can be absorbed or mitigated. Together, they form a balanced risk treatment strategy.

References from PSP: ASIS POA – Security and Risk Mitigation Strategies; PSP Study Guide – Operational and Strategic Measures

An initial threat or hazard evaluation must include an assessment of how likely each threat is to occur. This probability, when combined with impact analysis, forms the foundation for risk assessments. Understanding likelihood allows prioritization of mitigation strategies.

A (Estimate costs) and C (Develop business case) are later steps.

D (Develop response plan) comes after risk characterization.

The correct answer is D. retinal pattern recognition.

In PSP physical security design, access control is part of integrated physical security systems and countermeasure implementation. ASIS describes the PSP credential as covering physical security assessments, integrated physical security systems, and implementation/evaluation of security measures.

Retinal pattern recognition is a biometric access control method. It verifies a person based on a unique physical characteristic rather than something the person carries or knows. Biometric authentication uses unique body characteristics such as retinas, fingerprints, facial structure, or other biological traits for security and authentication.

The other options provide lower security by comparison:

A. Proximity card — possession-based credential; it can be lost, stolen, shared, or cloned.

B. Computer-controlled keypad — knowledge-based credential; PINs can be observed, guessed, shared, or compromised.

C. Smart card — stronger than a basic proximity card, but still a possession-based credential unless combined with PIN or biometric verification.

D. Retinal pattern recognition — biometric; tied directly to the individual and therefore provides the highest level of security among the listed options.

Therefore, for a high-security area such as a data center, the best answer is D. retinal pattern recognition.

Security consultants are often retained to provide strategic input on staffing needs, policy design, and technology integration. Their advice helps organizations make informed decisions regarding the deployment of personnel, the structure of policies, and the selection of physical and electronic security systems.

An operational audit is a continuous and comprehensive review of all facets of the security operation. It evaluates whether security procedures are functioning as intended and whether resources are being used efficiently. This process identifies inefficiencies, policy violations, or procedural weaknesses over time.

References from PSP: ASIS POA – Security Operations Review; PSP Study Manual – Domain 3: Operations and Program Evaluation

Ethernet was developed in the early 1970s by Robert Metcalfe and his team at Xerox Corporation’s Palo Alto Research Center (PARC). It became the foundational technology for local area networks (LANs) and remains widely used in networking today.

IBM (B) developed other networking technologies but not Ethernet.

Microsoft (C) is a software company and did not develop Ethernet.

Alarm monitoring systems are categorized into central station systems, local systems, proprietary systems, and auxiliary systems. Each system involves different methods of signal transmission and monitoring, including third-party monitoring centers or direct links to authorities.

An alarm sensor (also called a detector or initiating device) detects specific changes such as motion, temperature, or opening/closing of entry points. It is the primary component in any detection system and initiates the alarm response.

The correct answer is C. Equipment performance testing.

In PSP physical security implementation, testing is used to verify that installed security equipment and systems actually perform according to required functional and performance objectives. The ASIS PSP Body of Knowledge includes functional requirements, performance requirements, success metrics, commissioning, and final acceptance testing as part of physical security system design and implementation.

Equipment performance testing is the specific type of testing used to determine whether equipment or a system is functional, has adequate sensitivity, and meets its design and performance objectives. This matches the wording of the question directly. Physical security testing guidance also describes security system performance testing as determining whether security equipment is functional, has adequate sensitivity, and meets design and performance objectives under operating conditions.

The other options are not the best answer:

A. Factory acceptance testing is normally conducted before delivery or installation to verify equipment at the factory or vendor stage.

B. Reliability performance testing focuses more on dependability, availability, or continued operation over time.

D. Site acceptance testing verifies the installed system at the actual site, but the wording about functionality, sensitivity, and design/performance objectives specifically describes equipment performance testing.

Therefore, the correct answer is C. Equipment performance testing.

The correct answer is D. annually.

In the ASIS PSP Body of Knowledge, lighting is specifically included as an environmental factor that impacts physical security assessment and as a structural security countermeasure. PSP also covers inspection techniques, maintenance of systems and hardware, and ongoing evaluation throughout the security system life cycle.

Exterior security lighting must be evaluated after installation to confirm that the lighting levels, coverage, shadows, glare, blind spots, and protected areas meet the intended security objective. After the initial installation survey, the lighting system should be reviewed annually to ensure it still provides effective illumination and has not been affected by lamp deterioration, damaged fixtures, vegetation growth, changed site conditions, or maintenance issues.

Security lighting guidance also supports an annual security lighting survey, especially when lighting is part of the facility’s protective security program. APTA’s security lighting recommended practice states that a security lighting survey should be performed on an annual basis or when the built environment changes.

Weekly or monthly checks may be useful for routine maintenance, damaged lamps, or outages, but the formal lighting survey after installation is normally conducted annually.

Therefore, the best answer is D. annually.

The Chief Security Officer (CSO) is responsible for overseeing an organization’s entire security posture—including physical, personnel, and sometimes information security. A crucial part of this role is ensuring that communication channels are effective. The CSO must analyze these channels regularly to ensure that the information received is accurate, relevant, timely, concise, and actionable for security operations and decision-making.

CIO (A) focuses on IT systems.

Information Security Officer (B) handles cybersecurity but may not oversee overall physical security.

Chief Minister (C) is a governmental/political role, not organizational security.

The correct answer is Capacitance.

Capacitive sensors detect changes in the electromagnetic field around a metallic object. When a metal container enters this field, it alters the capacitance, triggering an alarm or alert.

Photoelectric sensors rely on light interruption or reflection and are typically used for perimeter detection.

Sonic and ultrasonic sensors measure sound waves to detect motion or proximity but are not designed to sense metallic objects via electromagnetic fields.

Capacitive sensing is widely used in security for protecting safes, metal cabinets, and secured storage containers because it provides reliable detection of tampering or unauthorized entry into a defined magnetic field, consistent with ASIS PSP guidance on electronic intrusion detection.

Auxiliary systems are fire alarm systems that are connected directly to a municipal fire alarm system, such as those operated by a local fire department. These systems provide immediate notification to the authorities in the event of an alarm activation and are commonly found in buildings located within cities with centralized emergency response networks.

Warning system (A), Main system (C), and Alert system (D) are not formal classifications of municipal-linked fire alarm systems.

The value of an asset to an organization is most appropriately characterized by its replacement value, which represents the cost required to replace or restore the asset if it is lost, damaged, or compromised. In Human Resource and organizational management contexts, understanding asset value is essential for prioritizing protection measures, budgeting, and risk management planning. Replacement value provides a practical and measurable basis for decision-making, especially when allocating resources for security, insurance, and contingency planning. While surveys or industry publications may provide general insights, they do not reflect the specific operational importance of an asset within a particular organization. Cumulative value is not a standard method used in risk assessment. Therefore, option B is correct because replacement value offers a clear, objective, and widely accepted way to determine an asset’s importance.

Gopher is a hypertext-based information retrieval tool that predates the World Wide Web. It uses a series of text-based menus to allow users to navigate and access various types of textual information hosted on servers. It was one of the first attempts at organizing and accessing online information in a user-friendly way.

Consortium (A) refers to a group or association, not a technology.

Hyper-text based tool (B) is descriptive but not the specific name of the system.

Symantec (C) is a cybersecurity software company, unrelated to menu-based text access systems.

Training plays a critical role in enhancing employee motivation, which directly contributes to higher employee morale. In Human Resource management, well-designed training programs improve employees’ skills, confidence, and sense of value within the organization. When employees feel competent and supported, their job satisfaction increases, leading to a more positive attitude toward their work and the organization. This improved morale often results in better teamwork, reduced turnover, and increased productivity. Training does not inherently increase workload or supervision, nor is legal protection its primary outcome. Instead, it strengthens employee engagement and commitment. Therefore, the most accurate outcome of improved staff motivation through training is enhanced employee morale, making option D the correct answer.

Private security functions are generally client-centered—focused on protecting the assets, people, and interests of a private entity or organization. In contrast, public law enforcement is tasked with serving the community at large, maintaining public order, and enforcing laws for societal benefit.

This fundamental difference in mission and orientation underpins many of the operational and strategic differences between the two sectors.

Within the PSP framework and project management methodology, the design phase is where technical and cost evaluations are conducted. During this phase, the security system’s requirements are translated into detailed specifications, including system architecture, component selection, and preliminary layouts.

Technical evaluation assesses whether proposed systems, devices, or configurations meet operational and functional requirements, including performance, scalability, and compliance with standards.

Cost evaluation ensures that proposed solutions align with the organization’s budget and provides a basis for cost-benefit analysis.

These evaluations inform decision-making before procurement and installation, reducing risk of over-specification, underperformance, or budget overruns. In contrast, planning defines objectives and scope, procurement executes purchase decisions, and installation implements the system according to the design.

The critical detection point in a Physical Protection System (PPS) occurs when the remaining distance or time an adversary must cover before reaching the target exceeds the security response time. This ensures that detection happens early enough for responders to act and intervene before the attacker reaches the asset.

B and C refer to detection and interruption probabilities, which are important metrics but not the defining threshold for the critical detection point.

D (Remaining delay time) factors into the protection layers but does not define the detection threshold.

Sergey Nechaev, a 19th-century Russian revolutionary, provided an extreme ideological foundation for terrorism. His definition emphasized a total disconnection from moral and social norms, promoting violence as a revolutionary tool. His " Catechism of a Revolutionary " laid the groundwork for early anarchist-terrorist thinking.

A Physical Security Personnel metric measures the performance or responsiveness of individuals or teams responsible for maintaining physical security systems. " Integrator response to a service request " measures how quickly and effectively a technician or support provider addresses security system issues—making it a valid personnel performance metric.

A and C relate to threat detection or monitoring, not personnel metrics.

B is a system-level metric, not specific to personnel.

The primary function of an electronic security system during an attempted or successful penetration is to notify personnel so that appropriate action can be taken. While alarms, countermeasures, and system integrations are important components, they are all secondary to ensuring that responsible individuals are informed promptly. In Human Resource and organizational security management, timely notification enables trained personnel to respond effectively, follow established procedures, and minimize potential damage or risk. Without proper notification, alarms alone may not lead to action, and automated responses may not address the situation appropriately. Effective communication and response coordination are critical aspects of workplace safety and incident management. Therefore, notifying personnel is the most essential function, making option B the correct answer.

Insurance should be viewed as a complementary component of a security program, not a replacement. It provides financial recovery after a loss has occurred but does not prevent the loss itself. Security operations—including physical barriers, surveillance, policies, and personnel—serve as the primary defense against threats. Insurance mitigates the financial impact only after an incident.

The first step in planning any new security initiative is to gain the support of upper management because organizational commitment is essential for success. In Human Resource and organizational management practices, leadership approval ensures that adequate resources, authority, and strategic alignment are available before any detailed planning begins. Without management support, efforts such as budgeting, conducting surveys, or selecting equipment may lack direction, funding, or long-term sustainability. Securing executive backing also helps in establishing policies, enforcing compliance, and promoting a culture of safety and accountability within the workplace. Once leadership support is obtained, the organization can proceed with risk assessments, budgeting, and implementation planning in a structured and effective manner.

The recommendations from the U.S. Department of Justice Task Force on Private Security Training include:

A minimum of 8 hours of formal pre-assignment training (A),

32 hours of basic training within two months of assignment, with at least 16 hours being supervised on-the-job training (B).

These guidelines aim to professionalize private security personnel and improve effectiveness and accountability.

Case law is the result of judicial decisions and precedents established through court interpretations of existing laws, whether based on common law (historical precedents from English law) or statutory law (laws passed by legislatures). It forms part of the legal framework in many jurisdictions and evolves through court rulings.

Criminal law (A) defines offenses and penalties.

Constitution law (D) governs foundational legal principles.

Offended suit (B) is not a recognized legal term.

Security standards typically require that any opening in a perimeter (e.g., HVAC ducts, pipe chases, vents) be lockable or otherwise protected if the cross-sectional area is 96 square inches or greater. This threshold is based on a size that could permit unauthorized entry or object passage.

A, B, and D are incorrect measurements based on security industry benchmarks.

In physical security terminology, a " facility " refers to any plant, building, office, institution, or industrial/commercial complex along with all its associated functions and structures that are part of an integrated operation. This includes everything from administrative buildings to warehouses and utility structures.

This definition helps determine the scope of security assessments and protective strategies under Domain 1 of the PSP program, " Physical Security Assessment. "

“Contents” (B) refers to the items inside a facility.

“Interior” (C) refers to internal areas within a facility.

“Padlocks” (D) are physical locking devices and do not define a type of structure or location.

???? References:

ASIS International, Physical Security Principles (PSP) Study Guide – Domain 1: Physical Security Assessment

Protection of Assets (POA) Manual – Chapter: Physical Security Concepts

Establishing performance requirements improves a security program because it helps decision-makers choose security features that directly support the organization’s overall protection strategy. In management and Human Resource related planning, clear performance requirements guide the selection of tools, procedures, and personnel responsibilities based on how well they achieve desired outcomes rather than simply meeting a checklist. This approach ensures that resources are aligned with actual risks, operational goals, and employee safety needs. It also supports better training, accountability, and coordination across departments because everyone understands what level of performance is expected. Validating compliance or certification may be useful later, but those actions do not primarily increase program effectiveness during design. The greatest benefit comes from choosing features that strengthen the full strategy. Therefore, option B is the most accurate answer.

Organizational levels of terrorism are generally classified into:

Individual Terrorism (Lone-wolf actors)

Group Terrorism (Non-state groups like al-Qaeda, ISIS)

State Terrorism (When a state uses terror tactics on its own or others ' populations)

Modern terrorism refers more to the contemporary methods, tools, and global nature of terrorism—not a level of organization. Hence, it ' s not considered an " organizational level. "

Comprehensive Detailed Explanation:

A security system acceptance test verifies that the system has been installed according to the design and is operating properly. This includes ensuring cameras are correctly aimed, focused, and provide the intended coverage and image quality. This practical verification is critical for performance validation.

B and C may be part of training or specific functionality checks but are not core acceptance test items.

D refers to reliability testing, which is separate from initial acceptance.

Integrity and lie detection tests fall into multiple categories, including:

Polygraph: Measures physiological responses to assess truthfulness.

Psychological Stress Evaluator (PSE): Analyzes voice stress to detect deception.

Personal Security Inventory: A written assessment designed to evaluate honesty and attitudes toward theft or other misconduct.

Each of these tools can play a role in assessing trustworthiness, particularly in high-risk or sensitive positions, and are often part of pre-employment or internal investigation procedures (where legally permissible).

In low-light surveillance conditions, a lower F-stop allows more light to pass through the camera lens and reach the image sensor. The F-stop measures the size of the lens opening, and the lower the number, the wider the aperture. A wider aperture improves image brightness and helps the camera produce clearer footage in dim environments. In organizational safety and Human Resource related security planning, proper camera performance is important because poor visibility can affect incident review, employee protection, and overall workplace monitoring. A higher F-stop reduces the amount of light entering the camera, which is less effective in low-light areas. Glass lens quality and iris type may influence performance, but they do not directly increase light intake as much as a lower F-stop. Therefore, option C is the correct answer.

Top of Form

Asking targeted questions about post orders helps supervisors verify that security officers understand their duties. It encourages engagement, promotes accountability, and reinforces learning through direct interaction.

A (Checking training records) shows completion but not understanding.

B (Logbook review) focuses on past actions, not comprehension.

D (Written report) may test literacy more than actual understanding.

Detention, particularly in the context of retail loss prevention, refers to the practice of holding a suspected shoplifter temporarily while investigating or waiting for law enforcement. This concept has evolved to provide legal protection for merchants when they act in good faith and with reasonable cause.

Release (A) and Confinement (B) do not fit the protective context.

None of the above (D) is incorrect because " Detention " is a valid and specific term used.

The four main types of invasion of privacy recognized under civil law are:

Misappropriation of name or likeness for commercial use (A)

False light (B) — misrepresenting someone publicly

Intrusion upon seclusion (D) — unauthorized intrusion into someone’s private space or affairs

Public disclosure of private facts — not “private disclosure of public facts” as stated in option C

Option C is incorrect because “private disclosure of public facts” is not a valid tort; it reverses the recognized tort, which is “public disclosure of private facts.”

An intangible asset is a non-physical resource that holds value for an organization, typically contributing to competitive advantage or operational capability. Examples include intellectual property, such as patents, trademarks, copyrights, and proprietary knowledge.

Land, buildings, and natural resources are tangible assets, meaning they have a physical form that can be seen and touched.

Intangible assets are critical in risk assessment because they often require specialized protection strategies, including legal safeguards, access control, and confidentiality measures.

ASIS PSP guidance highlights the need to recognize both tangible and intangible assets when conducting asset valuation and risk assessments, ensuring security measures are appropriately tailored to protect all forms of organizational value.

Remote access control using CCTV requires two-way communication to authenticate identity, provide instructions, and ensure that individuals requesting entry can be properly engaged. This supports access decisions made by personnel monitoring remotely.

A and D (monitoring and visual analysis) are important but secondary to communication.

C (constant camera display) is inefficient and not a requirement if smart alerting or switching is used.

Comprehensive Detailed Explanation:

Pandemics primarily impact human health and workforce availability rather than directly damaging physical infrastructure. The effects on infrastructure are typically secondary, such as reduced staffing at utilities or service providers, rather than structural destruction (as in natural disasters).

Infrastructure remains physically intact, but operations may be disrupted due to workforce shortages.

Usenet is a global distributed discussion system that predates modern forums and social media. It operates through a network of servers and allows users to post and read messages (articles) in organized newsgroups. It ' s one of the oldest forms of online community interaction.

Telnet (B) is a protocol for remote login.

Widespread net (C) and Web net (D) are not recognized technical terms.

Credit reports not only reflect a person ' s financial condition (debts, credit utilization, bankruptcies), but also provide useful data such as past addresses and the names of previous employers. This auxiliary information is essential during background investigations and helps validate the accuracy of job applications.

Legal and compliance considerations apply; employers must follow fair credit reporting laws and obtain consent.

Conversion is a civil tort that occurs when one party wrongfully possesses or interferes with another’s personal property (chattel) to the extent that the owner ' s use or rights are seriously restricted or denied. It’s essentially a civil version of theft.

Restriction (A), Transfer (B), and Constraint (C) are not legally specific terms for this tort.

Pass systems are security control mechanisms used to manage access to restricted or sensitive areas within a facility. The common types of pass systems include:

Single Pass System: A permanent pass assigned to the user, typically used throughout employment unless access levels change.

Multiple Pass System: Involves multiple types of passes for different access levels or time periods.

Pass-Exchange System: A system requiring the surrender or exchange of one pass for another at checkpoints or entry to more restricted areas.

" Pass-control system " is not recognized as a distinct type of pass system in security literature and is not classified within the known categories defined in the ASIS Protection of Assets (POA) Manual or PSP certification materials.

The accounting or finance department typically has oversight of all monetary assets, including cash flow, budgets, payroll, and financial reporting. This central role makes it particularly vulnerable to internal fraud, embezzlement, and cybercrime. Security measures here often include both physical controls and procedural checks (e.g., audits, access controls, separation of duties).

References from PSP: Organizational Vulnerability – ASIS POA; PSP Study Guide – Internal Threats and Crime Risks

Risk management is the continuous and proactive process of identifying areas where a business may suffer losses, assessing the likelihood and potential impact of those losses, and implementing security countermeasures to minimize or eliminate them. This function ensures that organizational assets—people, property, and information—are protected against threats such as theft, sabotage, natural disasters, and operational failures.

References from PSP: ASIS POA – Risk Management; PSP Study Guide – Physical Security Assessment Domain

Capacitance proximity sensors detect changes in electrical capacitance, which can be influenced by environmental conditions. Changes in relative humidity can affect the dielectric properties of the air or materials nearby, potentially causing false alarms or degraded performance.

B (Temperature) and C (Air movement) typically affect other sensor types (e.g., infrared or ultrasonic).

D (End-of-line resistance) applies to alarm circuit supervision, not proximity sensing.

In loss prevention, the “common denominator” refers to a recurring factor or condition that presents an opportunity for theft, such as lack of supervision, poorly designed procedures, or inadequate physical security. Identifying and addressing these common denominators can significantly reduce incidents of pilferage or loss.

Low deterrence (A) is a result, not a proactive factor.

Confusion (B) may contribute but isn’t the primary concept here.

Reduced pilfering (D) is an outcome, not an ingredient.

According to best practices, the vendor should offer a warranty that includes full maintenance of the equipment because the vendor is typically responsible for delivering the complete solution, including installation, integration, and ongoing support. In Human Resource and organizational management contexts, having a single accountable party ensures clarity, efficiency, and reliable service. Vendors coordinate between manufacturers, technicians, and service providers, making them best positioned to manage maintenance responsibilities and ensure system performance. This arrangement also simplifies communication and accountability, which is important for minimizing downtime and maintaining workplace safety. Manufacturers may provide product warranties, but they usually do not handle full system maintenance. Therefore, option A is correct because the vendor ensures comprehensive support and aligns with best practices in system lifecycle management.

Impressioning is a covert method used to create a working key for a lock without disassembly. It involves inserting a blank key into the lock and turning or jiggling it to create small marks where pins contact the blank, which are then filed down to form the correct cuts.

B (Rapping) and C (Bumping) are techniques to bypass a lock, not to create a key.

D (Decoding) involves analyzing key cuts visually or electronically but not physically producing a key directly.

Crime Prevention Through Environmental Design (CPTED) is a proactive design philosophy that uses environmental elements to reduce crime opportunities. One of its core principles is natural surveillance, which involves designing spaces so that legitimate users can easily observe their surroundings. This increases perceived risk for offenders and discourages criminal activity.

A (Balanced systems), B (Protection in depth), and D (Layered defense) are principles used in security system design but not specific to CPTED.

The distance from the camera to the gate is the straight-line distance, which must be calculated using the Pythagorean theorem since the camera is mounted above ground and the gate is a horizontal distance away.

Using the formula:

√(height² + horizontal distance²)

= √(40² + 30²)

= √(1600 + 900)

= √2500 = 50 feet

So, the focal length must accommodate a 50-foot (15-meter) distance.

When budgeting for replacement systems, planners must consider how quickly current technologies become outdated. Accelerating obsolescence—driven by rapid innovation and evolving threats—means that replacement cycles may need to occur sooner, and newer systems should be scalable and upgradeable.

A, B, and C are valid concerns but do not directly relate to future-proofing or replacement planning due to obsolescence.

Magnetometers, used in security screening for detecting metallic objects, typically operate using two main methods:

Continuous-wave: Emits a constant electromagnetic field to detect disruptions caused by metal.

Pulsed-field: Emits bursts of energy and analyzes the return signals to identify metal objects.

These methods allow both walk-through and handheld devices to detect ferrous and non-ferrous metals.

A, C, and D include terms not applicable to standard magnetometer operation.

This definition matches the U.S. Department of State and ASIS definitions of terrorism. It highlights the political and psychological components of terrorism, including the targeting of civilians and the intent to instill fear or send a political message.

A contingent event is one that may or may not occur and is typically dependent on other conditions or events. In risk and continuity planning, a contingent event is considered in scenarios such as equipment failure, natural disasters, or cyberattacks. Preparing for such events is central to contingency planning.

Critical processes (B) are the operations needing continuity.

Conditional delegation (C) refers to assigning authority under specific conditions.

Emergency response (D) is the action taken, not the uncertain event itself.

Electronic eavesdropping involves the unauthorized interception or monitoring of digital data and communications, including tapping into communication lines. This can involve accessing private messages, data streams, or other electronic communications as they travel across networks.

War driving (B) refers to searching for unsecured Wi-Fi networks, not line tapping.

Digital beating (C) and Standard digitizing (D) are not recognized cybersecurity terms.

Crisis management plans are primarily concerned with:

Crisis management team structure (A)

Disaster operations and coordination (B)

Media communication strategies (C)

While vital records (D) are important to business continuity planning, they are not a core function of crisis management, which focuses more on command, communication, and high-level decision-making during emergencies.

In risk assessment and security management, predictability refers to how likely it is that a person, group, or threat source will act in a certain way based on known patterns, intentions, or circumstances. This makes predictability mainly an indicator of behavior. In Human Resource and organizational risk contexts, behavior is an important factor because employee actions, workplace conduct, and responses to policies can often be anticipated from past patterns, attitudes, or warning signs. Understanding predictability helps organizations assess the likelihood of insider threats, misconduct, noncompliance, or other security-related actions. It is not primarily a measure of crisis deterrence, event history alone, or how effective countermeasures are. Instead, it focuses on the expected conduct of individuals or threat sources. Therefore, option A is the most accurate answer because predictability is fundamentally linked to behavior.

Security awareness training ensures that all employees understand security policies, recognize threats, and know how to respond appropriately. It is critical for creating a proactive security culture and ensuring that all layers of defense—including human factors—are effective.

A, B, and D refer to specific training content areas, but security awareness encompasses overall employee engagement and is critical for program success.

In the organizational structure of a security function, the core activities typically include:

Managerial: Oversight, policy development, leadership.

Administrative: Recordkeeping, personnel management, compliance.

Preventive: Strategies and operations to deter incidents before they occur.

Investigative: Reactive efforts to determine the cause of incidents or breaches.

These functions vary depending on the organization and risk profile but represent the foundational elements of an effective security program.

Self-assumption of risk means the organization accepts the financial responsibility for certain risks without transferring them to an insurer. This may involve setting aside internal reserves or using other contingency planning methods to absorb potential losses.

References from PSP: ASIS POA – Risk Financing Techniques; PSP Guide – Self-Insured Risk Models

Intangible assets are non-physical resources that carry value for an organization and require protection despite lacking a tangible form. Patents are a classic example because they represent proprietary technology or intellectual property, which can provide competitive advantage and legal protection.

Reputation and digital files may hold value, but in PSP asset valuation, patents are specifically recognized as legal intangible assets with quantifiable ownership rights.

Obsolete equipment is a tangible, depreciated asset and does not qualify as intangible.

Properly identifying and valuing intangible assets like patents ensures that security strategies address not only physical property but also intellectual and proprietary assets, aligning with PSP guidance on comprehensive asset protection.

Continuity planning involves developing strategies and procedures to ensure that critical infrastructure, processes, and systems continue to function or are restored promptly after a disruption. It includes emergency response, crisis management, recovery, and resumption phases.

Contingent planning (A) is not a standard term.

Resource planning (C) focuses on allocation of resources, not continuity.

Resumption planning (D) is a subset of continuity planning.

A search is a legal and systematic examination of a person, place, or property with the intent to discover evidence of a crime. This must often be supported by probable cause and, in many cases, a warrant.

Examine (A), Test (B), and Research (C) are generic terms that lack the legal context and specificity of " Search. "

Natural surveillance is a CPTED principle that enhances visibility in public or semi-public spaces to deter crime. Positioning kitchen windows to overlook a playground increases the likelihood of observation, reducing the opportunity for illicit behavior and enhancing safety.

A (Defensible space) is a broader concept that includes natural surveillance.

B (Territoriality) focuses on expressing ownership of space.

C (Overwatch) is a military/security term not directly used in CPTED.

Preventive maintenance involves proactive actions taken to ensure systems continue to operate efficiently and to prevent failures before they occur. Updating system and application software is a clear example of preventive maintenance because it improves system performance, addresses vulnerabilities, and ensures compatibility with current operational requirements. In Human Resource and organizational management contexts, preventive maintenance supports uninterrupted operations, protects organizational assets, and ensures employee safety by reducing the likelihood of system failures. In contrast, investigating problems, restoring systems, and updating documentation are reactive or corrective maintenance activities that occur after an issue has already arisen. Preventive measures like regular updates, inspections, and testing help maintain reliability and reduce downtime. Therefore, option B is correct because it reflects a proactive approach to maintaining system effectiveness.

The Pass-Exchange System enhances security by requiring that the employee exchanges one pass for another at a control point before entering a more secure or restricted area. This ensures that access is tightly monitored and controlled on a zone-by-zone basis.

Performance testing typically involves precise measurement using calibrated instruments or devices to ensure systems meet specified performance criteria (e.g., camera resolution, sensor range, alarm response time).

A (Operational) testing checks usability.

C (Subsystem) testing targets individual components.

D (Post-maintenance) confirms system functionality after servicing.

Vicarious liability refers to an indirect legal responsibility held by an organization for the actions or omissions of its employees or agents. This is particularly relevant in the security industry when an enterprise employs or contracts security personnel. If those personnel cause harm or violate rights while performing their duties, the employer can be held liable—even if the employer did not directly engage in the act.

Strict (A) refers to liability without fault.

Negligence (B) is direct liability due to carelessness.

Loose (D) is not a recognized legal term.

Comprehensive Detailed Explanation and References

Group terrorism involves an organized entity that includes a leadership hierarchy, recruitment infrastructure, training procedures, and operations planning. These groups typically have defined ideological goals and logistics networks. Examples include Hezbollah, al-Qaeda, and the FARC.

In risk evaluation, vulnerability refers to the state of being open or susceptible to harm, damage, or exploitation. It identifies weaknesses in systems, processes, or human behavior that can be taken advantage of by a threat. In Human Resource and organizational risk management, vulnerabilities may include lack of training, poor supervision, weak policies, or gaps in security awareness among employees. These weaknesses increase the chances that a threat can successfully cause harm. A threat represents a potential danger, likelihood measures the probability of occurrence, and criticality reflects the importance of assets or operations. However, vulnerability specifically focuses on exposure to risk. Understanding vulnerabilities allows HR and management to implement targeted controls such as training programs, policy improvements, and monitoring systems to reduce organizational risk and enhance workplace safety.

Threats in security risk assessments are typically classified as either man-made (e.g., vandalism, terrorism) or natural (e.g., earthquakes, floods). This distinction helps define appropriate mitigation strategies.

A, B, and C describe other possible classifications but are not the foundational categories.

Among the listed options, asphalt has the lowest reflectance. CCTV performance depends on lighting and surface reflectivity.

Snow (A) has very high reflectance, sometimes exceeding 80%.

Sandy soil (B) and red bricks (D) reflect more light than asphalt.

Asphalt, being dark and non-reflective, absorbs more light, making it harder for cameras to capture detail unless well illuminated.

The correct answer is C. 328 ft. (100 m).

In PSP physical security system design, cabling distance is important because electronic security systems such as access control, video surveillance, and intrusion detection depend on proper communication infrastructure. The ASIS PSP Body of Knowledge includes electronic security systems, applicable codes/standards, performance requirements, and technical system design capacities under physical security system design.

For category-rated UTP cable, the standard distance limitation is 100 meters, which equals approximately 328 feet. This is the commonly accepted maximum channel distance for category-rated twisted-pair Ethernet cabling. TIA/EIA cabling references repeatedly use 100 m (328 ft) as the standard measurement length for category-rated cable performance values.

Therefore, the correct PSP-relevant answer is C. 328 ft. (100 m).

Comprehensive Detailed Explanation:

Lux is the SI unit of illuminance and is used to measure the amount of light that falls on a surface. It quantifies how much luminous flux is spread over a given area. One lux equals one lumen per square meter. It is critical in physical security when designing lighting for surveillance, perimeter control, or safety.

A is too general.

C (Luminare) refers to a complete lighting unit.

D refers to fluorescent tube operation, not illumination measurement.

In supervised alarm circuits, resistors are placed at the end of the line (EOL) to monitor the circuit ' s integrity. This setup helps detect any tampering, open or short circuits, or line interruptions. If the resistor is not at the end, it defeats the supervision purpose, as the system cannot verify whether the line is intact all the way to the device.

Placing resistors before or after each device is unnecessary and could create false readings.

Placing it in the control panel (D) bypasses the wiring run altogether, which defeats the supervision function.

Probability of detection refers to the likelihood that an intrusion or unauthorized action will be identified by the security system. It is a key performance metric used to evaluate the effectiveness of electronic security components such as sensors and alarms. A high probability of detection means a more reliable system.

A (System validation) is a phase where detection may be measured, but it’s not the definition.

B (Officer response) is unrelated to detection probability.

D (Response timing) is part of delay or intervention, not detection.

Comparative fault, also known as comparative negligence, is a legal principle where the plaintiff’s own actions are taken into account when determining liability and awarding damages. If a person contributed to their own injury—e.g., by entering a restricted area—their compensation may be reduced proportionally to their share of fault.

Control tactics (A) and Defensive control (C) relate to use-of-force procedures, not legal doctrines.

Private security refers to individuals or organizations that offer security-related services for compensation. This includes both self-employed individuals (such as independent security consultants or contractors) and funded business entities (such as security companies or firms) that provide services to private clients for a fee. These services may include guarding, patrolling, risk assessments, investigations, alarm monitoring, or other protective activities.

An auxiliary alarm system uses a direct connection (usually via leased lines) to a public emergency service center, such as police, fire, or 911. This provides rapid response but limits control to only the responding agencies, unlike proprietary or central station systems.

A good risk management program incorporates multiple stages:

Identifying risks or vulnerabilities (e.g., threats to assets or processes)

Analyzing risks based on likelihood and potential impact (quantitative or qualitative assessment)

Evaluating and aligning existing or proposed security programs to determine adequacy and needed improvements

All three elements are part of a systematic approach to managing security and organizational risk effectively.

References from PSP: Risk Management Process – ASIS POA; PSP Study Manual – Security Program Development

Risk spreading refers to decentralizing operations or distributing assets so that if one site or operation is compromised, the entire organization isn’t paralyzed. For example, backing up data across multiple locations ensures that the loss of one system doesn ' t cause total data loss.

References from PSP: Risk Management Techniques – ASIS POA; PSP Certification Guide – Business Resilience Measures

In the PSP methodology, the preliminary design phase includes both threat assessments and vulnerability analyses.

Threat assessment identifies potential adversaries, hazards, and scenarios that could negatively impact the facility or operations.

Vulnerability analysis examines weaknesses in systems, processes, and physical infrastructure that could be exploited by threats.

These analyses inform the design of security measures by determining risk exposure and guiding the selection of protective layers. While operating security reviews and security systems architecture focus on implementation and operational evaluation, the preliminary design phase is where risks are systematically identified and addressed in the system concept and specifications, consistent with ASIS PSP guidance.

A complete Physical Protection System (PPS) procurement package must include:

Contract terms and conditions

Instructions for bidders

Technical system specifications

Design drawings

This ensures that all vendors have a uniform understanding of the scope and requirements, leading to accurate and comparable proposals.

A, B, and D include valid elements, but only C includes all core components required at minimum.

Electromechanical sensors, including magnetic reed switches and contact sensors, are the most common type used on doors and windows. They detect the opening or closing of an entry point and are widely deployed in intrusion detection systems.

A (Capacitance), C (Infrasonic), and D (Fiber optic) sensors are more specialized and not commonly used for standard door/window monitoring.

A change key is designed to operate a single specific lock within a keyed system and is typically assigned to an individual user for limited access. In key control systems, which are important in organizational and Human Resource security management, different key types are used to control access levels. A change key provides the lowest level of access, ensuring that employees can only enter authorized areas relevant to their roles. This supports accountability, reduces security risks, and helps enforce workplace policies. Options A and C describe functions of master or grand master keys, which open multiple locks. Option D refers to control or core keys used for lock maintenance. Proper use of change keys helps organizations maintain structured access control and protect assets, personnel, and sensitive areas effectively.

In the context of physical security, predictability typically refers to human behavior patterns that adversaries could exploit. For example, predictable patrol schedules or access procedures can be observed and defeated. Reducing predictability enhances security by complicating an attacker’s planning process.

A (Accuracy) and B (Effectiveness) relate to system performance.

D (Efficiency) relates to resource use, not vulnerability.

A virus is a type of malicious software that attaches itself to legitimate files and spreads when those files are executed.

A worm is a standalone malware program that replicates itself to spread to other computers without needing to attach to a host file.

A bug refers to an error or flaw in software, but in the context of this question (malicious instructions causing effects), it can contribute to vulnerabilities exploited by malware.

Since all these can involve sets of unwanted instructions leading to harmful effects, “All of the above” is the most accurate answer.

A trapdoor (also known as a backdoor) is a hidden method used by developers or attackers to bypass normal authentication or access controls in software. However, in technical distinction, a “trapdoor” refers more to unintentional or overlooked access, while “backdoor” is often intentional. For this question, since it emphasizes “unintentional access,” trapdoor is the best fit.

Bomb (A): Refers to logic bombs—malicious code triggered by specific conditions.

Backdoor (C): Usually intentionally left in place by developers or attackers.

Trojan Horse (D): Malware disguised as legitimate software.

The standard maximum distance for category-rated unshielded twisted pair UTP cable is 100 meters, which is approximately 328 feet. This limit is defined by networking standards to ensure reliable data transmission without significant signal degradation or loss. In organizational environments, including those managed under Human Resource and administrative functions, maintaining proper infrastructure standards is essential for effective communication systems, security operations, and data management. Exceeding the recommended cable length can lead to reduced network performance, increased errors, and potential system failures, which may disrupt business operations and employee productivity. HR-related systems such as attendance tracking, communication platforms, and security monitoring rely on stable network connectivity. Therefore, adhering to the 100-meter limitation ensures efficiency, reliability, and continuity of workplace operations.

In risk assessment, the tangibility of an asset does not automatically determine whether it is more or less valuable than another asset. Both tangible assets, such as equipment and facilities, and intangible assets, such as reputation, information, and employee knowledge, can be critical to an organization. Human Resource management especially recognizes that intangible assets like workforce expertise, trust, and organizational culture can have major strategic value. Because of this, each asset must be evaluated based on its specific importance, exposure to risk, and potential impact on operations. Protection measures should then be matched to that value and level of risk. A physical item is not always more valuable than a nonphysical one, and mitigation strategies should not automatically be identical. Therefore, option D is the most accurate answer.

The best way to express the impact of a risk in business terms is through monetary value. This allows decision-makers to understand the financial consequences of threats and justify investments in controls or mitigation strategies. Assigning a dollar value helps in prioritizing risks and performing cost-benefit analyses.

B (Cost-benefit ratio) is used in analysis, not direct impact expression.

C (Downtime estimate) is useful, but only a part of financial impact.

D (Frequency graph) represents likelihood, not impact.