ASIS ASIS-PSP Physical Security Professional (PSP) Exam Exam Practice Test

The correct answer is C. environmental and degradation factors.

In PSP physical security design, lighting is treated as a structural security countermeasure, and the ASIS PSP Body of Knowledge includes knowledge of lighting, electronic security systems, performance requirements, and security system design capacities.

A 4:1 light-to-dark ratio means the brightest area should not be more than four times brighter than the darkest area within the assessed scene. This provides relatively even illumination for guards and video assessment systems. In physical protection system guidance, the light-to-dark ratio directly affects the ability to assess a scene; very high ratios create dark blind spots, while a lower ratio such as 4:1 greatly reduces those blind spots.

The reason 4:1 is used as the preferred design goal is that lighting systems degrade over time due to environmental and maintenance-related factors such as lamp aging, dirt on fixtures, weather effects, dust, damaged lamps, vegetation growth, and surface reflectance changes. Guidance on security camera lighting states that lighting may be designed for a 4-to-1 ratio to allow for degradation over time, while a 6-to-1 ratio is still used as a practical maximum to avoid areas becoming too dark or too bright for assessment.

The other options are not the best answer:

A. High surface reflection may help contrast, but it is not the reason for selecting a 4:1 design goal.

B. High aspect ratio is not a security lighting design objective in this context.

D. Reflected glare reduction is important, but the 4:1 ratio is mainly selected to maintain usable illumination despite environmental and degradation factors.

Therefore, the correct answer is C. environmental and degradation factors.

Metal halide lamps emit a bright, white light with a bluish cast. This makes them ideal for applications requiring good color rendering and visibility, such as CCTV surveillance or high-intensity outdoor lighting.

A (Sodium vapor) emits yellow/orange light.

C (Mercury vapor) also has a bluish tint but less desirable color rendering.

D (Incandescent) gives off a warm, yellowish light.

If stairwells are used regularly for inter-floor travel and permitted by local code, the best practice is to maintain both life safety and security. This can be done by installing approved access control devices (e.g., card readers) and two-way communication systems (intercoms) to manage access while allowing emergency use.

A (Fail-secure locks) could pose a safety risk in emergencies.

B (Unlocked doors) may violate building security policies.

C (Selective unlocking) is inconsistent and may cause confusion during emergencies.

Intangible assets are non-physical resources that carry value for an organization and require protection despite lacking a tangible form. Patents are a classic example because they represent proprietary technology or intellectual property, which can provide competitive advantage and legal protection.

Reputation and digital files may hold value, but in PSP asset valuation, patents are specifically recognized as legal intangible assets with quantifiable ownership rights.

Obsolete equipment is a tangible, depreciated asset and does not qualify as intangible.

Properly identifying and valuing intangible assets like patents ensures that security strategies address not only physical property but also intellectual and proprietary assets, aligning with PSP guidance on comprehensive asset protection.

One of the key indicators of effective management is the ability to delegate responsibilities. Delegation allows managers to focus on strategic oversight rather than becoming bogged down in tasks that can be handled at lower levels. This empowers staff, improves efficiency, and enhances organizational agility.

Managers who fail to delegate often become bottlenecks, negatively impacting team performance.

An Invitation for Bid (IFB) is a procurement method used when requirements are clearly defined and price is the main selection criterion. It typically requires bidders to submit pricing in a specific format so that proposals can be directly compared.

A, B, and C relate more to Requests for Proposals (RFPs), where qualitative evaluation (e.g., technical capability) plays a bigger role.

A felony is a serious criminal offense that is punishable by death or imprisonment for more than one year. This classification contrasts with misdemeanors, which are less serious offenses typically punishable by fines or imprisonment of less than one year.

Misdemeanor (D) is a lesser offense.

Corruption (A) can be a felony but is a specific type of offense.

Misguidance (C) is not a recognized legal category.

In the organizational structure of a security function, the core activities typically include:

Managerial: Oversight, policy development, leadership.

Administrative: Recordkeeping, personnel management, compliance.

Preventive: Strategies and operations to deter incidents before they occur.

Investigative: Reactive efforts to determine the cause of incidents or breaches.

These functions vary depending on the organization and risk profile but represent the foundational elements of an effective security program.

Preliminary cost estimates are developed during the feasibility phase of a project. These early estimates help determine whether a project is viable and worth pursuing, guiding initial decision-making and budgeting discussions.

A (Design) and B (Development) phases involve more detailed cost estimates.

C (Execution) is when implementation begins, after funding is approved.

In an exchange badge system, individuals surrender a personal credential in return for a temporary badge (often with a photo). One of the ways to bypass such a system is to steal or borrow a badge and alter your appearance to resemble the photo—exploiting human recognition weaknesses.

A, B, and C are more related to access control systems or hacking, not specific to defeating exchange badge visual verification.

Comprehensive Detailed Explanation:

Identity theft is the act of obtaining and using someone else ' s personal or financial information—such as social security numbers, bank details, or credit card information—without permission, often for committing fraud or other criminal activities.

Identity fraud (A) refers to the actual fraudulent acts committed after the identity is stolen.

Identity dissemination (C) and Identity distortion (D) are not standard legal or cybersecurity terms.

An intentional tort occurs when a person deliberately engages in actions that are likely to cause harm or when the person knowingly performs an act that they can reasonably foresee will result in damage. Examples include assault, battery, false imprisonment, and trespassing.

Active resister (A) and Lack of control (B) are not legal terms related to tort liability.

" International tort " is a misspelling; the correct term is " intentional tort. "

Electronic eavesdropping involves the unauthorized interception or monitoring of digital data and communications, including tapping into communication lines. This can involve accessing private messages, data streams, or other electronic communications as they travel across networks.

War driving (B) refers to searching for unsecured Wi-Fi networks, not line tapping.

Digital beating (C) and Standard digitizing (D) are not recognized cybersecurity terms.

The correct answer is A. Humans.

In the ASIS PSP Body of Knowledge, asset identification is part of Domain One: Physical Security Assessment, where the security professional must identify assets to determine their value, criticality, and loss impact. The PSP Body of Knowledge specifically includes knowledge of the nature and types of assets, including tangible and intangible assets.

A tangible asset is an asset that has a physical form or physical presence. Humans/people are tangible because they physically exist and can be directly protected through physical security measures such as access control, emergency response, life safety systems, barriers, screening, and security staffing.

The other choices are not the best examples of tangible assets:

B. Information is generally treated as an intangible asset, although it may be stored on physical media.

C. Reputation is an intangible organizational asset.

D. Trademarks are intellectual property and are intangible assets.

ASIS also describes the PSP credential as related to protecting an organization’s assets, including people, property, and information, which supports the classification of people/humans as a core asset in physical security.

Therefore, the correct answer is A. Humans.

This statement reflects a well-recognized trend in modern security models. As public law enforcement agencies face increasing demands and limited resources, private sector security is expected to play a larger role in crime prevention, particularly in areas like property protection, corporate investigations, and access control. This shift allows public police to focus more on violent crime and emergency response.

Motive is the internal drive or reason behind someone ' s actions. In this context, an employee who has been passed over for a promotion and feels resentment may develop a motive for misconduct, such as sabotage, theft, or workplace disruption.

Desire refers to the emotional want.

Opportunity is about environmental or procedural chances to act.

All of the above (D) includes broader elements, but the question specifically asks for what the resentment reflects — that is motive.

Controlled areas are secure zones that restrict access to authorized personnel and vehicles only. These areas may include military zones, secure corporate facilities, or sensitive operational spaces where access control is enforced through badges, guards, surveillance, or barriers.

Terminal operations (A) refers to logistical or transportation hubs.

Surveillance (B) is a monitoring method, not a restricted area itself.

Total programs (C) is not a recognized security term.

Reserves are security personnel who are not assigned to fixed posts or patrol routes but are instead held in readiness to respond when assistance is needed. They may be used during emergencies, staffing shortages, or heightened security alerts. Their role is crucial in maintaining flexibility in a security force structure.

Contingency planning traditionally focuses on:

Infrastructure (A)

People (B)

Processes (C)

While reputation is a concern in broader risk management and public relations, it is not considered a direct category of contingency planning programs, which deal more with operational continuity than brand management.

Project management principles emphasize balancing scope, time, and cost, often referred to as the project management “triple constraint” or “iron triangle.”

Scope defines the work required to complete the project successfully, including deliverables, system specifications, and operational objectives.

Time represents the project schedule and deadlines for completing tasks, phases, or milestones.

Cost encompasses budgetary limits, including labor, materials, equipment, and contingencies.

A project manager must continuously monitor and adjust these factors to ensure that changes in one area do not negatively impact the others. For example, expanding scope without adjusting time or cost can jeopardize project success. This approach aligns with PSP guidance for security system projects, where maintaining balance among scope, schedule, and budget is critical to delivering an effective and operationally viable security system.

The classic “fire triangle” describes the three elements necessary for fire to occur:

Heat – to raise material to ignition temperature

Fuel – combustible material

Oxygen – typically from the air, to sustain combustion

Removing any one of these three elements will prevent or extinguish a fire.

An intangible asset is non-physical but adds value to an organization. A company’s reputation is a prime example—it influences customer trust, brand strength, and business continuity, especially in crisis situations.

A (Patents) are intellectual property, which are intangible but categorized differently.

C (Digital files) are tangible in terms of data assets.

D (Obsolete equipment) is a tangible depreciated asset.

The accounting or finance department typically has oversight of all monetary assets, including cash flow, budgets, payroll, and financial reporting. This central role makes it particularly vulnerable to internal fraud, embezzlement, and cybercrime. Security measures here often include both physical controls and procedural checks (e.g., audits, access controls, separation of duties).

References from PSP: Organizational Vulnerability – ASIS POA; PSP Study Guide – Internal Threats and Crime Risks

In low-light surveillance conditions, a lower F-stop allows more light to pass through the camera lens and reach the image sensor. The F-stop measures the size of the lens opening, and the lower the number, the wider the aperture. A wider aperture improves image brightness and helps the camera produce clearer footage in dim environments. In organizational safety and Human Resource related security planning, proper camera performance is important because poor visibility can affect incident review, employee protection, and overall workplace monitoring. A higher F-stop reduces the amount of light entering the camera, which is less effective in low-light areas. Glass lens quality and iris type may influence performance, but they do not directly increase light intake as much as a lower F-stop. Therefore, option C is the correct answer.

Top of Form

Comprehensive Detailed Explanation:

One of the key principles of good security reporting is objectivity, not subjectivity. Reports should be clear, concise, timely, and objective to ensure factual, actionable information. Subjectivity introduces bias and undermines the reliability of reports.

A (Clarity), B (Timeliness), and D (Conciseness) are all core principles of effective reporting.

When designing safety and security countermeasures for an existing (especially aging) facility, the first priority for a Physical Security Professional is to assess the current state of physical security. This includes evaluating doors, locks, windows, barriers, structural access points, and environmental design features.

Understanding what currently exists sets the foundation for integrating other systems like fire detection, access control, and intrusion detection.

Fire detection (A) is critical for life safety but not the first step in physical security design.

Access control (B) and intruder detection (D) are components of the overall physical security system and come after baseline evaluation.

The multifactor approach examines terrorism through multiple dimensions, including psychological, sociological, ideological, and organizational factors. It analyzes how individuals are recruited, indoctrinated, and motivated within terrorist networks. This is key in understanding the behavioral patterns and lifecycle of a terrorist.

Detention differs from arrest in legal terms. Merchants and security personnel may temporarily detain someone suspected of theft under " shopkeeper ' s privilege " laws. This must be done with reasonable cause, for a reasonable period, and without excessive force. Arrest involves formal legal procedures and typically requires law enforcement authority.

The Salami Technique is a type of computer or financial fraud where small amounts of money are siphoned off from many transactions or accounts. These amounts are often so minor that they go unnoticed individually but accumulate into significant sums when aggregated. It’s often associated with insider fraud and manipulation of accounting or financial systems.

Manipulation technique (A) is a general term.

Auction planning (B) and Hostile applets (D) are unrelated concepts.

Comprehensive Detailed Explanation:

The " Theft Triangle " is a concept used in physical security and loss prevention to illustrate the three primary elements that must exist for theft to occur: motive, desire, and opportunity.

Motive: The reason someone considers committing theft (e.g., financial hardship).

Desire: The internal emotional or psychological urge to obtain something.

Opportunity: The circumstances or vulnerabilities that allow the act to occur.

All three must typically be present for theft to happen. This model is used in behavioral risk assessments and insider threat prevention strategies.

A crime is defined as a voluntary and intentional violation of a law by someone who is legally competent. It involves breaking a legal duty meant to protect society. This can include actions that are prohibited or omissions where action was legally required.

Corruption (A) is a specific type of crime involving abuse of power.

Law-breaking (B) is a general, non-legal term.

Fault (C) is too broad and often used in civil contexts.

Line supervision is a critical security feature used to monitor the integrity of wiring between sensors and the alarm processor. When multiple interior sensors are connected, supervision must exist between the processor and each individual detection sensor to ensure that any tampering, disconnection, or fault is immediately identified. This approach enhances reliability and accountability within the system. In Human Resource and organizational security management, reliable detection systems are essential for protecting employees, assets, and facilities. If supervision were only applied to groups or loops, a failure at one sensor might go unnoticed, creating a security gap. Individual supervision ensures precise fault identification and faster response, supporting effective incident management and maintaining workplace safety. Therefore, option B is correct because it ensures maximum system integrity and performance.

Transportation terminals—such as airport cargo areas, seaports, and train yards—have implemented access controls that limit entry to underground or restricted zones. These security measures help prevent unauthorized access and protect critical infrastructure and high-value cargo.

Maritime operations (A) refer to port activities but not specifically to underground security.

Security measures (B) is too general.

Resealing (D) is not relevant to underground access control.

Vicarious liability refers to an indirect legal responsibility held by an organization for the actions or omissions of its employees or agents. This is particularly relevant in the security industry when an enterprise employs or contracts security personnel. If those personnel cause harm or violate rights while performing their duties, the employer can be held liable—even if the employer did not directly engage in the act.

Strict (A) refers to liability without fault.

Negligence (B) is direct liability due to carelessness.

Loose (D) is not a recognized legal term.

Throughout the life of a project, the project manager spends the most time on control activities. This includes monitoring progress, managing changes, addressing issues, ensuring compliance with scope, cost, and schedule, and keeping stakeholders informed. Control is ongoing from initiation through closeout.

A (Documentation), B (Meetings), and C (Planning) are important but represent specific tasks or phases, not the most time-consuming activity overall.

System administration training should occur after site acceptance testing (SAT), which confirms that the system performs as specified. At this point, the system is stable and ready for operational use, making it the right time to train administrators on real equipment in a functional environment.

Training before SAT (A or C) risks using incomplete systems.

D (After reliability testing) may delay training unnecessarily.

Integrity is a deeply ingrained sense of right and wrong that develops during an individual ' s formative years. It drives ethical behavior and respect for rules, even when no one is watching. In physical security and personnel management, individuals with high integrity are more likely to be trustworthy and less likely to engage in dishonest actions, even under pressure.

Risk assessment in the PSP framework is centered on understanding the interplay between assets, exposure, and losses.

Assets are the people, property, information, and operations that must be protected.

Exposure represents the vulnerability or likelihood that an asset will be affected by threats or hazards.

Losses are the potential consequences, whether financial, operational, reputational, or physical, if a threat materializes.

By systematically analyzing these three considerations, security professionals can prioritize risks, allocate resources effectively, and design appropriate mitigation strategies. Countermeasures are developed later as responses to identified exposures and potential losses, not as a primary input to risk classification. This aligns with ASIS guidance on structured risk assessment and enterprise security risk management.

The Pass-Exchange System enhances security by requiring that the employee exchanges one pass for another at a control point before entering a more secure or restricted area. This ensures that access is tightly monitored and controlled on a zone-by-zone basis.

The critical detection point in a Physical Protection System (PPS) occurs when the remaining distance or time an adversary must cover before reaching the target exceeds the security response time. This ensures that detection happens early enough for responders to act and intervene before the attacker reaches the asset.

B and C refer to detection and interruption probabilities, which are important metrics but not the defining threshold for the critical detection point.

D (Remaining delay time) factors into the protection layers but does not define the detection threshold.

A network security policy defines the scope of security measures within an organization’s network. It sets the rules for behavior, outlines acceptable use, identifies protected resources, defines responses to security breaches, and lays out disciplinary measures for violations.

Physical security (A) focuses on tangible access control.

Forensic investigations (C) deal with post-incident evidence gathering.

Spam filtering (D) is a specific technical control, not a policy framework.

Balanced magnetic switches are designed to be more resistant to tampering than simple magnetic switches. They include additional magnetic elements and polarity configurations that make it difficult for an intruder to manipulate the circuit with an external magnet.

A is true for both types of switches.

B and C are incorrect technical descriptions for balanced switches.

Fail-safe locks are designed to unlock automatically when power is removed. This ensures people can exit during emergencies such as fire alarms or power outages. It is a critical safety requirement in most building codes.

A may be true for integrated systems but doesn’t define fail-safe.

B describes fail-secure, which keeps the door locked during power failure.

D (Tamper resistance) relates to durability, not fail-safe function.

In risk management and Human Resource contexts, assets are defined as anything that holds value to an organization, whether tangible or intangible. Tangible assets include physical items such as buildings, equipment, and technology, while intangible assets include intellectual property, employee skills, organizational reputation, and data. HR plays a critical role in protecting and developing intangible assets, particularly human capital, which is often one of the most valuable resources of an enterprise. Options A and B are too narrow because assets are not limited to fame or financial gain alone, and option C is incorrect as assets must have value. Recognizing all forms of assets helps organizations implement effective risk management, security measures, and workforce strategies. Therefore, option D correctly defines assets in a comprehensive and accurate manner.

The first step in planning any new security initiative is to gain the support of upper management because organizational commitment is essential for success. In Human Resource and organizational management practices, leadership approval ensures that adequate resources, authority, and strategic alignment are available before any detailed planning begins. Without management support, efforts such as budgeting, conducting surveys, or selecting equipment may lack direction, funding, or long-term sustainability. Securing executive backing also helps in establishing policies, enforcing compliance, and promoting a culture of safety and accountability within the workplace. Once leadership support is obtained, the organization can proceed with risk assessments, budgeting, and implementation planning in a structured and effective manner.

Insurance should be viewed as a complementary component of a security program, not a replacement. It provides financial recovery after a loss has occurred but does not prevent the loss itself. Security operations—including physical barriers, surveillance, policies, and personnel—serve as the primary defense against threats. Insurance mitigates the financial impact only after an incident.

Security input is most effective when introduced during the initial design phase of a facility. This allows for integration of security considerations into architectural planning, site layout, and system infrastructure before major design decisions are finalized.

A and B are too late in the process.

D (Concept presentation) is usually too early and conceptual for detailed security input.

Microwave sensors are active volumetric sensors that transmit microwave signals and detect motion based on frequency changes. For optimal coverage and effectiveness, they are typically mounted near the ceiling of the protected area. This elevated placement allows the sensor to cover a wider detection zone and reduces interference from obstacles such as furniture or equipment. In workplace security and Human Resource safety management, proper sensor placement is essential to ensure reliable detection and minimize false alarms. Mounting sensors too low can limit their range and increase the likelihood of obstructions affecting performance. Positioning them at ceiling level enhances monitoring efficiency and supports a safer working environment by ensuring comprehensive coverage. Therefore, option D is correct because it provides the most effective installation position for microwave sensors.

When a bomb threat targets a specific floor, safety protocols typically mandate evacuation of the identified floor and the floors immediately above and below. This accounts for the potential blast radius and structural impact, ensuring personnel safety in adjacent vulnerable areas.

A is too vague.

C and D (all floors above or below) may be excessive unless threat specifics demand it.

Floodlights are wide-beam lighting devices used to extend horizontal illumination across large areas, particularly along perimeter barriers. Their design makes them effective in lighting long stretches of fencing or property lines to deter and detect intruders. Unlike spotlights or search lights, floodlights disperse light broadly and evenly, reducing shadows and blind spots.

" Search lights " produce narrow beams for focused scanning.

" Perimeter lighting " is a general concept, not a specific lighting unit.

" Fresnel lenses " are components used in optics and are not lighting units.

Vicarious liability arises when one party (often an employer or principal) is held legally responsible for the actions of another party (such as an employee or agent), particularly when the controlling party has authority over the actions being performed. This principle is central to agency law and is especially relevant in security services and corporate liability cases.

Compliance liability (A), Active liability (C), and Passive liability (D) are not formal legal terms in this context.

In the context of risk management:

A hazard is a condition or factor that increases the likelihood or severity of a peril (a cause of loss).

For example, oily floors (hazard) increase the chance of slips and falls (peril).

A (possible occurrence) and B (probable occurrence) describe likelihood, not hazard.

C (difference between actual and expected losses) refers to variance, not hazard.

Asset value in risk management is determined by considering criticality, ease of replacement, and some measure of value. Criticality refers to how important the asset is to organizational operations, including its impact on productivity, safety, and continuity. Ease of replacement evaluates how quickly and easily the asset can be restored or substituted if lost. The measure of value includes financial worth as well as operational or strategic importance. In Human Resource and organizational contexts, this is especially relevant when assessing both physical assets and human capital, as employee roles and skills may be difficult to replace and highly critical to operations. Original cost alone does not reflect true importance, making it less useful. Therefore, option D is correct because it includes the most relevant and comprehensive factors for determining asset value.

Stakeholders are individuals or groups that either impact or are impacted by an organization’s operations, assets, or personnel. This includes internal (e.g., employees, executives) and external (e.g., customers, regulators) parties. In physical security assessments, involving stakeholders is essential to understand operational needs, identify vulnerabilities, and ensure system effectiveness.

A (Investors), B (Executives), and C (Customers) are all stakeholders but represent narrower roles.

Post orders are written instructions for security personnel detailing duties, responsibilities, and conduct at a specific post. These orders must clearly express the policies and expectations of the protected organization, ensuring alignment with security protocols and business objectives.

A (Reviewing shift log) is a task, not a policy directive.

C (Verbal instructions override written) contradicts best practice.

D (Policies of local authorities) may influence actions but do not replace enterprise policies in post orders.

While terrorism countermeasures can be part of a broader protective strategy, they are not a core element in every protective system. Effective protective systems are designed based on specific threats and assets and typically integrate:

Physical measures (barriers, lighting)

Procedural measures (policies, response plans)

Threat/asset/risk alignment (A)

Terrorism countermeasures are highly specialized and situational—they are not a universal element in all protective systems, particularly for facilities not at risk of terrorism.

A deadbolt lock must have sufficient bolt projection, known as the throw, to resist forced entry techniques such as jamb spreading. The recommended minimum throw is 1 inch because it ensures that the bolt extends deeply into the door frame, increasing resistance against prying or forced separation of the door and frame. In organizational and Human Resource security management, proper physical security measures are essential for protecting employees, assets, and sensitive areas. Installing locks with inadequate throw length may create vulnerabilities that can be exploited easily. While shorter throws may offer basic locking, they do not provide the level of resistance required for secure environments. Therefore, selecting a deadbolt with at least a 1-inch throw supports stronger access control and contributes to overall workplace safety and risk reduction.

Crisis management plans are primarily concerned with:

Crisis management team structure (A)

Disaster operations and coordination (B)

Media communication strategies (C)

While vital records (D) are important to business continuity planning, they are not a core function of crisis management, which focuses more on command, communication, and high-level decision-making during emergencies.

Performance testing typically involves precise measurement using calibrated instruments or devices to ensure systems meet specified performance criteria (e.g., camera resolution, sensor range, alarm response time).

A (Operational) testing checks usability.

C (Subsystem) testing targets individual components.

D (Post-maintenance) confirms system functionality after servicing.

Low-pressure sodium (LPS) lamps emit a nearly monochromatic yellow light, which severely limits color rendition. This makes them unsuitable for CCTV surveillance where accurate color reproduction is needed. They are, however, energy efficient and used in some outdoor lighting applications where color accuracy is not critical.

B (Incandescent), C (Fluorescent), and D (Metal halide) all offer better color rendition than LPS lamps, with metal halide being the best for color fidelity.

To qualify for a physical security project, prospects are typically required to submit a bidder’s questionnaire because it provides structured and standardized information about the company’s capabilities, experience, resources, and compliance with project requirements. In procurement and Human Resource management practices, this document helps organizations evaluate whether a bidder is technically and operationally capable of performing the work. It ensures fairness, consistency, and transparency in the selection process by allowing all bidders to be assessed against the same criteria. While customer references and executive biographies provide useful background information, they are not as comprehensive or standardized. An intent-to-bid letter only indicates interest, not qualification. Therefore, the bidder’s questionnaire is the most appropriate tool for determining eligibility and suitability for a security project, making option C the correct answer.

Sergey Nechaev, a 19th-century Russian revolutionary, provided an extreme ideological foundation for terrorism. His definition emphasized a total disconnection from moral and social norms, promoting violence as a revolutionary tool. His " Catechism of a Revolutionary " laid the groundwork for early anarchist-terrorist thinking.

In risk evaluation, vulnerability refers to the state of being open or susceptible to harm, damage, or exploitation. It identifies weaknesses in systems, processes, or human behavior that can be taken advantage of by a threat. In Human Resource and organizational risk management, vulnerabilities may include lack of training, poor supervision, weak policies, or gaps in security awareness among employees. These weaknesses increase the chances that a threat can successfully cause harm. A threat represents a potential danger, likelihood measures the probability of occurrence, and criticality reflects the importance of assets or operations. However, vulnerability specifically focuses on exposure to risk. Understanding vulnerabilities allows HR and management to implement targeted controls such as training programs, policy improvements, and monitoring systems to reduce organizational risk and enhance workplace safety.

The first step in protecting a company and its assets is to conduct a threat and vulnerability analysis because it identifies potential risks and weaknesses that could impact the organization. In Human Resource and organizational security management, understanding threats such as theft, insider risks, or external attacks, along with vulnerabilities like poor training, weak procedures, or lack of controls, is essential before implementing any protective measures. This analysis provides the foundation for developing effective security strategies, policies, and employee awareness programs. Without first identifying what needs protection and where weaknesses exist, other steps such as cost analysis or business impact analysis may be ineffective or misdirected. Therefore, option C is correct because it establishes the baseline for informed decision-making and effective asset protection planning.

Multiplex systems allow multiple alarm signals to be transmitted over a single communication line. This significantly reduces the cost of leasing multiple phone lines while enhancing efficiency and providing a high level of security by encoding and validating data streams.

A (Circuit loop) is an older method using dedicated circuits.

C (Cellular) is wireless but may not always offer secure or low-cost options.

D (Dial-up) is cost-effective but offers limited security and speed.

The correct answer is C. 328 ft. (100 m).

In PSP physical security system design, cabling distance is important because electronic security systems such as access control, video surveillance, and intrusion detection depend on proper communication infrastructure. The ASIS PSP Body of Knowledge includes electronic security systems, applicable codes/standards, performance requirements, and technical system design capacities under physical security system design.

For category-rated UTP cable, the standard distance limitation is 100 meters, which equals approximately 328 feet. This is the commonly accepted maximum channel distance for category-rated twisted-pair Ethernet cabling. TIA/EIA cabling references repeatedly use 100 m (328 ft) as the standard measurement length for category-rated cable performance values.

Therefore, the correct PSP-relevant answer is C. 328 ft. (100 m).

A security survey is a detailed, on-site examination of an organization’s premises, operations, procedures, and systems. Its purpose is to identify weaknesses, evaluate risks, and recommend countermeasures. It includes physical inspection, interviews, documentation reviews, and testing of current security controls.

This is distinct from a risk analysis (which is more data-focused) or a performance audit (which evaluates outcomes rather than vulnerabilities).

References from PSP: Physical Security Assessment – ASIS POA; PSP Certification Study Manual – Domain 1

The effectiveness of entry control systems is typically measured by:

Throughput (speed of entry)

False Acceptance Rate (FAR) — unauthorized access

False Rejection Rate (FRR) — denial of access to authorized users

These metrics provide insight into both the security and user experience of the access control system.

A (Cost) is relevant to budgeting, not effectiveness.

B (Activation delays) may affect throughput but isn’t a primary measure.

D (System obsolescence) relates to lifecycle, not effectiveness.

An auxiliary alarm system uses a direct connection (usually via leased lines) to a public emergency service center, such as police, fire, or 911. This provides rapid response but limits control to only the responding agencies, unlike proprietary or central station systems.

The Internet Protocol (IP) is used to route packets of data between LANs and WANs. It allows communication across interconnected networks regardless of the underlying hardware or local network configuration. IP is part of the TCP/IP protocol suite and is the foundational protocol for all modern internetworking.

Ethernet Protocol (A) applies to LANs but not internetwork communication.

Options B and C are not valid or recognized protocol names.

The value of an asset to an organization is most appropriately characterized by its replacement value, which represents the cost required to replace or restore the asset if it is lost, damaged, or compromised. In Human Resource and organizational management contexts, understanding asset value is essential for prioritizing protection measures, budgeting, and risk management planning. Replacement value provides a practical and measurable basis for decision-making, especially when allocating resources for security, insurance, and contingency planning. While surveys or industry publications may provide general insights, they do not reflect the specific operational importance of an asset within a particular organization. Cumulative value is not a standard method used in risk assessment. Therefore, option B is correct because replacement value offers a clear, objective, and widely accepted way to determine an asset’s importance.

Under the 50/50 rule (also known as the " modified comparative negligence " rule), the plaintiff may recover damages only if they are 50% or less at fault. If the plaintiff ' s fault is more than 50%, they cannot recover any damages. Therefore, a person responsible for more than 50% of the negligence would be barred from recovery.

Comprehensive Detailed Explanation:

A security system acceptance test verifies that the system has been installed according to the design and is operating properly. This includes ensuring cameras are correctly aimed, focused, and provide the intended coverage and image quality. This practical verification is critical for performance validation.

B and C may be part of training or specific functionality checks but are not core acceptance test items.

D refers to reliability testing, which is separate from initial acceptance.

Under the pure comparative negligence approach, a plaintiff can recover damages even if they were primarily responsible for their own injury. For example, if the plaintiff was 90% at fault, they could still recover 10% of the damages from the defendant. This model allows for partial recovery based on proportional fault, regardless of the level of the plaintiff’s responsibility.

50/50 rule and 51 percent rule prevent recovery when the plaintiff is found equally or more at fault.

In risk management, " criticality " refers to the importance of an asset or process and the potential impact its loss would have—often measured in financial terms. It guides prioritization for protection and recovery planning.

B (Continuity) relates to maintaining operations.

C (Probability) measures likelihood of occurrence.

D (Vulnerability) describes exposure to risk, not financial impact.

Preventive maintenance involves proactive actions taken to ensure systems continue to operate efficiently and to prevent failures before they occur. Updating system and application software is a clear example of preventive maintenance because it improves system performance, addresses vulnerabilities, and ensures compatibility with current operational requirements. In Human Resource and organizational management contexts, preventive maintenance supports uninterrupted operations, protects organizational assets, and ensures employee safety by reducing the likelihood of system failures. In contrast, investigating problems, restoring systems, and updating documentation are reactive or corrective maintenance activities that occur after an issue has already arisen. Preventive measures like regular updates, inspections, and testing help maintain reliability and reduce downtime. Therefore, option B is correct because it reflects a proactive approach to maintaining system effectiveness.

Exterior lighting systems should be formally evaluated at installation and then at least annually to ensure proper function, coverage, and maintenance. Routine checks may occur more frequently, but full surveys are typically annual unless conditions dictate otherwise.

A, B, and C may be appropriate for operational checks, but not full surveys.

Color rendition refers to how accurately a light source displays colors in comparison to natural daylight. In security lighting, especially for surveillance and CCTV, high color rendition allows operators to better distinguish colors, which can be critical for identification purposes (e.g., clothing or vehicle color).

B (Color temperature) relates to the warmth or coolness of light, not how colors appear.

C and D describe related but less precise aspects of lighting performance.

The statement is incorrect. The correct definitions are:

Libel is written defamation—false and damaging statements published in writing or other fixed mediums.

Slander is oral defamation—spoken false statements meant to damage someone’s reputation.

So, libel is not oral; slander is.

A non-delegable duty is a legal responsibility that cannot be entirely transferred to another party (such as an independent contractor) under agency law. While a company may hire third-party providers, the courts often hold that certain responsibilities—particularly those involving safety and legal compliance—remain with the hiring entity. This is particularly significant in the context of security services, where liability can still rest with the client company even if services are outsourced.

Delegable duty (B) is the opposite and not applicable in this context.

Non-Crime duty (C) is not a recognized legal term.

Annual Loss Expectancy (ALE) is a key financial metric used in risk management to estimate the potential dollar loss per year due to a specific risk. It is calculated as:

ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO).

This helps quantify the financial impact of a threat, allowing better prioritization and budgeting for mitigation efforts.

B (Probability) is part of the ALE calculation but not a dollar-value measure.

C (Criticality) relates to function importance but not direct financial impact.

D (Risk) is broader and includes impact and likelihood, but ALE specifically quantifies impact in dollars.

Determining the objectives of a Physical Protection System (PPS) begins with understanding the context—what needs to be protected, how the facility operates, what processes are in place, and what assets exist. This foundational understanding informs risk assessments and system requirements.

A (Risk analysis) comes after defining what’s being protected.

B (Budget) is important but not the starting point.

D (Business case) is an outcome, not an initial step.

The Transmission Control Protocol (TCP) works with IP as part of the TCP/IP suite. It divides data into packets, numbers them sequentially, and adds error detection and correction codes. This ensures that data is transmitted reliably, in order, and without loss or corruption.

File Transfer Protocol (B) uses TCP but does not handle packet creation itself.

Information Control Protocol (C) is not a recognized protocol.

“None of the above” (D) is incorrect because TCP is the correct answer.

A significant issue in the operation of intrusion detection systems is the occurrence of false positives and false negatives. A false positive happens when the system signals an alarm even though no real intrusion has occurred, while a false negative happens when an actual intrusion is not detected. In organizational and Human Resource related security management, both problems are serious because they affect employee trust, response efficiency, and overall workplace safety. Frequent false alarms can cause staff to become less responsive or careless, while missed detections can expose personnel, assets, and sensitive information to harm. Effective training, proper maintenance, and accurate calibration are essential to reducing these issues. Therefore, option B is correct because false positives and false negatives are among the most important operational concerns in intrusion detection systems.

The correct answer is B. The legal, statutory, and regulatory impacts of capturing this type of data or information.

In the ASIS PSP Body of Knowledge, video surveillance is specifically included under electronic security systems. The PSP Body of Knowledge also identifies legal and regulatory considerations for security applications, including video surveillance, privacy issues, personally identifiable information, and life safety.

Video surveillance captures images of people, activities, movements, and sometimes sensitive operational details. Before deploying cameras, the security professional must evaluate whether recording is legally permitted, what notices are required, where cameras may or may not be placed, how long recordings may be retained, who may access the footage, and whether privacy or labor rules apply.

Option A is important because recorded video must be protected from unauthorized access, but storage security comes after determining whether the organization is legally permitted to capture and retain the footage. Option D is also relevant, especially in workplaces, but employee privacy expectations are part of the broader legal and regulatory evaluation. Option C is a business benefit, not the primary security or compliance concern.

Therefore, the most important factor to evaluate when considering video surveillance is B.

Holography on ID badges provides a unique, hard-to-replicate visual feature that significantly reduces the chances of badge counterfeiting. Holograms are difficult to duplicate with standard printing technologies, thus enhancing the integrity of badge-based access control systems.

Theft (A) and Intrusion (C) are indirect risks that holography helps mitigate by reducing counterfeiting.

Security (D) is a broad concept rather than a specific risk being addressed.

Nuisance alarms, particularly from doors, are often caused by mechanical failures such as worn hinges, faulty magnetic switches, or misaligned contacts. Regular inspections and maintenance are the most effective way to reduce false alarms.

Signage (A) helps inform but doesn’t fix the mechanical issue.

Patrols (C) are reactive, not preventative.

Janitorial scheduling (D) can reduce traffic but doesn’t address faulty hardware.

In perimeter lighting, light should be directed away from the protected area (toward potential adversaries) to illuminate potential threats outside the fence or perimeter, making it easier to detect intrusions. Backlighting (placing the source behind the area being monitored) enhances visibility of trespassers without creating glare for security personnel.

A, C, and D correctly describe standard characteristics of perimeter lighting.

B incorrectly suggests the wrong direction for optimal lighting design.

The primary purpose of analyzing data collected during a risk analysis is to support informed decision-making regarding identified risks. In Human Resource and organizational management, data-driven decisions are essential for effectively prioritizing threats, allocating resources, and implementing appropriate security measures. By evaluating collected data, a Physical Security Professional can understand the likelihood and impact of risks, identify vulnerabilities, and determine the most suitable mitigation strategies. While options such as identifying peak activities, selecting technologies, or communicating with management may result from the analysis, they are secondary outcomes. The core objective remains to guide sound and informed decisions that enhance organizational safety and operational efficiency. Therefore, option A is correct because it reflects the fundamental purpose of risk analysis in supporting strategic and evidence-based decision-making.

A Physical Security Personnel metric measures the performance or responsiveness of individuals or teams responsible for maintaining physical security systems. " Integrator response to a service request " measures how quickly and effectively a technician or support provider addresses security system issues—making it a valid personnel performance metric.

A and C relate to threat detection or monitoring, not personnel metrics.

B is a system-level metric, not specific to personnel.

Post-implementation evaluation testing should be performed at least annually to assess whether the security system continues to meet operational requirements. It also ensures that performance standards are upheld, and helps identify any necessary updates or improvements.

A, B, and C are more frequent than typical industry best practice unless special conditions apply.

Pass systems are security control mechanisms used to manage access to restricted or sensitive areas within a facility. The common types of pass systems include:

Single Pass System: A permanent pass assigned to the user, typically used throughout employment unless access levels change.

Multiple Pass System: Involves multiple types of passes for different access levels or time periods.

Pass-Exchange System: A system requiring the surrender or exchange of one pass for another at checkpoints or entry to more restricted areas.

" Pass-control system " is not recognized as a distinct type of pass system in security literature and is not classified within the known categories defined in the ASIS Protection of Assets (POA) Manual or PSP certification materials.

A study by BDP International found that 35 percent of shippers were accounting for additional time to comply with the Advanced Manifest System (AMS), a U.S. Department of Homeland Security requirement that came into effect in February 2003. AMS mandates that import manifest information must be submitted at least 24 hours before the cargo is loaded onto U.S.-bound vessels at foreign ports.

Once a crime has occurred on company property, the organization is considered “on notice.” If a similar incident happens again, it can be deemed “foreseeable,” and the company may be held liable for failing to prevent it.

B and D (Inadequate security, breach of duty) may result from foreseeability, but are not the legal principle itself.

C (Legally binding) is unrelated to crime foreseeability in this context.

Comprehensive Detailed Explanation:

A core element of an effective key control policy is ensuring accountability for all keys. This includes maintaining logs, conducting regular audits, and verifying that issued keys are returned or accounted for. This reduces the risk of unauthorized access and is fundamental in access control strategies.

A and C are arbitrary numeric limits and not standard policy practice.

D may be part of policy but is not as critical as ongoing accountability.

Substantive law defines the legal relationship between individuals, including rights, duties, and legal obligations. It governs how people behave in society and outlines the legal consequences for certain actions.

Procedural law (A) refers to the methods and processes for enforcing substantive laws (e.g., court procedures).

Statutes suit (B) and Constructive law (D) are not standard legal classifications.

Arrest refers to the legal act of taking a person into custody. One of the essential legal requirements following an arrest is that the individual must be handed over to law enforcement or judicial authorities without unreasonable delay. This is to protect the constitutional rights of the detainee and avoid unlawful detention.

Detain (B) and Detention (C) refer to temporary restraint without full arrest.

Threatening loss (D) is unrelated.

The prediction of internal crime (e.g., theft, fraud) heavily relies on historical data to identify patterns, vulnerable departments, and recurring behaviors. This data-driven approach informs proactive security strategies.

A (Background checks) are preventive, not predictive.

B and C offer useful insights but are not the primary basis for trend analysis.

Comprehensive Detailed Explanation

When multiple areas of a facility or operation undergo programmed supervision, their findings contribute to an aggregate operational audit. When these audits are viewed collectively, they provide a comprehensive view of the organization’s overall operational effectiveness and compliance. This holistic oversight is critical for enterprise-level security governance.

References from PSP: ASIS POA – Aggregated Security Review and Audit Integration; PSP Manual – Company-wide Program Evaluation

The correct answer is A. an unauthorized master key permits access through any lock in the series.

In PSP physical security, locks and key systems are part of structural security measures and access control countermeasures. The ASIS PSP Body of Knowledge includes locks under physical security countermeasure selection and implementation.

A master-keying system allows one master key to open multiple locks within a defined lock series. This is useful for management and emergency access, but it creates a major security risk: if the master key is lost, stolen, duplicated, or otherwise obtained by an unauthorized person, that person can access every lock controlled by that master key. Physical security lock guidance describes this as the most obvious security problem with master keys.

The other options are incorrect:

B is incorrect because master keying generally reduces the number of useful combinations, not increases them.

C relates more specifically to removable-core lock risks, not the main master-keying problem.

D is incorrect because close tolerances usually make picking harder, not easier.

Therefore, the correct answer is A.

An active volumetric sensor emits energy (such as sound waves or electromagnetic fields) into a defined volume and detects changes caused by movement or presence within that space. Ultrasonic sensors are a common example:

They transmit high-frequency sound waves and measure the reflections to detect objects or intruders in a monitored area.

Infrared sensors are often passive (detecting heat) or line-of-sight, rather than volumetric.

Capacitive sensors detect changes in an electric field but are typically used for proximity or tamper detection.

Vibration sensors detect mechanical disturbances rather than volumetric intrusion.

Active volumetric sensors are widely used in intrusion detection systems for rooms, corridors, or other enclosed spaces because they monitor an entire volume rather than just a single point or surface.

Bottom of Form

Among the listed options, asphalt has the lowest reflectance. CCTV performance depends on lighting and surface reflectivity.

Snow (A) has very high reflectance, sometimes exceeding 80%.

Sandy soil (B) and red bricks (D) reflect more light than asphalt.

Asphalt, being dark and non-reflective, absorbs more light, making it harder for cameras to capture detail unless well illuminated.

Comprehensive Detailed Explanation:

Contingency planning in security and business continuity comprises four key components:

Emergency Response – immediate action to protect life and assets.

Crisis Management – command, communication, and decision-making during crises.

Business Recovery – restoring critical functions temporarily.

Business Resumption – restoring full, normal operations post-disruption.

Other options include irrelevant terms such as “pressure devices” or “under investigation,” which are not core to contingency planning.

Credit reports not only reflect a person ' s financial condition (debts, credit utilization, bankruptcies), but also provide useful data such as past addresses and the names of previous employers. This auxiliary information is essential during background investigations and helps validate the accuracy of job applications.

Legal and compliance considerations apply; employers must follow fair credit reporting laws and obtain consent.

Site acceptance testing is the best choice because it verifies that the completed security system, once installed at the client’s location, meets the physical and functional requirements stated in the contract. This form of testing confirms that the system performs properly in the actual operating environment, where real conditions such as layout, user interaction, workflows, and site-specific risks can affect performance. In organizational and Human Resource related operations, this is important because employees, supervisors, and security personnel must rely on systems that function correctly in daily practice, not only in theory or in a factory setting. Factory testing may confirm equipment quality before delivery, but it does not fully prove contract compliance after installation. Therefore, site acceptance testing provides the most reliable demonstration to the client that all specified requirements have been met.

Trespass is the unauthorized physical intrusion onto someone else ' s property, or the refusal to leave after authorization has been withdrawn. It is a civil tort and can also carry criminal consequences if associated with damage or criminal intent.

Prosecution (A) relates to criminal legal action.

Verdict (C) is the outcome of a legal proceeding.

“None of the above” (D) is incorrect because Trespass is the correct legal term.

The three types of comparative negligence statutes include:

Pure approach (A): The plaintiff’s compensation is reduced by their percentage of fault, no matter how high.

50/50 rule (B): The plaintiff can recover damages only if their fault is 50% or less.

51 percent rule (C): The plaintiff can recover only if they are less than 51% at fault.

All three are valid comparative negligence models used in different jurisdictions.

The actions described represent risk reduction because the organization is implementing measures to decrease the likelihood and impact of theft rather than eliminating the activity entirely. Moving the coat department, installing surveillance systems, using anti-theft tags, and limiting access to merchandise are all strategies that reduce vulnerability and deter potential offenders. In Human Resource and organizational management, risk reduction is a common approach that balances operational needs with security controls, allowing business activities to continue while minimizing threats. Risk avoidance would involve eliminating the activity altogether, such as no longer selling coats, while risk transfer would involve shifting responsibility, such as through insurance. Risk acceptance would mean taking no action. Therefore, option B is correct because the organization is actively reducing exposure to theft through multiple preventive measures.

Conspiracy in the context of theft or fraud refers to two or more individuals collaborating—often using confusion or chaos in the environment—to execute or conceal a theft. This is especially common in employee-customer collusion or multi-person theft scenarios.

Accountability (B) reduces confusion.

Invoicing (C) is a documentation process.

Proliferation (D) means rapid increase, not relevant here.

Comprehensive Detailed Explanation:

In a cost-benefit analysis for physical security systems, the total cost must account for:

Acquisition cost: Initial purchase and installation.

Life cycle cost: Operating, maintenance, support, and energy use over time.

Replacement cost: Cost to replace or upgrade the system at end-of-life.

These factors give a comprehensive view of the true investment required, rather than just the initial purchase.

B and C partially include relevant elements, but only A captures the full scope.

D misses the operational costs involved in life cycle consideration.

Material Safety Data Sheets (MSDS), now referred to as Safety Data Sheets (SDS) under the Globally Harmonized System (GHS), provide detailed information about chemicals, including hazards, handling procedures, and emergency measures. OSHA regulations require employers to maintain these sheets for all hazardous substances in the workplace.

Asset Standard Act (A), Procurement Asset Safety Program (C), and Product Stability Program (D) are not applicable to this requirement.

Comprehensive Detailed Explanation and References

Group terrorism involves an organized entity that includes a leadership hierarchy, recruitment infrastructure, training procedures, and operations planning. These groups typically have defined ideological goals and logistics networks. Examples include Hezbollah, al-Qaeda, and the FARC.