Protective Security
Protective security is the applied discipline of safeguarding people, information, physical assets and reputation. The candidate should understand it as a system of layered controls - deter, detect, delay, respond - rather than a list of guards and cameras.
Core concepts: defence in depth; the security risk management cycle (identify, assess, treat, monitor); the confidentiality–integrity–availability triad for information; need-to-know and need-to-share; classification and handling; personnel, physical and information security as interdependent domains; and the concept of the insider as the hardest problem, since insiders bypass perimeter controls. Understand security-in-depth failure: a single control is never sufficient.
Traps: questions that treat protective security as purely physical, or that forget information security. Beware answers that add controls without assessing whether they are proportionate or cost-effective, or that assume technology replaces procedure. Another trap is confusing security (protecting assets) with safety (preventing harm) - related but distinct. Also watch for questions that ignore the human factor: most breaches involve people, not equipment.
Rule of thumb: the weakest layer defines the system. Worked example: an office has strong access control, CCTV and cleared staff, but a shared printer in a public corridor. The vulnerability is not the perimeter but the information layer - documents left uncollected defeat physical controls. The proportionate fix is procedural (secure printing, clean-desk policy) rather than more cameras, because the control gap is at the information-handling layer, not the physical one.