I85PREP
⌘ K
NSCDC Private Guard Exam study materials
NSCDC Private Guard Exam study resources

NSCDC Private Guard Exam practice questions

One question at a time. Build your NSCDC Private Guard Exam understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Protection of Critical Infrastructure

Under Nigeria's critical national infrastructure protection policy, which of the following best describes a 'critical national infrastructure' asset?

  1. Any private building that employs more than fifty security guards
  2. A government office that handles classified correspondence only
  3. A facility, system or asset whose destruction would seriously undermine national security, economy or public safety Correct answer.
  4. A transport terminal that serves more than one state

Explanation

Critical national infrastructure refers to assets, systems and networks whose incapacitation or destruction would have a debilitating effect on national security, the economy, public health or safety. The defining test is the consequence of loss, not the size of the workforce or ownership. Guards must recognise this consequence-based definition because it determines the level of vigilance required.

Question 2Protection of Critical Infrastructure

A guard at a water treatment plant notices an unauthorised person photographing the chlorine storage area. What is the most appropriate immediate action?

  1. Challenge the person calmly, note descriptions, and report to the control room and supervisor Correct answer.
  2. Wait until the person leaves and then inform colleagues at shift change
  3. Confront the person physically and seize the phone
  4. Ignore the person because photography is not a criminal offence

Explanation

Unauthorised photography of sensitive plant areas is a recognised hostile reconnaissance indicator. The guard should challenge politely, observe and record details, and escalate promptly through the reporting chain. Physical confrontation or seizure of property exceeds the guard's authority and may create liability.

Question 3Protection of Critical Infrastructure

Which access control principle requires that a person be granted only the minimum access needed to perform their assigned duties?

  1. Segregation of duties
  2. Least privilege Correct answer.
  3. Need to know
  4. Defence in depth

Explanation

Least privilege means granting each person the minimum access rights required for their role, which limits the damage an insider or compromised credential can cause. It is a core principle for protecting sensitive sites such as power substations and fuel depots. Guards applying it refuse unnecessary escorted access even to familiar staff.

Question 4Protection of Critical Infrastructure

During a patrol of a perimeter fence at a substation, a guard finds a section of mesh cut and pulled back. What should the guard do first?

  1. Repair the cut with wire before continuing the patrol
  2. Crawl through the gap to search the compound alone
  3. Photograph the breach, withdraw to a safe position, and report immediately Correct answer.
  4. Continue the patrol and include the finding in the end-of-shift log

Explanation

A cut fence is evidence of a possible intrusion, and the intruder may still be inside. The guard should record the scene, avoid entering through the breach alone, move to safety and raise the alarm so backup and search can be coordinated. Preserving evidence and personal safety both take priority over repair or routine logging.

Question 5Protection of Critical Infrastructure

Which document at a critical facility normally records the identity, time and purpose of every visitor and the host who authorised the visit?

  1. The incident register
  2. The visitor log Correct answer.
  3. The staff duty roster
  4. The asset inventory

Explanation

The visitor log captures identity, time in and out, purpose and the authorising host, providing an audit trail for investigations. It supports accountability at sites such as telecom exchanges where unauthorised presence is a serious risk. Incident registers and rosters serve different purposes and cannot substitute for visitor accountability.

Question 6Protection of Critical Infrastructure

A guard is told by a supervisor to leave a fuel depot gate unmanned for two hours to help move furniture. What is the correct response?

  1. Refuse to move furniture but abandon the gate anyway
  2. Leave the gate open so that staff can monitor it themselves
  3. Explain that the gate must remain manned and request that relief be arranged before leaving Correct answer.
  4. Comply because a supervisor's instruction is always lawful

Explanation

Abandoning a security post at a critical facility creates an unacceptable vulnerability regardless of who gives the order. The guard should raise the conflict with the supervisor and insist on proper relief before leaving the post. Leaving a gate open or unmanned, even briefly, breaches the post instructions.

Question 7Protection of Critical Infrastructure

Which of the following is the clearest example of a cyber-physical threat to a critical infrastructure site?

  1. A guard reporting late for the night shift
  2. A visitor forgetting to sign out at reception
  3. A phishing email that harvests credentials used to open an electronic gate Correct answer.
  4. A delivery van arriving outside its scheduled window

Explanation

A cyber-physical threat uses a digital compromise, such as stolen credentials, to affect a physical control system like an electronic gate or SCADA interface. Guards should understand that logical security failures can translate directly into physical access. The other options are procedural or administrative weaknesses, not cyber-physical attacks.

Question 8Protection of Critical Infrastructure

What is the primary purpose of a guard conducting a visible foot patrol around a critical facility?

  1. To replace electronic intrusion detection systems
  2. To check that staff are working efficiently
  3. To create a deterrent presence and detect anomalies early Correct answer.
  4. To satisfy insurance paperwork requirements

Explanation

Visible patrols deter opportunist intruders and give guards the chance to detect anomalies such as forced doors or unusual smells before an incident develops. Patrols complement, rather than replace, electronic detection and do not assess staff productivity. Their value lies in deterrence plus early detection.

Question 9Protection of Critical Infrastructure

A guard at a telecommunications facility sees smoke coming from a battery room. Which action sequence is most appropriate?

  1. Raise the alarm, evacuate according to procedure, and call the fire service without entering the room Correct answer.
  2. Close all doors and continue the patrol to avoid disruption
  3. Wait for the smoke to clear before reporting
  4. Enter the room with a water extinguisher to attack the fire

Explanation

Battery rooms present electrical and chemical hazards, and smoke may indicate a fire that is unsafe to tackle without training and protective equipment. The guard should activate the alarm, follow evacuation procedure and call professional responders. Entering with the wrong extinguisher or delaying the report risks explosion and injury.

Question 10Protection of Critical Infrastructure

In the context of protecting critical infrastructure, what does 'insider threat' most accurately describe?

  1. A member of the public who photographs the entrance from the road
  2. An intruder who scales the perimeter fence at night
  3. A person with legitimate access who misuses it to harm the facility Correct answer.
  4. A contractor who has never been granted access

Explanation

An insider threat is posed by someone who already holds legitimate access, such as an employee or authorised contractor, and abuses that trust. Insiders can bypass perimeter controls and may know weaknesses in procedures. Guards counter this through vigilant access enforcement and anomaly reporting, not just perimeter defence.

Question 11Protection of Critical Infrastructure

A tanker driver at a fuel depot presents a delivery note that does not match the vehicle registration on the approved schedule. What should the guard do?

  1. Allow entry after taking the driver's phone number
  2. Send the driver away without recording the incident
  3. Allow entry because the delivery note is signed
  4. Deny entry, hold the vehicle in a safe area, and verify with the depot supervisor Correct answer.

Explanation

Mismatched documentation is a classic sign of an attempted unauthorised delivery or diversion. The guard should deny entry, keep the vehicle in a designated holding area away from hazardous plant, and verify with the responsible supervisor. Recording the event preserves intelligence for later investigation.

Question 12Protection of Critical Infrastructure

Why should a guard vary the timing and route of patrols at a sensitive site?

  1. To comply with overtime regulations
  2. To prevent adversaries from predicting patrol patterns Correct answer.
  3. To reduce the need for electronic monitoring
  4. To cover more ground in less time

Explanation

Predictable patrols allow an adversary to time an intrusion into the gap between passes. Randomising routes and intervals, within the limits of post orders, makes hostile planning harder. Variation supports deterrence and detection but does not replace technology or reduce working hours.

Question 13Protection of Critical Infrastructure

A guard receives a phone call from a person claiming to be a senior engineer who demands the gate code to allow an urgent repair team in. What is the best course of action?

  1. Give the code because the repair is urgent
  2. Allow the team in if they arrive in a marked van
  3. Refuse to give codes over the phone and verify the caller through the approved contact list Correct answer.
  4. Ask the caller to send the code request by text message

Explanation

Pretext calls are a common social-engineering technique against critical facilities. Codes and access details should never be disclosed by phone; the guard must verify identity through the approved contact list and follow the visitor procedure. Urgency and marked vehicles are claims that an attacker can easily fabricate.

Question 14Protection of Critical Infrastructure

Which control best protects a critical facility against a vehicle-borne improvised explosive device?

  1. Requiring visitors to wear identification badges
  2. Increasing the number of guards at the main gate
  3. Maintaining a stand-off distance enforced by physical barriers Correct answer.
  4. Installing brighter lighting around the car park

Explanation

Stand-off distance is the primary defence against vehicle bombs because blast effects fall sharply with distance. Physical barriers such as bollards and hostile vehicle mitigation systems enforce that distance. Extra guards, lighting and badges help generally but cannot substitute for keeping explosive vehicles far from the asset.

Question 15Protection of Critical Infrastructure

During a power outage at a critical facility, what is the guard's priority at the perimeter gates?

  1. Open all gates to ease traffic flow
  2. Direct all vehicles to enter without checks to avoid queues
  3. Move to manual control, verify identities by torchlight, and log all movements Correct answer.
  4. Leave the gates in their current position and wait for power to return

Explanation

Loss of power often disables electronic access control and lighting, creating an opportunity for intrusion. Guards should switch to manual procedures, verify identity carefully and record every movement until systems are restored. Opening gates or suspending checks defeats the control exactly when risk is highest.

Question 16Protection of Critical Infrastructure

Which of the following best explains why critical infrastructure sites use layered security, sometimes called defence in depth?

  1. Because regulations require at least five guards per shift
  2. Because it removes the need for incident reporting
  3. Because a single control can fail, and layers provide redundancy and delay Correct answer.
  4. Because it eliminates the need for staff training

Explanation

Defence in depth assumes that any single control may fail or be defeated, so multiple independent layers provide redundancy and delay an attacker. Each layer buys time and creates detection opportunities. Layering does not remove the need for training or reporting; it depends on people operating the layers correctly.

Question 17Protection of Critical Infrastructure

A guard notices the same unmarked car parked outside a substation on three consecutive mornings, with the occupant apparently observing the entrance. What is the most professional response?

  1. Block the car in with a patrol vehicle
  2. Assume it is a contractor and take no action
  3. Approach the car aggressively and order the occupant to leave
  4. Record the registration, times and behaviour, and report it as suspected hostile reconnaissance Correct answer.

Explanation

Repeated presence and observation of an entrance are classic indicators of hostile reconnaissance. The guard should discreetly record details and report them so a pattern can be assessed and police informed if needed. Aggression or blocking vehicles can escalate danger and may be unlawful.

Question 18Protection of Critical Infrastructure

What is the main security purpose of a two-person rule at a high-risk area such as a control room or armoury?

  1. To reduce staffing costs
  2. To ensure no single person can access or operate the asset unobserved Correct answer.
  3. To speed up shift handovers
  4. To satisfy union representation requirements

Explanation

The two-person rule requires that access or operation of a sensitive asset always involves two authorised people, so no individual can act unobserved. It deters insider misuse and makes collusion necessary for wrongdoing, raising the risk for an attacker. It is a security integrity control, not a cost or staffing measure.

Question 19Protection of Critical Infrastructure

A guard at a data centre is asked by a technician to prop open a secure door because the technician's hands are full. How should the guard respond?

  1. Refuse, and require the technician to badge in and pass through normally Correct answer.
  2. Disable the door alarm until the technician finishes
  3. Hold the door open and let the technician through without a badge check
  4. Prop the door open briefly and monitor it from a distance

Explanation

Propping or holding secure doors open defeats the access control layer and is a common technique for bypassing it, whether by tailgating or deliberate circumvention. The guard should insist on normal badging and entry, offering assistance only in ways that preserve the control. Disabling alarms or unsupervised propping creates an exploitable gap.

Question 20Protection of Critical Infrastructure

Which of the following best describes the purpose of a security vulnerability assessment at a critical facility?

  1. To assign blame after an incident has occurred
  2. To list every item of furniture in the facility
  3. To identify weaknesses and prioritise measures that reduce risk Correct answer.
  4. To calculate the payroll cost of the guard force

Explanation

A vulnerability assessment identifies weaknesses in physical, procedural and cyber controls and helps prioritise mitigation according to risk. It is forward-looking and preventive, guiding investment and procedure changes. It is not an accounting exercise, an inventory, or a post-incident blame process.

Question 21Protection of Critical Infrastructure

A suspicious package is found near the intake valve of a water treatment plant. Which combination of actions best reflects correct procedure?

  1. Move the package to the security office for safekeeping
  2. Spray the package with water to neutralise any threat
  3. Open the package to identify the owner
  4. Cordon the area, avoid touching the package, and notify police and management Correct answer.

Explanation

An unattended package near critical plant may be an explosive or hazardous device. The correct response is to establish a cordon, avoid contact, and alert police and management so experts can assess it. Moving, opening or wetting the package can trigger a device or destroy evidence.

Question 22Protection of Critical Infrastructure

A guard's post orders state that all contractor vehicles must be searched on exit. A long-serving contractor refuses, saying the rule is insulting. What should the guard do?

  1. Allow exit but report the contractor the next day
  2. Conduct the search politely and, if refused, deny exit and escalate to the supervisor Correct answer.
  3. Waive the search because of the contractor's length of service
  4. Search the vehicle forcibly without informing anyone

Explanation

Post orders apply equally to all persons and a refusal does not create an exemption. The guard should apply the search courteously and, if refused, prevent exit and escalate so management can resolve the matter. Forcible search or delayed reporting undermines both security and legal defensibility.

Question 23Protection of Critical Infrastructure

Which measure most directly mitigates the risk of an unmanned aerial vehicle conducting surveillance over a critical facility?

  1. Coordinated detection, reporting to aviation authorities, and protective screening of sensitive areas Correct answer.
  2. Painting the roofs of buildings in camouflage colours
  3. Posting a guard on the roof with a rifle
  4. Ignoring drones because they are a civil aviation matter

Explanation

Drone incursions are a growing threat to critical sites because they can gather imagery or deliver payloads. Effective mitigation combines detection, prompt reporting to the appropriate authorities, and physical or electronic screening of sensitive areas. Guards do not shoot at aircraft, and camouflage paint or inaction does not address the threat.

Question 24Protection of Critical Infrastructure

A guard discovers that a colleague has been routinely disabling a perimeter alarm to avoid false activations. What is the most appropriate action?

  1. Disable the alarm as well so behaviour is consistent
  2. Confront the colleague publicly at the next shift briefing
  3. Say nothing because the colleague is more experienced
  4. Report the matter through the security supervisor or whistleblowing channel Correct answer.

Explanation

Deliberately disabling a security system is a serious breach that creates a gap an attacker can exploit. The guard should report it through the proper supervisory or whistleblowing channel so it can be investigated and corrected. Silence, imitation or public confrontation risks retaliation and fails to fix the vulnerability.

Question 25Protection of Critical Infrastructure

During a coordinated intrusion, two guards are confronted at the gate while a third alarm activates at the rear fence. Which response best reflects sound incident command at guard level?

  1. All guards rush to the rear fence, leaving the gate unmanned
  2. The senior guard keeps the gate covered, confirms the rear alarm, and requests police backup Correct answer.
  3. The guards switch off the alarm to avoid confusion
  4. Guards abandon their posts and wait in the rest room

Explanation

A coordinated intrusion may use a diversion at one point to draw defenders away from the real target. The senior guard should maintain coverage of the gate while confirming the rear alarm and calling for police support. Abandoning posts, hiding or silencing alarms surrenders the advantage to the attackers.

Question 26Protection of Critical Infrastructure

Under the critical infrastructure protection model, a national electricity grid, a major dam and a central banking system are grouped together primarily because of which shared characteristic?

  1. They are all located within a single geographical region
  2. Their loss or compromise would cause severe disruption to national security, the economy or public safety Correct answer.
  3. They all rely exclusively on internet-based control systems
  4. They are all owned and operated directly by the armed forces

Explanation

Critical infrastructure is defined by the consequence of failure, not by ownership, location or technology. Assets are designated critical when their destruction or disruption would seriously harm national security, economic stability or public health and safety. A guard should therefore treat these sites with a level of vigilance matched to the national consequence of their loss.

Question 27Protection of Critical Infrastructure

A guard at a water treatment plant notices a person in high-visibility clothing carrying a clipboard near the chemical storage area, but the person has no visible access badge. What is the most appropriate immediate action?

  1. Challenge the person politely, confirm identity and authorisation, and report the outcome Correct answer.
  2. Escort the person off site without asking any questions
  3. Photograph the person from a distance and wait until the end of the shift to report
  4. Ignore the person because the clothing suggests legitimate work

Explanation

Appearance and props such as high-visibility clothing and clipboards are easily imitated and must never substitute for verified authorisation. The guard should calmly challenge, verify identity against the access list or escort procedures, and report the encounter. This detects both intruders and unescorted contractors before they can reach sensitive areas.

Question 28Protection of Critical Infrastructure

What is the primary purpose of a controlled single entry point at a critical facility perimeter?

  1. To concentrate screening resources so every person and vehicle can be checked Correct answer.
  2. To make the site look more organised to visitors
  3. To reduce the number of staff needed to mow the perimeter grass
  4. To allow guards to take longer breaks between patrols

Explanation

A single controlled entry point concentrates people, vehicles and screening equipment at one place where checks can be consistent. It reduces the number of points an attacker must be prevented from using and makes access decisions auditable. The goal is consistent verification, not cosmetic tidiness or staff convenience.

Question 29Protection of Critical Infrastructure

A guard on night duty at a substation sees a fence-line sensor alarm activate but observes nothing on the camera covering that zone. What is the correct response?

  1. Dispatch a physical check to the zone while continuing to monitor the camera Correct answer.
  2. Switch off the sensor to prevent repeated nuisance alarms
  3. Wait for a second alarm before responding
  4. Reset the alarm and log it as a false activation without further action

Explanation

A sensor activation must be verified physically because cameras have blind spots and an intruder may be concealed or have already passed the camera view. The guard should send or conduct a check of the zone while maintaining camera coverage. Dismissing or disabling the alarm removes a layer of protection.

Question 30Protection of Critical Infrastructure

Which record is most important for a guard to complete after turning away an unauthorised vehicle at a critical facility gate?

  1. A gate log entry recording the time, vehicle details, reason for refusal and any persons notified Correct answer.
  2. A verbal mention to a colleague at the next shift change
  3. A photograph posted on the site's social media account
  4. A note in a personal diary kept at home

Explanation

A contemporaneous gate log creates an auditable record that supports investigations, pattern analysis and legal proceedings. It should capture time, vehicle registration, the reason access was refused and who was informed. Personal diaries, informal handovers and public postings fail to meet these requirements.

Question 31Protection of Critical Infrastructure

A guard is posted at the control room door of a gas processing plant. Which behaviour best demonstrates correct enforcement of the site's access rules?

  1. Allowing anyone wearing a company uniform to enter without a badge check
  2. Allowing entry to anyone carrying tools because they are clearly workers
  3. Letting in visitors who say they are expected by a manager
  4. Checking every person's badge and confirming their name appears on the approved access list Correct answer.

Explanation

Access control at a high-consequence area requires checking credentials against an approved list for every person, regardless of uniform or claimed expectations. Uniforms and tools can be obtained or imitated. Consistent badge checks prevent unauthorised entry and reinforce the site's security culture.

Question 32Protection of Critical Infrastructure

In critical infrastructure protection, what does the term 'resilience' most accurately describe?

  1. The ability of a system to continue operating or recover quickly after disruption Correct answer.
  2. The total value of the assets protected at a site
  3. The number of guards employed at a facility
  4. The ability of a system to prevent all attacks from ever succeeding

Explanation

Resilience is about absorbing shocks and recovering quickly, accepting that some disruptions will occur. It complements prevention measures such as guards and barriers. A resilient site can maintain essential services or restore them rapidly after an incident.

Question 33Protection of Critical Infrastructure

Why should a guard at a critical facility treat discarded paperwork found in a public car park near the site as a security concern?

  1. Because littering is a criminal offence in most jurisdictions
  2. Because documents may reveal site layouts, shift patterns or operating details useful to an attacker Correct answer.
  3. Because the car park is private property
  4. Because the paperwork may belong to a member of staff who will want it back

Explanation

Documents can leak information such as site plans, rosters, delivery schedules or system details that support reconnaissance and planning by an attacker. The guard should secure the material and report it so the source of the leak can be investigated. The concern is information security, not littering or ownership.

Question 34Protection of Critical Infrastructure

A guard at a fuel depot notices that a delivery tanker has stopped on the access road outside the gate for several minutes with its hazard lights on. Which action best reflects sound protective security practice?

  1. Log the vehicle and continue routine duties without observing it
  2. Walk out and order the driver to move immediately without recording anything
  3. Assume the driver is making a phone call and take no action
  4. Observe the vehicle, note its details and report the unusual stop to the control room Correct answer.

Explanation

A stationary vehicle near a critical facility can be a reconnaissance or pre-attack indicator, and the guard should observe and report rather than assume a benign cause. Recording the registration and behaviour supports later investigation. Direct confrontation should be avoided unless the situation requires it, and no observation should be discarded.

Question 35Protection of Critical Infrastructure

At a data centre, a contractor arrives to service cooling equipment but the work order lists a different company name from the one on the contractor's identification. What should the guard do?

  1. Admit the contractor but keep their ID card at the gate
  2. Refuse entry until the discrepancy is resolved with the authorising manager Correct answer.
  3. Ask the contractor to sign a waiver and then admit them
  4. Admit the contractor because the trade and equipment match

Explanation

A mismatch between the work order and the contractor's identity is a red flag that must be resolved before access is granted. The guard should contact the authorising manager to confirm or correct the work order. Admitting first and checking later defeats the purpose of verification.

Question 36Protection of Critical Infrastructure

A guard at a telecommunications exchange sees a person inside the perimeter who claims to be a new employee who has lost their badge. What is the best course of action?

  1. Ask the person to leave the site immediately without any checks
  2. Accept the explanation and let the person continue to the building
  3. Escort the person to a controlled area and verify their identity with the supervisor before any further movement Correct answer.
  4. Take the person's word and issue a temporary badge on the spot

Explanation

An unbadged person inside the perimeter must be treated as unverified until identity and employment status are confirmed. Escorting the person to a controlled location prevents further movement while the supervisor checks records. This balances safety and courtesy with security discipline.

Question 37Protection of Critical Infrastructure

Which practice best protects a critical facility's guard force from being manipulated through social engineering at the gatehouse?

  1. Requiring guards to memorise every employee's name and face
  2. Allowing guards to share gate codes with anyone who sounds official
  3. Limiting the information guards give over the phone and requiring callers to authenticate through a known procedure Correct answer.
  4. Encouraging guards to be as helpful as possible to all callers

Explanation

Social engineering exploits helpfulness and information leakage, so guards should give out only the minimum information and require callers to authenticate through a defined procedure. This blocks pretexting attempts that rely on authority or urgency. Memorising faces is unreliable, and sharing codes or over-helping creates vulnerabilities.

Question 38Protection of Critical Infrastructure

During a site emergency at a critical facility, why must the guard at the main gate keep a written record of who enters and leaves through the emergency route?

  1. To account for all persons on site and support rescue and investigation after the incident Correct answer.
  2. To satisfy the visitors' curiosity about site operations
  3. To reduce the number of guards needed at the gate
  4. To help the site manager calculate overtime payments

Explanation

Emergency evacuation and response depend on knowing who is on site and where they went. A record of movement through the emergency route supports accountability, rescue and later investigation. Payment, curiosity and staffing levels are unrelated to this protective purpose.

Question 39Protection of Critical Infrastructure

A guard at a substation notices that a perimeter camera has been rotated to point at the fence rather than the approach road. What does this most likely indicate, and what should the guard do?

  1. Possible deliberate tampering, so the guard should report it and check the area while maintaining cover Correct answer.
  2. A fault to be fixed at the next scheduled service
  3. A sign that the camera should be switched off
  4. A routine maintenance adjustment, so no action is needed

Explanation

A camera moved from its designed field of view can be a deliberate act to create a blind spot before an intrusion. The guard should report the change and check the affected area while remaining alert. Treating it as routine or waiting for service leaves a security gap open.

Question 40Protection of Critical Infrastructure

What is the main protective benefit of installing vehicle barriers at a standoff distance from a critical building?

  1. They prevent a vehicle from reaching the structure at speed with a device on board Correct answer.
  2. They keep the building entrance clear for deliveries
  3. They provide shade for guards on duty
  4. They reduce noise from passing traffic

Explanation

Standoff distance is the primary defence against vehicle-borne attack, and barriers enforce that distance by stopping or slowing an approaching vehicle. Keeping the structure beyond reach reduces the blast effect on the asset and its occupants. Deliveries, noise and shade are incidental effects, not the protective purpose.

Question 41Protection of Critical Infrastructure

A guard at a critical facility sees a colleague writing down the gate code on a sticky note attached to the gatehouse desk. What is the most appropriate response?

  1. Photograph the note to prove the colleague was careless
  2. Point out the risk and report the practice so the code can be changed and the practice stopped Correct answer.
  3. Say nothing because the colleague is senior
  4. Copy the note into the guard's own notebook for convenience

Explanation

Written codes left in the open defeat access control and can be read by anyone entering the gatehouse. The guard should raise the issue and report it so the code is changed and the practice is corrected. Copying or photographing the note spreads the exposure rather than fixing it.

Question 42Protection of Critical Infrastructure

Which of the following best describes the role of a guard during a site lockdown at a critical facility?

  1. To open all gates so staff can leave quickly
  2. To leave the post and search the site alone
  3. To hold the assigned position, control movement through it and report observations to the control room Correct answer.
  4. To switch off alarms to avoid confusion

Explanation

A lockdown depends on guards holding assigned positions and controlling movement so the incident commander can account for the site. Leaving post or opening gates creates gaps and lets people move unpredictably. Alarms must remain active to support detection.

Question 43Protection of Critical Infrastructure

A guard at a water reservoir notices a small unmanned aircraft hovering over the treated-water storage area. What is the most appropriate response?

  1. Throw objects at the aircraft to bring it down
  2. Post a photograph of the aircraft on social media to warn the public
  3. Record the time, direction and description, notify the control room and follow the site's counter-drone procedure Correct answer.
  4. Ignore it because drones are common in the area

Explanation

An unmanned aircraft over a sensitive area may be conducting surveillance or preparing an attack, so the guard should gather observations and follow the site's counter-drone procedure. Interference with the aircraft is dangerous and may be unlawful. Public posting could compromise the response and alarm the community.

Question 44Protection of Critical Infrastructure

At a critical facility, why is it important that guards do not discuss shift rosters, alarm locations or patrol timings on social media or in public places?

  1. Because such details could be collected by an adversary to plan an attack Correct answer.
  2. Because the public has no interest in the details
  3. Because discussing work is against employment law
  4. Because the information is copyrighted by the employer

Explanation

Details about rosters, alarms and patrols are operational security information that an adversary can combine into a picture of site weaknesses and routines. Loose talk in public or online is a form of information leakage. Copyright, employment law and public interest are not the security reasons.

Question 45Protection of Critical Infrastructure

A guard is asked by a site engineer to allow a vehicle to park directly beside the main transformer building because it is convenient for unloading. The post orders require a standoff distance. What should the guard do?

  1. Refuse the request, explain the standoff rule and direct the vehicle to the designated unloading area Correct answer.
  2. Ask the driver to switch off the engine and then allow the parking
  3. Allow the parking because the engineer is senior
  4. Allow the parking but note it in the log

Explanation

Standoff rules exist to protect the asset from vehicle-borne threats and must not be waived for convenience, even by senior staff. The guard should refuse politely, explain the rule and redirect the vehicle to the approved area. Logging a breach or allowing a stationary vehicle beside the asset still leaves the asset exposed.

Question 46Protection of Critical Infrastructure

A guard at a critical facility sees a person taking photographs of the perimeter fence and security cameras from a public footpath. What is the best assessment of this behaviour?

  1. It is definitely harmless because the person is on public land
  2. It may be legitimate, but repeated or systematic photography of security features warrants observation and reporting Correct answer.
  3. It is a crime that requires immediate physical detention
  4. It should be ignored because the guard cannot act outside the fence

Explanation

Photography of security features can be a sign of hostile reconnaissance, but it can also be innocent. The correct approach is proportionate observation and reporting so that a pattern can be assessed. Assuming harmlessness, arresting the person or ignoring the behaviour all fail to manage the risk appropriately.

Question 47Protection of Critical Infrastructure

A critical facility's guard force receives a warning of a credible threat against the site. Which combination of actions best reflects the principles of protective security?

  1. Reduce patrols so the site appears normal to the public
  2. Tell staff to ignore the warning to avoid panic
  3. Close the site permanently and send all staff home
  4. Increase visible patrols, tighten access checks, brief all staff and report observations through the chain of command Correct answer.

Explanation

A credible threat calls for proportionate, coordinated measures that raise deterrence and detection while preserving the site's function. Increasing patrols, tightening access, briefing staff and reporting observations achieve this. Permanent closure, denial and reducing patrols either overreact or create new vulnerabilities.

Question 48Protection of Critical Infrastructure

A guard at a critical facility notices that a delivery driver has left a vehicle at the loading bay and walked away while the engine is running. The bay is within the standoff zone. What is the most appropriate analysis and action?

  1. Treat it as a possible unattended-vehicle threat, keep people back, notify the control room and follow the site's suspicious-vehicle procedure Correct answer.
  2. Switch off the engine and carry on with routine duties
  3. Wait for the driver to return before doing anything
  4. Move the vehicle personally to clear the bay

Explanation

An unattended vehicle with its engine running inside a standoff zone is a recognised suspicious-vehicle indicator and must be treated cautiously. The guard should keep people back, notify the control room and follow the site's procedure, leaving movement of the vehicle to those authorised. Moving or touching the vehicle or waiting passively could place people at risk.

Question 49Protection of Critical Infrastructure

A guard at a control centre sees on camera that a person has entered a fenced compound and is walking toward a valve manifold. The guard cannot leave the control room. What is the best course of action?

  1. Switch off the camera to avoid distracting the response team
  2. Leave the control room to confront the person alone
  3. Announce over the public address, alert the response team with the location and keep continuous camera coverage of the person Correct answer.
  4. Wait until the person reaches the manifold before alerting anyone

Explanation

The guard's value in the control room is timely detection and communication, so the best action is to alert the response team with a precise location while maintaining visual coverage. Continuous observation gives responders accurate information. Abandoning the console, delaying or blinding the cameras all reduce the effectiveness of the response.

Question 50Protection of Critical Infrastructure

A guard at a critical facility is offered a sum of money by a stranger to leave a side gate unlocked for ten minutes. What does this situation most likely represent, and what should the guard do?

  1. A test of the guard's honesty that requires no report
  2. A harmless prank, so the guard should laugh and forget it
  3. A misunderstanding to be resolved later with the stranger
  4. An attempted bribery or insider recruitment, so the guard should refuse, avoid further contact and report it immediately Correct answer.

Explanation

Offers of money to weaken security are a classic sign of an attempt to recruit an insider or test susceptibility. The guard should refuse, avoid further contact and report the approach so the site can investigate and adjust its security. Treating it as a prank, a test or a misunderstanding leaves a serious threat unaddressed.