I85PREP
⌘ K
ASP Fellowship II study materials
ASP Fellowship II study resources

ASP Fellowship II practice questions

One question at a time. Build your ASP Fellowship II understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Fundamentals of Systems Safety and Risk Analysis

In a hazard analysis, which term describes the combination of a hazard's severity and its probability of occurrence?

  1. Exposure
  2. Tolerance
  3. Mitigation
  4. Risk Correct answer.

Explanation

Risk expresses the potential for harm as a function of both the severity of the consequence and the likelihood that the hazardous event occurs. Severity alone or probability alone does not constitute risk; the two dimensions must be combined. This combined view lets analysts rank hazards and allocate controls proportionally.

Question 2Fundamentals of Systems Safety and Risk Analysis

A hazard is best defined within systems safety as which of the following?

  1. An event that has already resulted in injury
  2. A component failure mode recorded in a reliability database
  3. A condition that can cause harm to people, property, or the environment Correct answer.
  4. A deviation from a documented procedure

Explanation

Systems safety treats a hazard as a state or condition with the potential for harm, not the harm itself. This distinction matters because hazards can exist before any failure occurs, and controls are designed to eliminate or constrain those states. An accident is the realization of the harm; a hazard is the precondition.

Question 3Fundamentals of Systems Safety and Risk Analysis

Which analysis technique is a top-down, deductive method that starts from an undesired top event and traces contributing causes through logical gates?

  1. Fault tree analysis Correct answer.
  2. Failure mode and effects analysis
  3. Hazard and operability study
  4. Event tree analysis

Explanation

Fault tree analysis begins with a defined top event and works downward through AND/OR gates to identify combinations of basic events that can cause it. This deductive structure makes it suited to quantifying the probability of a specific undesired outcome. The other techniques listed proceed inductively or from deviations rather than from a chosen top event.

Question 4Fundamentals of Systems Safety and Risk Analysis

In a fault tree, a basic event that is not developed further because its probability is obtained from reliability data is called what?

  1. Undeveloped event
  2. Intermediate event
  3. Basic event Correct answer.
  4. Conditioning event

Explanation

A basic event is a lowest-level event in the fault tree for which failure data are available and no further decomposition is performed. Intermediate events are the logic outputs of gates, and undeveloped events are those left unresolved due to lack of information. Recognizing these categories is essential for correct probability assignment.

Question 5Fundamentals of Systems Safety and Risk Analysis

Which risk acceptance approach compares the cost of further risk reduction against the benefit gained and accepts risk when further reduction is grossly disproportionate?

  1. Design-to-cost rule
  2. Zero-risk policy
  3. ALARP principle Correct answer.
  4. Prescriptive compliance

Explanation

The ALARP principle requires that risk be reduced as low as reasonably practicable, weighing the sacrifice of further measures against the benefit. Risk is tolerated only when further reduction would be grossly disproportionate to the gain. Zero-risk and prescriptive approaches do not perform this balancing test.

Question 6Fundamentals of Systems Safety and Risk Analysis

Preliminary hazard analysis is typically performed at what stage of a system lifecycle?

  1. Exclusively after an accident investigation
  2. After the system is retired
  3. Early concept or design phase Correct answer.
  4. Only during final acceptance testing

Explanation

Preliminary hazard analysis is an early, coarse screening of hazards performed during concept and preliminary design, when design changes are still inexpensive. It identifies hazards, ranks them, and sets priorities for later, more detailed analyses. Performing it late forfeits its main advantage of influencing design.

Question 7Fundamentals of Systems Safety and Risk Analysis

Which of the following best describes a safety requirement in a system specification?

  1. A description of a component's physical dimensions
  2. A recommendation that designers may follow if convenient
  3. A verifiable statement of a condition the system must satisfy to keep risk within acceptable limits Correct answer.
  4. A record of failures observed during operation

Explanation

A safety requirement states a condition the system must satisfy to control risk, and it must be verifiable so compliance can be demonstrated. Treating it as optional or descriptive undermines its role in the safety case. Requirements should be traceable to hazards and to verification evidence.

Question 8Fundamentals of Systems Safety and Risk Analysis

A severity category in a hazard risk matrix reflects which attribute of a potential mishap?

  1. The frequency with which the hazard is encountered
  2. The number of analysts assigned to the assessment
  3. The degree of injury, damage, or harm that could result Correct answer.
  4. The cost of the mitigation measure

Explanation

Severity describes the magnitude of the consequence if the hazard is realized, ranging from negligible to catastrophic. Frequency or probability is a separate axis in the risk matrix. Conflating severity with likelihood or with assessment logistics is a common error.

Question 9Fundamentals of Systems Safety and Risk Analysis

In a hazard and operability study, the guide word "NONE" applied to a flow parameter indicates which deviation?

  1. No flow when flow is intended Correct answer.
  2. Flow at the wrong temperature
  3. Flow in the reverse direction
  4. More flow than intended

Explanation

HOK guide words systematically generate deviations; NONE applied to flow means the intended flow is absent. Each guide word is paired with a parameter to prompt the team to consider a specific deviation. Other guide words such as MORE or REVERSE produce different deviations.

Question 10Fundamentals of Systems Safety and Risk Analysis

A fault tree has a top event driven by two independent basic events combined through an AND gate. If each basic event has probability 0.1, what is the approximate top-event probability?

  1. 0.9
  2. 0.1
  3. 0.2
  4. 0.01 Correct answer.

Explanation

For an AND gate with independent inputs, the output probability is the product of the input probabilities, so 0.1 times 0.1 equals 0.01. An OR gate would instead sum the probabilities approximately. The AND gate therefore represents a more demanding, less likely combination of failures.

Question 11Fundamentals of Systems Safety and Risk Analysis

In failure mode and effects analysis, the risk priority number is conventionally computed as the product of which three factors?

  1. Severity, exposure, and cost
  2. Probability, consequence, and exposure
  3. Severity, occurrence, and detection Correct answer.
  4. Frequency, duration, and cost

Explanation

The risk priority number multiplies severity, occurrence, and detection rankings to prioritize failure modes for corrective action. Detection is included because a failure mode that is easily detected before harm is less critical. The product is a relative ranking aid, not an absolute risk measure.

Question 12Fundamentals of Systems Safety and Risk Analysis

An event tree analysis begins with which element?

  1. A top event decomposed into basic causes
  2. A component's failure modes and their local effects
  3. A set of guide words applied to process parameters
  4. An initiating event and the sequence of system responses that follow Correct answer.

Explanation

Event tree analysis is inductive: it starts from an initiating event and branches through the success or failure of successive safety functions to produce outcome sequences. Fault tree analysis instead decomposes a top event deductively. FMEA and HOK use entirely different starting points.

Question 13Fundamentals of Systems Safety and Risk Analysis

A design change eliminates a single-point failure by adding redundancy. Which risk-handling strategy does this primarily represent?

  1. Risk avoidance
  2. Risk acceptance
  3. Risk reduction through design Correct answer.
  4. Risk transfer

Explanation

Adding redundancy modifies the design so that no single failure causes the hazardous outcome, which is risk reduction through design. Risk avoidance would eliminate the hazardous function entirely, and transfer would shift consequences to another party. Acceptance leaves the risk in place without change.

Question 14Fundamentals of Systems Safety and Risk Analysis

Which concept describes the failure of multiple redundant channels due to a shared cause such as a common power supply or software defect?

  1. Cascading failure
  2. Intermittent failure
  3. Common cause failure Correct answer.
  4. Latent failure

Explanation

Common cause failure occurs when a single shared influence defeats multiple supposedly independent channels at once, undermining redundancy assumptions. Independence is a key premise in reliability block diagrams and fault trees, so common cause must be modeled explicitly. Latent and intermittent failures describe detection timing rather than shared causation.

Question 15Fundamentals of Systems Safety and Risk Analysis

In a risk matrix, a hazard rated as high severity but very low probability is typically handled by which approach?

  1. Applying rigorous controls because the consequence is catastrophic even if unlikely Correct answer.
  2. Ignoring it because the probability is negligible
  3. Treating it identically to a low-severity, high-probability hazard
  4. Deferring all action until an accident occurs

Explanation

Catastrophic consequences warrant strong controls even at low likelihood, because the potential loss is severe and often irreversible. Risk matrices are designed to prevent low-probability, high-consequence events from being dismissed. Ignoring such hazards is a classic failure of risk perception.

Question 16Fundamentals of Systems Safety and Risk Analysis

Which term refers to a failure that remains undetected until the system demands the function, potentially defeating a protective measure?

  1. Wear-out failure
  2. Random failure
  3. Latent failure Correct answer.
  4. Active failure

Explanation

A latent failure lies dormant and is revealed only when the affected function is called upon, which is why periodic proof testing of protective systems is required. Active failures produce immediate observable effects. Random and wear-out failures describe the failure mechanism, not the detection status.

Question 17Fundamentals of Systems Safety and Risk Analysis

A safety analyst is choosing between FMEA and fault tree analysis for a new system. Which consideration most strongly favors fault tree analysis?

  1. The need to brainstorm process deviations with an operating team
  2. The need to catalog every component failure mode and its local effect
  3. The need to model how combinations of failures lead to one specific undesired top event Correct answer.
  4. The need to estimate the cost of spare parts

Explanation

Fault tree analysis is deductive and well suited to showing how combinations of basic events combine to cause a defined top event. FMEA is inductive and better for systematically cataloging component failure modes and effects. The choice should follow the question the analyst needs to answer.

Question 18Fundamentals of Systems Safety and Risk Analysis

Which statement correctly distinguishes a hazard from a risk?

  1. A hazard exists only after an accident, while risk exists beforehand
  2. A hazard is the measured probability of harm, while risk is the source of harm
  3. A hazard is a potential source of harm, while risk combines the likelihood and severity of that harm Correct answer.
  4. A hazard applies only to machinery, while risk applies only to software

Explanation

A hazard is the potential source of harm, and risk is the assessed combination of how likely and how severe the resulting harm would be. The same hazard can carry different risk levels depending on exposure and controls. Reversing the two terms confuses the qualitative source with the quantitative assessment.

Question 19Fundamentals of Systems Safety and Risk Analysis

A system uses two redundant sensors, but both are connected to a single power distribution unit. Which analysis weakness does this reveal?

  1. The sensors are undersized for the load
  2. The detection ranking in the FMEA is too high
  3. The redundancy claim assumes independence that the shared power supply violates Correct answer.
  4. The event tree lacks an initiating event

Explanation

Redundancy only reduces risk when the redundant channels are truly independent; a shared power supply creates a common cause that can defeat both at once. The analysis must model this dependency rather than treating the channels as independent. Otherwise the computed reliability is optimistic and misleading.

Question 20Fundamentals of Systems Safety and Risk Analysis

In a fault tree, which gate represents a situation where the output occurs only if all input events occur?

  1. AND gate Correct answer.
  2. Inhibit gate
  3. OR gate
  4. Exclusive OR gate

Explanation

An AND gate produces its output only when every input event occurs simultaneously, modeling a requirement for all conditions to be present. An OR gate produces output when any input occurs. The inhibit gate is a special conditional form, and exclusive OR is not a standard fault tree gate.

Question 21Fundamentals of Systems Safety and Risk Analysis

A preliminary hazard list identifies a hazard with catastrophic severity and frequent likelihood. According to typical risk-matrix practice, what action is most appropriate?

  1. Immediate action to eliminate or control the hazard before proceeding Correct answer.
  2. Acceptance with routine monitoring
  3. Documentation only, with no design change
  4. Deferral to the next design review cycle

Explanation

A hazard combining catastrophic severity with frequent likelihood falls in the intolerable region of a typical risk matrix, requiring immediate action to eliminate or control it. Routine monitoring and deferral are appropriate only for lower-risk combinations. Delaying action on an intolerable hazard is indefensible.

Question 22Fundamentals of Systems Safety and Risk Analysis

Which of the following is the primary purpose of conducting a functional hazard assessment early in system development?

  1. To compute the lifecycle cost of maintenance activities
  2. To identify hazardous system functions and their effects so safety requirements can be derived Correct answer.
  3. To schedule production line capacity
  4. To verify that purchased components meet their datasheet specifications

Explanation

Functional hazard assessment examines system functions to identify which ones are hazardous and what their effects would be, providing the basis for deriving safety requirements and design constraints. It is a requirements-shaping activity performed before detailed design. Cost and scheduling activities are outside its scope.

Question 23Fundamentals of Systems Safety and Risk Analysis

A fault tree contains a basic event with probability 0.2 feeding an OR gate together with a second independent basic event of probability 0.3. What is the exact probability of the OR gate output?

  1. 0.5
  2. 0.06
  3. 0.56
  4. 0.44 Correct answer.

Explanation

For independent events, the OR gate output equals one minus the product of the complements: 1 minus (0.8 times 0.7) equals 1 minus 0.56, which is 0.44. Simply summing the probabilities gives 0.5, which ignores the overlap where both events occur. The exact value matters when probabilities are not small.

Question 24Fundamentals of Systems Safety and Risk Analysis

Why does the ALARP framework reject a purely zero-risk target for complex engineering systems?

  1. Because zero risk is achievable only with redundant software
  2. Because risk matrices cannot represent negligible risks
  3. Because regulators prohibit documenting residual risk
  4. Because driving risk to zero would require disproportionate sacrifice relative to the marginal benefit gained Correct answer.

Explanation

ALARP recognizes that beyond a certain point, further risk reduction costs far more than the benefit it delivers, so a zero-risk target becomes grossly disproportionate. The framework instead demands reduction to the point where further measures are not reasonably practicable. Residual risk is then explicitly documented and managed.

Question 25Fundamentals of Systems Safety and Risk Analysis

In an event tree, a sequence passes through three successive safety functions, each with success probability 0.9 and independent of the others. What is the probability that all three succeed in sequence?

  1. 0.999
  2. 0.9
  3. 0.729 Correct answer.
  4. 0.27

Explanation

The probability that all three independent functions succeed is the product 0.9 times 0.9 times 0.9, which equals 0.729. Each branch in the event tree multiplies the path probabilities. Summing the probabilities, by contrast, would be incorrect for a conjunctive sequence.

Question 26Fundamentals of Systems Safety and Risk Analysis

In systems safety terminology, which definition correctly describes a mishap?

  1. An unplanned event or series of events that results in death, injury, occupational illness, damage to or loss of equipment or property, or environmental harm Correct answer.
  2. A condition in the system that has the potential to cause harm if no controls are applied
  3. The probability that a hazardous condition will lead to an accident during a defined operating period
  4. Any deviation from design intent detected during a design review, regardless of its consequences

Explanation

A mishap is the realized, unplanned outcome event that produces actual harm, whether to people, equipment, property, or the environment. It is distinguished from a hazard, which is only a potential source of harm, and from risk, which expresses likelihood and severity together.

Question 27Fundamentals of Systems Safety and Risk Analysis

A design team classifies a hazard as unacceptable under its risk acceptance criteria. Which risk-handling strategy is the preferred first response in standard systems safety practice?

  1. Eliminate the hazard by design change or redesign of the hazardous function Correct answer.
  2. Purchase insurance to transfer the financial consequences of a mishap
  3. Add warning labels and revise the operator manual to describe the hazard
  4. Accept the residual risk and monitor it through operational reporting

Explanation

The accepted hierarchy of risk handling places design elimination first, because removing the hazard source removes the risk without relying on human behavior or added hardware. Administrative controls, warnings, and transfer mechanisms are considered only after elimination and mitigation options are exhausted.

Question 28Fundamentals of Systems Safety and Risk Analysis

An analyst is performing a hazard analysis on a new system and needs to identify hazards arising from interactions between the system and its surrounding environment, operators, and interfacing systems. Which analysis technique is specifically structured for that purpose?

  1. Operating and support hazard analysis Correct answer.
  2. Sneak circuit analysis
  3. Mean time between failure calculation
  4. Parts stress derating analysis

Explanation

Operating and support hazard analysis focuses on hazards introduced by the environment, human operators, maintenance tasks, and interfaces during operation and support activities. Techniques such as sneak circuit analysis or reliability calculations address different concerns, such as unintended logic paths or component failure rates.

Question 29Fundamentals of Systems Safety and Risk Analysis

A system safety program requires a qualitative technique that systematically examines each subsystem function for hazards to personnel, equipment, and mission under normal, abnormal, and emergency operating modes. Which technique best fits that requirement?

  1. Subsystem hazard analysis Correct answer.
  2. Human error rate prediction
  3. Event tree analysis
  4. Common cause failure analysis

Explanation

Subsystem hazard analysis examines each subsystem's functions and operating modes, including normal, abnormal, and emergency conditions, to identify hazards and their causes. It provides functional coverage across modes, whereas the other techniques address specific failure mechanisms or quantify sequences.

Question 30Fundamentals of Systems Safety and Risk Analysis

A fault tree has a top event fed by an OR gate with two independent basic events, each with probability 0.1. A second analyst argues the top event probability should be computed differently because the events are mutually exclusive rather than independent. Which statement best characterizes the correct treatment?

  1. For independent events the OR gate probability is approximately 0.1 + 0.1 - 0.01 = 0.19; if the events were truly mutually exclusive the intersection term would be zero, giving 0.20 Correct answer.
  2. The OR gate probability is 0.1 because the larger single event dominates the gate output
  3. The OR gate probability cannot be computed without converting the fault tree into an event tree first
  4. The OR gate probability is the product 0.1 × 0.1 = 0.01 regardless of whether the events are independent or mutually exclusive

Explanation

For an OR gate with independent inputs, the exact probability is the union of the events, computed as the sum minus the intersection, so 0.1 + 0.1 - 0.01 = 0.19. If the events were mutually exclusive the intersection would be zero and the union would equal 0.20, which is why the independence assumption matters.

Question 31System Safety Program Planning and Management

In a system safety program plan (SSPP), which document typically defines the safety tasks, deliverables, and milestones that the contractor must perform and submit?

  1. The hazard tracking log
  2. The contract Statement of Work (SOW) Correct answer.
  3. The system safety program plan itself
  4. The configuration management plan

Explanation

The Statement of Work is the contractual instrument that obligates the contractor to perform specific safety tasks and deliver specified safety products. The SSPP describes how the contractor will manage and execute the safety program, but the SOW is what makes those activities enforceable contract requirements.

Question 32System Safety Program Planning and Management

Which element is essential in a system safety program plan to ensure that safety requirements flow down to subcontractors and suppliers?

  1. The name of the government safety review board chairperson
  2. A subcontractor safety requirements flow-down clause or procedure Correct answer.
  3. A description of the contractor's safety awards program
  4. A list of all past mishaps involving similar systems

Explanation

Effective SSPPs include a mechanism for flowing down safety requirements to subcontractors and suppliers so that lower-tier contributors meet the same safety standards. Without a defined flow-down clause or procedure, safety obligations can be lost at subcontract interfaces.

Question 33System Safety Program Planning and Management

A program manager wants to establish a closed-loop hazard tracking system. Which practice best supports closure of a hazard?

  1. Recording the hazard in the log and assigning a risk level
  2. Reviewing the hazard at the next quarterly program review
  3. Verifying that the implemented mitigation reduces risk to an acceptable level and documenting the verification Correct answer.
  4. Transferring the hazard to the customer for acceptance

Explanation

Hazard closure requires objective evidence that the mitigation was implemented and that residual risk meets the acceptance criteria. Simply logging, transferring, or scheduling review of a hazard does not demonstrate that risk has actually been reduced and verified.

Question 34System Safety Program Planning and Management

During a system safety program review, a reviewer notes that the hazard log contains hazards with no assigned severity or probability. Which program management action is most appropriate?

  1. Remove the hazards from the log to reduce clutter
  2. Reopen the risk assessment process and assign severity and probability to each hazard Correct answer.
  3. Escalate the entire log to the customer without further action
  4. Close the hazards because they were not rated as high risk

Explanation

The risk assessment process requires that each hazard be evaluated for severity and probability so that risk can be prioritized and mitigated. Unrated hazards cannot be properly managed; the correct action is to complete the risk assessment rather than to close, delete, or merely escalate them.

Question 35System Safety Program Planning and Management

Which type of safety review is typically conducted early in the acquisition life cycle to examine the preliminary hazard analysis and the proposed safety approach?

  1. Critical design review (CDR)
  2. System requirements review (SRR) Correct answer.
  3. Physical configuration audit (PCA)
  4. Test readiness review (TRR)

Explanation

The system requirements review occurs early and examines whether the preliminary hazard analysis and safety requirements are adequately defined before design proceeds. CDR, TRR, and PCA occur later and focus on design maturity, test readiness, and configuration verification respectively.

Question 36System Safety Program Planning and Management

A system safety manager is developing a risk acceptance matrix. Which pair of factors is most commonly used to define risk levels in such a matrix?

  1. Frequency and duration
  2. Detection and exposure
  3. Severity and probability Correct answer.
  4. Cost and schedule

Explanation

Risk acceptance matrices in system safety typically combine hazard severity with probability of occurrence to determine a risk level and required acceptance authority. Cost, schedule, frequency, duration, detection, and exposure may inform analyses but are not the standard two dimensions of a risk matrix.

Question 37System Safety Program Planning and Management

Which document typically establishes the safety requirements and acceptance criteria that a system safety program plan must address?

  1. The program's risk management plan
  2. The system specification or contract requirements Correct answer.
  3. The training plan
  4. The contractor's quality assurance manual

Explanation

The system specification or contract requirements define the safety performance and acceptance criteria that the SSPP must satisfy. Other plans support program execution but do not establish the safety requirements baseline that the SSPP is written to address.

Question 38System Safety Program Planning and Management

A contractor's system safety program plan states that hazard analyses will be performed only after design is complete. What is the primary deficiency of this approach?

  1. It requires too many personnel to be assigned to safety
  2. It delays safety analysis until changes are most costly and least effective Correct answer.
  3. It prevents the use of qualitative analysis techniques
  4. It eliminates the need for a hazard tracking log

Explanation

System safety is most effective when hazard analyses are performed early and iteratively throughout design, when design changes can still influence safety. Waiting until design is complete means hazards are discovered when corrective changes are most expensive and disruptive.

Question 39System Safety Program Planning and Management

Which organization within a contractor's system safety program is typically responsible for approving the system safety program plan?

  1. The government program office or contracting authority Correct answer.
  2. The contracts department
  3. The facilities management office
  4. The human resources department

Explanation

The system safety program plan is normally submitted to and approved by the government program office or contracting authority to ensure it meets contractual safety requirements. Internal departments such as contracts, HR, and facilities do not have the authority to approve the safety program plan.

Question 40System Safety Program Planning and Management

A program is preparing for a major milestone review. The system safety manager must demonstrate that all identified hazards have been assessed and that residual risk is acceptable. Which artifact best provides this evidence?

  1. A hazard tracking log with closure evidence and risk acceptance records Correct answer.
  2. A signed statement from the program manager
  3. A list of safety meetings held during the phase
  4. A copy of the system safety program plan

Explanation

The hazard tracking log, supported by closure evidence and documented risk acceptance decisions, provides objective traceability from hazard identification through mitigation and acceptance. A signed statement, meeting list, or plan copy does not demonstrate that each hazard was assessed and closed.

Question 41System Safety Program Planning and Management

In system safety program management, what is the purpose of a safety review board?

  1. To manage the contractor's employee safety training records
  2. To review and adjudicate hazard risk acceptance and safety issues across the program Correct answer.
  3. To conduct independent cost estimates for safety equipment
  4. To perform configuration audits of safety-critical software

Explanation

A safety review board provides a cross-functional forum to review hazard analyses, adjudicate risk acceptance, and resolve safety issues that affect the program. Cost estimating, training records, and configuration audits are separate functions outside the board's primary purpose.

Question 42System Safety Program Planning and Management

A system safety program plan must define how safety data will be managed. Which practice best supports traceability of safety decisions throughout the program?

  1. Maintaining a centralized, configuration-controlled hazard tracking database Correct answer.
  2. Archiving safety data only at program completion
  3. Storing hazard analyses in individual engineers' local folders
  4. Recording safety decisions only in meeting minutes

Explanation

A centralized, configuration-controlled hazard tracking database provides a single authoritative source for hazard status, decisions, and closure evidence. Distributed local files, meeting minutes alone, or end-of-program archiving undermine traceability and configuration control.

Question 43System Safety Program Planning and Management

Which factor most directly determines the level of system safety effort and rigor required for a given program?

  1. The severity of potential consequences and the program's criticality category Correct answer.
  2. The length of the program schedule
  3. The location of the contractor's facility
  4. The number of engineers assigned to the safety team

Explanation

The required safety rigor is driven primarily by the severity of potential consequences and the program's criticality designation, which dictate the depth of analyses and review requirements. Staffing, schedule length, and facility location may affect execution but do not set the safety rigor baseline.

Question 44System Safety Program Planning and Management

A hazard is identified with a severity categorized as catastrophic and a probability categorized as frequent. According to typical risk acceptance principles, what action is generally required?

  1. Accept the risk without further action because the probability is known
  2. Document the hazard and continue design as planned
  3. Immediately mitigate or eliminate the hazard before proceeding Correct answer.
  4. Transfer the risk to the operator through a warning label

Explanation

A catastrophic severity combined with frequent probability represents an unacceptable risk that generally requires immediate mitigation or elimination before the program can proceed. Accepting, merely documenting, or relying solely on warnings does not satisfy the requirement to reduce such high risk.

Question 45System Safety Program Planning and Management

Which of the following best describes the role of the system safety working group in a program?

  1. It serves as the final authority for contract termination
  2. It provides technical review and coordination of safety analyses across integrated product teams Correct answer.
  3. It conducts all hazard analyses independently of the design teams
  4. It approves the program's budget and schedule

Explanation

The system safety working group is a technical forum that coordinates and reviews safety analyses across integrated product teams to ensure consistent hazard identification and mitigation. Budget approval, independent analysis of all hazards, and contract termination authority reside elsewhere.

Question 46System Safety Program Planning and Management

A program is transitioning from development to production. Which system safety activity is most important to ensure that safety-critical characteristics are preserved in the production articles?

  1. Revising the safety awards criteria
  2. Updating the preliminary hazard analysis
  3. Verifying that safety-critical manufacturing processes and inspections are defined and controlled Correct answer.
  4. Conducting a new system requirements review

Explanation

During the transition to production, the program must ensure that safety-critical characteristics are captured in manufacturing processes, inspections, and controls so that production articles retain the required safety performance. Updating early analyses, repeating requirements reviews, or revising awards criteria does not directly control production safety characteristics.

Question 47System Safety Program Planning and Management

Which metric best indicates the health of a system safety program's hazard management process?

  1. The number of safety meetings held per quarter
  2. The percentage of identified hazards with approved closure or documented risk acceptance Correct answer.
  3. The total number of pages in the safety program plan
  4. The number of safety personnel assigned to the program

Explanation

The proportion of hazards that have been closed with verified mitigation or formally accepted provides a direct measure of whether the hazard management process is functioning. Meeting counts, document length, and staffing levels are activity or resource measures that do not reflect hazard disposition.

Question 48System Safety Program Planning and Management

A system safety manager discovers that a hazard analysis was performed using outdated design data. What is the most appropriate corrective action?

  1. Annotate the analysis as historical and take no further action
  2. Accept the analysis because the hazard conclusions are likely unchanged
  3. Delete the analysis and rely on the next scheduled review
  4. Re-perform or update the analysis using the current design baseline and document the change Correct answer.

Explanation

Safety analyses must reflect the current design baseline; using outdated data can invalidate hazard identification and risk conclusions. The appropriate action is to re-perform or update the analysis against current data and document the revision through configuration control.

Question 49System Safety Program Planning and Management

In the context of system safety program planning, what is the primary purpose of a safety requirements verification matrix?

  1. To schedule safety training sessions
  2. To map each safety requirement to its verification method and status Correct answer.
  3. To track the cost of safety-related design changes
  4. To list the names of safety review board members

Explanation

A safety requirements verification matrix provides traceability by linking each safety requirement to the method and status of its verification. It does not track costs, list board members, or schedule training, which are separate management activities.

Question 50System Safety Program Planning and Management

A program's system safety program plan lacks a defined process for handling safety deviations and waivers. What risk does this create?

  1. Safety deviations may be approved without adequate hazard assessment and documentation Correct answer.
  2. The contractor will be required to hire additional safety engineers
  3. The program will be unable to perform any hazard analysis
  4. The program will automatically fail its next design review

Explanation

Without a defined deviation and waiver process, requests to depart from safety requirements may be approved without the hazard assessment and documentation needed to ensure risk remains acceptable. The absence of such a process does not prevent hazard analysis, dictate staffing, or automatically cause review failure.