I85PREP
⌘ K
PSP study materials
PSP study resources

PSP practice questions

One question at a time. Build your PSP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Physical Security Assessment

In a physical security risk assessment, which expression best represents risk?

  1. Threat + vulnerability + consequence
  2. Asset value ÷ countermeasure cost
  3. Likelihood ÷ consequence
  4. Threat × vulnerability × consequence Correct answer.

Explanation

Risk is commonly modeled as the product of threat, vulnerability, and consequence, so each factor scales the overall result. Additive models do not capture the multiplicative interaction among the factors. Ratios describe cost-benefit or relative measures rather than risk.

Question 2Physical Security Assessment

An asset has a single loss expectancy (SLE) of $50,000 and an annualized rate of occurrence (ARO) of 0.2. What is the annualized loss expectancy (ALE)?

  1. $10,000 Correct answer.
  2. $100,000
  3. $50,200
  4. $250,000

Explanation

ALE equals SLE multiplied by ARO, so $50,000 × 0.2 = $10,000. An ARO below 1 reduces the expected annual loss below the single-loss figure.

Question 3Physical Security Assessment

Windows overlooking a parking area allow employees to observe activity outside. Which CPTED principle does this illustrate?

  1. Territorial reinforcement
  2. Maintenance
  3. Natural surveillance Correct answer.
  4. Natural access control

Explanation

Natural surveillance increases the visibility of people and spaces, raising the perceived risk to an offender. Access control directs movement, territorial reinforcement expresses ownership, and maintenance concerns upkeep.

Question 4Physical Security Assessment

What is typically the first step in a physical security assessment?

  1. Conducting an adversarial penetration test
  2. Selecting and costing countermeasures
  3. Identifying assets and ranking criticality Correct answer.
  4. Drafting the final assessment report

Explanation

The assessment begins with understanding what must be protected and how important it is. Countermeasure selection, testing, and reporting follow from that foundation. Without asset identification, later analysis lacks a basis.

Question 5Physical Security Assessment

A design basis threat (DBT) is best described as...

  1. The insurance limit covering security-related losses
  2. A complete list of every adversary that could attack
  3. The threat a protection system is designed to defeat Correct answer.
  4. The maximum budget allocated to physical security

Explanation

A DBT defines the adversary characteristics, such as numbers, tactics, and capabilities, against which protection is designed. It sets a defensible performance target rather than a budget, exhaustive list, or insurance figure.

Question 6Physical Security Assessment

A physical security survey primarily...

  1. Certifies guards against a professional standard
  2. Tests the guard force's response time under stress
  3. Produces construction drawings for a new facility
  4. Records existing conditions and deficiencies Correct answer.

Explanation

A survey is a systematic inspection that records current safeguards, conditions, and gaps. It provides factual input to the risk assessment. Response testing, certification, and design are separate activities.

Question 7Physical Security Assessment

A risk matrix typically plots...

  1. Cost against schedule
  2. Likelihood against consequence Correct answer.
  3. Asset value against depreciation
  4. Threat against budget

Explanation

A risk matrix combines likelihood and consequence to assign a risk rating and prioritize treatment. Cost, schedule, budget, and depreciation are not the standard axes.

Question 8Physical Security Assessment

The principle of layered defense means...

  1. Relying on a single highly reliable barrier
  2. Relying primarily on a contract guard force
  3. Using multiple independent, complementary controls Correct answer.
  4. Concentrating all protection measures at the perimeter fence

Explanation

Layered defense places diverse controls at the perimeter, building envelope, interior, and asset level so that failure of one does not defeat the system. Independence and diversity matter more than a single strong element.

Question 9Physical Security Assessment

An asset valued at $400,000 has an exposure factor of 25% and an ARO of 0.5. What is the ALE?

  1. $50,000 Correct answer.
  2. $100,000
  3. $25,000
  4. $200,000

Explanation

SLE equals asset value times exposure factor, so $400,000 × 0.25 = $100,000. ALE equals SLE times ARO, so $100,000 × 0.5 = $50,000.

Question 10Physical Security Assessment

A loading dock door is routinely propped open by employees. In risk terms, this is best classified as...

  1. A vulnerability Correct answer.
  2. A consequence
  3. A threat
  4. A countermeasure

Explanation

A vulnerability is a weakness or condition that can be exploited, and a propped door is a control failure. The threat is the adversary or event, while consequence is the impact if the weakness is exploited.

Question 11Physical Security Assessment

Which factor most directly determines an asset's criticality ranking?

  1. The age of the facility and the year it was last renovated
  2. The number of employees assigned to the building that houses it
  3. The asset's original purchase price recorded in the fixed-asset register
  4. The mission impact if the asset is lost or compromised Correct answer.

Explanation

Criticality reflects the business or mission consequence of loss, compromise, or unavailability, not book value or headcount. It drives prioritization and the allocation of protection resources.

Question 12Physical Security Assessment

A countermeasure costs $120,000 and is expected to reduce annualized loss by $40,000. What is the simple payback period?

  1. 3 years Correct answer.
  2. 0.33 years
  3. 12 years
  4. 4 years

Explanation

Payback equals cost divided by annual benefit, so $120,000 ÷ $40,000 = 3 years. Simple payback is a screening tool and ignores the time value of money.

Question 13Physical Security Assessment

A gap analysis in physical security compares...

  1. Guard wage rates against published industry averages
  2. The number of cameras against the number of doors
  3. Insurance premiums against the organization's loss history
  4. Current protection against a required standard Correct answer.

Explanation

Gap analysis identifies differences between the existing protection posture and the applicable standard, regulation, or target profile. It produces a deficiency list that feeds risk treatment.

Question 14Physical Security Assessment

Maximum tolerable downtime (MTD) is best described as...

  1. The time required to install a new access control system
  2. The average interval between recorded security incidents at a site
  3. The time a guard force needs to respond to an alarm activation
  4. The longest outage a process can absorb before serious harm Correct answer.

Explanation

MTD comes from business impact analysis and sets the upper bound that recovery time objectives must meet. It is expressed in time and tied to unacceptable business harm.

Question 15Physical Security Assessment

Bollards, landscaping, and a single controlled entry point that guide visitors to reception illustrate...

  1. Natural surveillance and sightlines
  2. Natural access control Correct answer.
  3. Territorial reinforcement and ownership cues
  4. Target hardening of the perimeter

Explanation

Natural access control uses physical design to direct movement and reduce access to vulnerable areas. It is distinct from surveillance, which concerns visibility, and territorial reinforcement, which signals ownership.

Question 16Physical Security Assessment

Which information is most relevant when characterizing a site during a physical security assessment?

  1. The chief executive's published travel itinerary
  2. Topography, adjacent land use, and approach routes Correct answer.
  3. The organization's annual marketing plan and brand strategy
  4. Employee salary bands and compensation benchmarks

Explanation

Site characterization covers terrain, surrounding land uses, sightlines, and access routes that shape threat and vulnerability. These physical factors directly affect detection, delay, and response.

Question 17Physical Security Assessment

Security benchmarking is best used to...

  1. Replace a site-specific risk assessment
  2. Test whether intrusion sensors detect an intruder
  3. Compare practices and performance against peers Correct answer.
  4. Determine the organization's insurance premiums

Explanation

Benchmarking provides an external reference point for practices and performance. It informs, but does not replace, a site-specific risk assessment.

Question 18Physical Security Assessment

Which source is most useful for developing a site-specific threat assessment?

  1. Local crime statistics and incident data Correct answer.
  2. The building's HVAC specifications
  3. The facility's utility bills
  4. The organization's organizational chart

Explanation

Threat assessment relies on information about adversaries and events, such as local crime trends, prior incidents, and intelligence. Utilities, org charts, and HVAC data do not describe the threat.

Question 19Physical Security Assessment

After risk is assessed, the generally preferred order for treating risk is to...

  1. Avoid, reduce, transfer, accept Correct answer.
  2. Accept, ignore, transfer, reduce
  3. Reduce, ignore, avoid, transfer
  4. Transfer, avoid, accept, ignore

Explanation

Risk treatment generally seeks to avoid the risk first, then reduce it with controls, then transfer it, for example through insurance, and finally accept the residual. Acceptance is the fallback, not the starting point.

Question 20Physical Security Assessment

A qualitative risk assessment is most appropriate when...

  1. Actuarial data are available for underwriting
  2. Precise monetary loss estimates are required
  3. Reliable numeric loss data are unavailable Correct answer.
  4. Regulators demand exact ALE figures

Explanation

Qualitative methods use expert judgment and scaled ratings when numeric data are sparse or unreliable. Quantitative methods are preferred when credible loss and frequency data exist.

Question 21Physical Security Assessment

A key limitation of a purely quantitative risk assessment is that...

  1. It may convey false precision with sparse data Correct answer.
  2. It cannot produce a prioritized ranking of risks for management
  3. It cannot incorporate asset values into the calculation
  4. It forbids the use of structured expert judgment

Explanation

Quantitative outputs look precise even when likelihood and loss inputs are estimates. That appearance of precision can mislead decision-makers, so sensitivity analysis and qualitative context are important.

Question 22Physical Security Assessment

For a facility that depends on an off-site data center and municipal power, the assessor should...

  1. Map dependencies and single points of failure Correct answer.
  2. Assume that municipal utilities are always reliable
  3. Exclude all third-party sites from the assessment scope
  4. Limit the assessment to the facility perimeter

Explanation

Dependencies on utilities and third parties can create single points of failure outside the fence line. A complete assessment maps these dependencies and considers cascading effects.

Question 23Physical Security Assessment

Residual risk is best defined as...

  1. The risk that cannot be measured or estimated
  2. The risk that has been transferred to an insurer
  3. The risk that exists before any controls are applied
  4. The risk left after countermeasures are applied Correct answer.

Explanation

Residual risk is what remains once controls are in place, and it must be compared with the organization's risk tolerance. Inherent risk is the pre-control level.

Question 24Physical Security Assessment

A design basis threat should be reviewed and updated when...

  1. Threats, criticality, or design change materially Correct answer.
  2. Only when the security budget increases in a fiscal year
  3. Only at the end of a guard services contract term
  4. Only after a significant security incident has occurred

Explanation

The DBT is a living baseline; material changes in adversary capability, asset importance, or facility configuration can invalidate it. Periodic review is good practice even without a triggering event.

Question 25Physical Security Assessment

Which statement best distinguishes a security survey from a risk assessment?

  1. A survey documents conditions; risk assessment analyzes risk Correct answer.
  2. A completed survey eliminates the need for a separate risk assessment
  3. A risk assessment is performed only by insurance underwriters
  4. A survey is always quantitative, while a risk assessment is always qualitative

Explanation

A survey is an inspection that records existing conditions, while a risk assessment interprets those findings to estimate and rank risk. They are complementary rather than substitutes.

Question 26Physical Security Assessment

In physical security, a vulnerability assessment is best described as:

  1. a schedule for routine maintenance of security equipment
  2. a complete inventory of every asset and its replacement cost
  3. a count of security incidents from the previous year
  4. a process for identifying exploitable weaknesses Correct answer.

Explanation

A vulnerability assessment identifies weaknesses in physical, procedural, and organizational controls that a threat could exploit. It builds on threat and asset information rather than replacing it. The output supports risk determination and countermeasure selection.

Question 27Physical Security Assessment

Which CPTED strategy is illustrated by positioning a reception desk so employees can see the main entrance?

  1. Natural surveillance Correct answer.
  2. Natural access control
  3. Territorial reinforcement
  4. Target hardening

Explanation

Natural surveillance increases the visibility of people and areas so that intruders are more likely to be seen. A reception desk with a clear view of the entrance supports this strategy. The other options describe different CPTED principles.

Question 28Physical Security Assessment

Which activity establishes the foundation for determining which assets require protection?

  1. Testing the backup generator monthly
  2. Inventorying and valuing the assets Correct answer.
  3. Calculating payback for CCTV cameras
  4. Reviewing the alarm response plan

Explanation

Protection decisions follow from knowing what assets exist and what they are worth. Inventory and valuation establish that foundation for criticality and risk analysis. Alarm review, CCTV payback, and generator testing are later or supporting activities.

Question 29Physical Security Assessment

Purchasing an insurance policy to cover losses from a burglary is an example of:

  1. Risk avoidance
  2. Risk mitigation
  3. Risk acceptance
  4. Risk transfer Correct answer.

Explanation

Risk transfer shifts the financial consequence of a loss to another party, commonly through insurance. The underlying risk still exists, so transfer is not the same as reducing likelihood or impact. Avoidance would eliminate the activity; acceptance would retain the loss.

Question 30Physical Security Assessment

During a physical security assessment, a site walk-through is primarily used to:

  1. replace the need for interviews with staff
  2. determine the organization's annual insurance premiums
  3. calculate the annualized loss expectancy
  4. observe conditions and verify documented controls Correct answer.

Explanation

A walk-through lets the assessor directly observe physical conditions, employee behavior, and whether documented controls are actually implemented. It complements interviews and document review. It does not produce cost or loss figures by itself.

Question 31Physical Security Assessment

The primary purpose of a perimeter fence in a physical security program is to:

  1. eliminate the need for security officers
  2. define a boundary and delay entry Correct answer.
  3. replace interior intrusion detection sensors
  4. provide evidence for insurance claims

Explanation

A perimeter fence marks the protected boundary and creates delay for anyone attempting unauthorized entry. It supports detection and response but does not replace them. Interior sensors and officers remain part of a layered program.

Question 32Physical Security Assessment

Security lighting is most effective when it:

  1. provides uniform light across critical areas Correct answer.
  2. creates deep shadows along the fence line
  3. is left on continuously at maximum brightness
  4. illuminates only the tops of buildings

Explanation

Uniform lighting across critical areas reduces dark spots and glare that can hide activity or degrade camera images. It supports natural surveillance and detection. Excess or uneven lighting can create shadows or nuisance glare.

Question 33Physical Security Assessment

An effective key control program should include:

  1. documenting issuance and recovering keys Correct answer.
  2. keeping a single unsecured log at the front desk
  3. issuing master keys to all employees
  4. replacing locks only after a major incident

Explanation

Key control requires accountability: record who receives each key and recover it at separation or transfer. This limits unauthorized access. Unrestricted master keys and unsecured logs defeat the purpose.

Question 34Physical Security Assessment

An asset is valued at $250,000. A fire is expected to destroy 40% of its value. What is the single loss expectancy (SLE)?

  1. $250,000
  2. $150,000
  3. $40,000
  4. $100,000 Correct answer.

Explanation

SLE equals asset value multiplied by exposure factor: $250,000 × 0.40 = $100,000. It estimates the loss from a single event. ARO would be needed to annualize the figure.

Question 35Physical Security Assessment

If a particular loss event is expected to occur once every four years, the annualized rate of occurrence (ARO) is:

  1. 1.0
  2. 0.4
  3. 0.25 Correct answer.
  4. 4.0

Explanation

ARO is the expected number of loss events per year. One event every four years equals 1 ÷ 4 = 0.25 per year. ARO is separate from exposure factor and asset value.

Question 36Physical Security Assessment

Which statement best describes the relationship between a threat and a vulnerability?

  1. A vulnerability causes harm only when no threat exists.
  2. A threat is a weakness, and a vulnerability is an actor.
  3. A threat causes harm; a vulnerability is exploited. Correct answer.
  4. A threat and a vulnerability mean the same thing.

Explanation

A threat is a potential source or cause of harm, while a vulnerability is a weakness that a threat could exploit. Risk depends on the interaction of threat, vulnerability, and consequence. They are distinct concepts.

Question 37Physical Security Assessment

Consequence analysis in a physical security risk assessment focuses on:

  1. the cost of security guards
  2. the likelihood that a threat will occur
  3. the impact of a successful attack Correct answer.
  4. the number of cameras installed

Explanation

Consequence analysis estimates the harm that would result if a threat successfully exploits a vulnerability. It considers effects on people, operations, reputation, and finances. Likelihood is assessed separately.

Question 38Physical Security Assessment

Which method values an asset based on the cost to replace it with an equivalent item?

  1. Market share value
  2. Sentimental value
  3. Replacement cost Correct answer.
  4. Book value

Explanation

Replacement cost estimates what it would cost to obtain an equivalent asset. It is commonly used when the goal is to restore capability after loss. Book value reflects accounting depreciation, not replacement.

Question 39Physical Security Assessment

A scenario-based physical security assessment is most useful for:

  1. measuring employee satisfaction with security
  2. producing a complete inventory of every asset
  3. evaluating how specific threats could succeed Correct answer.
  4. determining the facility's real estate value

Explanation

Scenario-based assessment examines specific threat paths and asks whether existing controls can detect, delay, or defeat them. This reveals site-specific weaknesses. It does not replace asset inventory or general surveys.

Question 40Physical Security Assessment

An assessment reveals that the entire site depends on one municipal power feed with no backup. This is best described as:

  1. a residual risk
  2. a single point of failure Correct answer.
  3. a design basis threat definition
  4. a layered defense strategy

Explanation

A single point of failure is one component whose failure or compromise disables the entire system. One power feed without backup fits that definition. Layered defense uses redundancy to avoid this condition.

Question 41Physical Security Assessment

The purpose of alarm assessment is to:

  1. identify the root cause of each alarm
  2. determine whether an alarm is real Correct answer.
  3. replace the need for a response force
  4. reduce the number of sensors required

Explanation

Alarm assessment determines whether a sensor activation is a genuine security event or a nuisance alarm. It may use video, officers, or other verification. Assessment supports efficient response but does not replace the response force.

Question 42Physical Security Assessment

Which document is most useful for understanding intended access control procedures at a site?

  1. The annual financial report
  2. Access control policy and post orders Correct answer.
  3. The building's architectural style guide
  4. The organization's marketing brochure

Explanation

Access control policy and post orders state who is authorized, where, and under what procedures. They are the primary documents for comparing intended access control with practice. Other documents are unrelated to security procedures.

Question 43Physical Security Assessment

In a layered physical security design, the layer closest to the protected asset is generally:

  1. the perimeter fence line
  2. the employee parking lot
  3. the public street outside the gate
  4. the asset and its container Correct answer.

Explanation

Layers of defense progress from the outer perimeter toward the protected asset. The innermost layer is the asset itself or its immediate container. Outer layers provide delay and detection before an adversary reaches it.

Question 44Physical Security Assessment

An organization decides to accept a risk because the cost of the countermeasure exceeds the potential loss. This decision should be:

  1. made without documentation to avoid liability
  2. documented with rationale and approval Correct answer.
  3. delegated to the security guard force
  4. reviewed only after an incident occurs

Explanation

Accepting risk is a management decision that should be documented with the rationale and approved at the appropriate authority. Documentation supports accountability and periodic review. Informal acceptance creates unmanaged exposure.

Question 45Physical Security Assessment

Which activity best verifies that an installed intrusion detection system performs as intended?

  1. Interviewing the sales representative
  2. Conducting controlled penetration tests Correct answer.
  3. Counting the number of sensors
  4. Reviewing the manufacturer's datasheet

Explanation

Performance is verified by testing the system under realistic conditions, such as controlled penetration attempts and response drills. These reveal detection, assessment, and response gaps. Manufacturer data and sensor counts show design intent, not actual performance.

Question 46Physical Security Assessment

In physical security design, barrier delay time should be compared with:

  1. the facility's cleaning schedule
  2. the response force's deployment time Correct answer.
  3. the installed cost of the barrier material
  4. the number of employees on site

Explanation

Barrier delay must be long enough for the response force to arrive and intervene. Comparing delay time with deployment time shows whether the barrier provides meaningful protection. Cost and staffing affect selection but not this timing relationship.

Question 47Physical Security Assessment

A purely checklist-based physical security assessment is most likely to:

  1. produce quantitative loss estimates automatically
  2. miss site-specific vulnerabilities not listed Correct answer.
  3. guarantee that all site-specific threats are addressed
  4. eliminate the need for professional judgment

Explanation

Checklists promote consistency but are limited to the items listed, so they can miss site-specific vulnerabilities. They do not replace professional judgment or tailored analysis. A combined approach is stronger.

Question 48Physical Security Assessment

Which control is most directly aimed at reducing the risk of an insider threat during the hiring process?

  1. Increasing fence height
  2. Pre-employment screening Correct answer.
  3. Adding parking lot cameras
  4. Installing exterior lighting

Explanation

Insider risk is reduced through personnel controls, including pre-employment screening, ongoing vetting, and termination procedures. Screening helps identify candidates who may pose a risk. Exterior lighting, fences, and parking cameras address external threats.

Question 49Physical Security Assessment

After completing a physical security assessment, recommendations should generally be prioritized by:

  1. the personal preference of the assessor
  2. the vendor's latest marketing materials
  3. risk reduction versus cost Correct answer.
  4. the alphabetical order of control names

Explanation

Recommendations should be prioritized by how much risk they reduce relative to cost and asset criticality. This helps management allocate limited resources. Alphabetical order or personal preference is not a risk-based method.

Question 50Physical Security Assessment

Which metric best indicates whether a physical security program is achieving its intended outcome?

  1. The number of years since the last equipment upgrade
  2. The number of pages in the written security policy
  3. The total number of security cameras purchased
  4. Detection, assessment, and response rates Correct answer.

Explanation

Outcome metrics measure whether the program detects, assesses, and responds to intrusions effectively. Input counts such as cameras purchased or policy pages do not show performance. Effective metrics support continuous improvement.