BDOC NSS Examination Questions And Answers
Verified Solutions Latest Update
Base Defense Operations Center
Naval Security Standards
Table of Contents
Abstract
Table of Contents
Section 1: Exam Instructions
Section 2: Domain 1 — Force Protection & Antiterrorism Standards (Questions 1–12)
Section 3: Domain 2 — Physical Security & Asset Protection (Questions 13–23)
Section 4: Domain 3 — Emergency Response & Crisis Management (Questions 24–34)
Section 5: Domain 4 — Legal Authorities & Use of Force (Questions 35–45)
Section 6: Domain 5 — Surveillance Detection & Counterintelligence Basics (Questions 46–55)
Section 7: Domain 6 — Communication & Reporting Procedures (Questions 56–65)
Section 8: Domain 7 — Personnel Security & Vetting Processes (Questions 66–75)
Section 9: Domain 8 — Operational Security (OPSEC) & Information Assurance (Questions 76–85)
Section 10: Domain 9 — Ethics & Professional Conduct in Security Operations (Questions 86–93)
Section 11: Domain 10 — Scenario-Based Application (Questions 94–100)
Section 12: Answer Key
1
, Section 2: Domain 1: Force Protection & Antiterrorism Standards
Questions 1–12
1. Which FPCON level applies when a general threat of possible terrorist activity exists
and the nature and extent of the threat are unpredictable?
A. FPCON NORMAL
B. FPCON ALPHA
C. FPCON BRAVO
D. FPCON CHARLIE
Correct Answer: B - FPCON ALPHA
Rationale: FPCON ALPHA is declared when there is a general threat of possible terrorist activity
against personnel and facilities, but the nature and extent of the threat are unpredictable. FPCON
NORMAL is the default state with no specific threat, FPCON BRAVO indicates an increased and more
predictable threat, and FPCON CHARLIE applies when an incident occurs or intelligence indicates
that some form of terrorist action is likely. ALPHA requires increased security awareness but not the
full measures of higher levels.
2. Under FPCON DELTA, which of the following actions is mandatory for all personnel
on a naval installation?
A. Continue normal duties with increased awareness
B. Remain within secure areas and restrict all movement
C. Report to the visitor control center for identification verification
D. Conduct routine perimeter patrols at standard intervals
Correct Answer: B - Remain within secure areas and restrict all movement
Rationale: FPCON DELTA is the highest force protection condition, declared when a terrorist attack
has occurred or intelligence indicates that an attack against a specific location is imminent. At this
level, all personnel must remain within secure areas and movement is restricted to essential
activities only. Normal duties are suspended, routine patrols are increased beyond standard
intervals, and the visitor control center would likely be closed to non-essential visitors. The severity
of DELTA demands maximum protective measures.
3. According to DoD Antiterrorism program requirements, all personnel must complete
AT Level I training at what minimum frequency?
A. Annually
B. Every two years
C. Every three years
D. Only upon initial assignment
Correct Answer: A - Annually
Rationale: DoD Instruction 2000.16 mandates that all DoD personnel, including military, civilians,
and contractors, must complete Antiterrorism Level I awareness training annually. This annual
requirement ensures personnel maintain current knowledge of threat indicators, reporting
procedures, and protective measures. One-time training upon initial assignment is insufficient
because the threat environment evolves continuously, and refresher training is critical for
maintaining vigilance and awareness of new tactics and procedures.
4. When encountering an active shooter situation, the recommended response protocol
follows which sequence?
A. Hide, Run, Fight
B. Run, Hide, Fight
2
,C. Fight, Run, Hide
D. Run, Fight, Hide
Correct Answer: B - Run, Hide, Fight
Rationale: The Department of Homeland Security and DoD adopted the Run, Hide, Fight protocol
for active shooter situations. The first priority is to evacuate (Run) if a safe path is available. If
evacuation is not possible, the second option is to find a secure location and barricade (Hide). As a
last resort, when confronted directly and no other option exists, individuals should attempt to
incapacitate the shooter (Fight). This ordered sequence maximizes survival chances by prioritizing
avoidance over confrontation.
5. What is the primary purpose of a Random Antiterrorism Measure (RAM)?
A. To replace FPCON measures during periods of reduced threat
B. To increase the uncertainty for potential adversaries regarding security postures
C. To reduce the cost of implementing force protection measures
D. To provide training exercises for security personnel
Correct Answer: B - To increase the uncertainty for potential adversaries regarding
security postures
Rationale: Random Antiterrorism Measures are designed to introduce unpredictability into the
security posture of an installation, making it more difficult for adversaries to plan attacks based on
observed patterns. RAMs are not replacements for FPCON measures but supplements to them, and
their purpose is not cost reduction or training. By varying security procedures at irregular intervals,
potential attackers cannot reliably predict when specific vulnerabilities might exist, thereby
enhancing overall force protection effectiveness.
6. Which FPCON level requires the implementation of a 100 percent identification check
of all personnel entering an installation?
A. FPCON ALPHA
B. FPCON BRAVO
C. FPCON CHARLIE
D. FPCON DELTA
Correct Answer: B - FPCON BRAVO
Rationale: FPCON BRAVO requires increased security measures including 100 percent identification
checks for all personnel entering the installation. While FPCON ALPHA increases awareness and
spot checks, BRAVO mandates thorough ID verification for every individual. FPCON CHARLIE and
DELTA impose even stricter access controls, but the 100 percent ID check requirement is specifically
associated with BRAVO as a standard measure. At CHARLIE and DELTA, access may be further
restricted to essential personnel only.
7. After a terrorist incident on a naval installation, which report must be submitted to
document the event and lessons learned?
A. OPREP-3
B. SIR (Serious Incident Report)
C. After-Action Report (AAR)
D. Both B and C
Correct Answer: D - Both B and C
Rationale: Following a terrorist incident, both a Serious Incident Report (SIR) and an After-Action
Report (AAR) are required. The SIR provides immediate notification through the chain of command
about the incident, while the AAR is a comprehensive review conducted after the event that
documents what happened, what was done correctly, what needs improvement, and
recommendations for future operations. OPREP-3 is a specific operational reporting format used for
significant events but is not the only required report. The combination of immediate reporting and
thorough post-incident analysis ensures both situational awareness and organizational learning.
8. Under the DoD AT program, what is the role of the Force Protection Officer (FPO)?
3
, A. To serve as the installation's primary law enforcement investigator
B. To coordinate and implement force protection measures and advise the commander on AT issues
C. To conduct offensive counterterrorism operations off-installation
D. To manage the installation's financial budget for security programs
Correct Answer: B - To coordinate and implement force protection measures and advise
the commander on AT issues
Rationale: The Force Protection Officer serves as the commander's principal advisor on
antiterrorism and force protection matters. The FPO is responsible for coordinating the
implementation of FPCON measures, developing the installation AT plan, conducting vulnerability
assessments, and ensuring AT training is accomplished. The FPO does not serve as a law
enforcement investigator, conduct offensive operations, or manage financial budgets. The role is
fundamentally about coordination, planning, and advising to protect personnel and assets.
9. Which of the following is considered a high-risk terrorist target according to DoD
guidance?
A. Morale, Welfare, and Recreation facilities
B. Commissary buildings during peak hours
C. Population concentration points such as arrival/departure areas
D. All of the above
Correct Answer: D - All of the above
Rationale: DoD antiterrorism guidance identifies multiple categories of high-risk targets, including
MWR facilities where large numbers of personnel gather, commissary buildings especially during
peak usage, and population concentration points such as arrival and departure areas, gates, and
assembly points. Terrorists seek to maximize casualties and media impact, making any location
where personnel congregate a potential target. Recognizing these as high-risk areas enables security
planners to allocate resources and implement protective measures proportionate to the vulnerability
of each location.
10. What does the acronym 'THREATCON' refer to in legacy DoD terminology?
A. Threat Condition — a graduated system of alert postures
B. Threat Conference — a meeting to discuss intelligence
C. Threat Control — the process of neutralizing threats
D. Threat Construction — building defensive structures
Correct Answer: A - Threat Condition — a graduated system of alert postures
Rationale: THREATCON was the legacy term (pre-2001) for what is now called FPCON (Force
Protection Condition). It referred to a graduated system of alert postures used to standardize the
military's response to terrorist threats. The term was replaced by FPCON to provide clearer
terminology and more detailed implementation guidance. THREATCON did not refer to conferences,
control processes, or construction activities. Understanding the legacy term is important when
reviewing older doctrine and historical documents related to force protection.
11. When a suspicious unattended package is discovered at a naval facility, what is the
first action security personnel should take?
A. Pick up and move the package to a safe location
B. Open the package to determine its contents
C. Isolate the area and do not touch or approach the package
D. Spray the package with water to neutralize potential threats
Correct Answer: C - Isolate the area and do not touch or approach the package
Rationale: The first and most critical action when a suspicious unattended package is discovered is
to isolate the area and avoid touching or approaching the item. Moving the package could detonate
an explosive device, opening it could trigger a detonation mechanism, and spraying water is not a
recognized bomb disposal technique. The correct procedure is to establish a perimeter at a safe
distance, prevent others from entering the area, and immediately notify Explosive Ordnance
Disposal (EOD) personnel and the chain of command for professional assessment and disposition.
4
Verified Solutions Latest Update
Base Defense Operations Center
Naval Security Standards
Table of Contents
Abstract
Table of Contents
Section 1: Exam Instructions
Section 2: Domain 1 — Force Protection & Antiterrorism Standards (Questions 1–12)
Section 3: Domain 2 — Physical Security & Asset Protection (Questions 13–23)
Section 4: Domain 3 — Emergency Response & Crisis Management (Questions 24–34)
Section 5: Domain 4 — Legal Authorities & Use of Force (Questions 35–45)
Section 6: Domain 5 — Surveillance Detection & Counterintelligence Basics (Questions 46–55)
Section 7: Domain 6 — Communication & Reporting Procedures (Questions 56–65)
Section 8: Domain 7 — Personnel Security & Vetting Processes (Questions 66–75)
Section 9: Domain 8 — Operational Security (OPSEC) & Information Assurance (Questions 76–85)
Section 10: Domain 9 — Ethics & Professional Conduct in Security Operations (Questions 86–93)
Section 11: Domain 10 — Scenario-Based Application (Questions 94–100)
Section 12: Answer Key
1
, Section 2: Domain 1: Force Protection & Antiterrorism Standards
Questions 1–12
1. Which FPCON level applies when a general threat of possible terrorist activity exists
and the nature and extent of the threat are unpredictable?
A. FPCON NORMAL
B. FPCON ALPHA
C. FPCON BRAVO
D. FPCON CHARLIE
Correct Answer: B - FPCON ALPHA
Rationale: FPCON ALPHA is declared when there is a general threat of possible terrorist activity
against personnel and facilities, but the nature and extent of the threat are unpredictable. FPCON
NORMAL is the default state with no specific threat, FPCON BRAVO indicates an increased and more
predictable threat, and FPCON CHARLIE applies when an incident occurs or intelligence indicates
that some form of terrorist action is likely. ALPHA requires increased security awareness but not the
full measures of higher levels.
2. Under FPCON DELTA, which of the following actions is mandatory for all personnel
on a naval installation?
A. Continue normal duties with increased awareness
B. Remain within secure areas and restrict all movement
C. Report to the visitor control center for identification verification
D. Conduct routine perimeter patrols at standard intervals
Correct Answer: B - Remain within secure areas and restrict all movement
Rationale: FPCON DELTA is the highest force protection condition, declared when a terrorist attack
has occurred or intelligence indicates that an attack against a specific location is imminent. At this
level, all personnel must remain within secure areas and movement is restricted to essential
activities only. Normal duties are suspended, routine patrols are increased beyond standard
intervals, and the visitor control center would likely be closed to non-essential visitors. The severity
of DELTA demands maximum protective measures.
3. According to DoD Antiterrorism program requirements, all personnel must complete
AT Level I training at what minimum frequency?
A. Annually
B. Every two years
C. Every three years
D. Only upon initial assignment
Correct Answer: A - Annually
Rationale: DoD Instruction 2000.16 mandates that all DoD personnel, including military, civilians,
and contractors, must complete Antiterrorism Level I awareness training annually. This annual
requirement ensures personnel maintain current knowledge of threat indicators, reporting
procedures, and protective measures. One-time training upon initial assignment is insufficient
because the threat environment evolves continuously, and refresher training is critical for
maintaining vigilance and awareness of new tactics and procedures.
4. When encountering an active shooter situation, the recommended response protocol
follows which sequence?
A. Hide, Run, Fight
B. Run, Hide, Fight
2
,C. Fight, Run, Hide
D. Run, Fight, Hide
Correct Answer: B - Run, Hide, Fight
Rationale: The Department of Homeland Security and DoD adopted the Run, Hide, Fight protocol
for active shooter situations. The first priority is to evacuate (Run) if a safe path is available. If
evacuation is not possible, the second option is to find a secure location and barricade (Hide). As a
last resort, when confronted directly and no other option exists, individuals should attempt to
incapacitate the shooter (Fight). This ordered sequence maximizes survival chances by prioritizing
avoidance over confrontation.
5. What is the primary purpose of a Random Antiterrorism Measure (RAM)?
A. To replace FPCON measures during periods of reduced threat
B. To increase the uncertainty for potential adversaries regarding security postures
C. To reduce the cost of implementing force protection measures
D. To provide training exercises for security personnel
Correct Answer: B - To increase the uncertainty for potential adversaries regarding
security postures
Rationale: Random Antiterrorism Measures are designed to introduce unpredictability into the
security posture of an installation, making it more difficult for adversaries to plan attacks based on
observed patterns. RAMs are not replacements for FPCON measures but supplements to them, and
their purpose is not cost reduction or training. By varying security procedures at irregular intervals,
potential attackers cannot reliably predict when specific vulnerabilities might exist, thereby
enhancing overall force protection effectiveness.
6. Which FPCON level requires the implementation of a 100 percent identification check
of all personnel entering an installation?
A. FPCON ALPHA
B. FPCON BRAVO
C. FPCON CHARLIE
D. FPCON DELTA
Correct Answer: B - FPCON BRAVO
Rationale: FPCON BRAVO requires increased security measures including 100 percent identification
checks for all personnel entering the installation. While FPCON ALPHA increases awareness and
spot checks, BRAVO mandates thorough ID verification for every individual. FPCON CHARLIE and
DELTA impose even stricter access controls, but the 100 percent ID check requirement is specifically
associated with BRAVO as a standard measure. At CHARLIE and DELTA, access may be further
restricted to essential personnel only.
7. After a terrorist incident on a naval installation, which report must be submitted to
document the event and lessons learned?
A. OPREP-3
B. SIR (Serious Incident Report)
C. After-Action Report (AAR)
D. Both B and C
Correct Answer: D - Both B and C
Rationale: Following a terrorist incident, both a Serious Incident Report (SIR) and an After-Action
Report (AAR) are required. The SIR provides immediate notification through the chain of command
about the incident, while the AAR is a comprehensive review conducted after the event that
documents what happened, what was done correctly, what needs improvement, and
recommendations for future operations. OPREP-3 is a specific operational reporting format used for
significant events but is not the only required report. The combination of immediate reporting and
thorough post-incident analysis ensures both situational awareness and organizational learning.
8. Under the DoD AT program, what is the role of the Force Protection Officer (FPO)?
3
, A. To serve as the installation's primary law enforcement investigator
B. To coordinate and implement force protection measures and advise the commander on AT issues
C. To conduct offensive counterterrorism operations off-installation
D. To manage the installation's financial budget for security programs
Correct Answer: B - To coordinate and implement force protection measures and advise
the commander on AT issues
Rationale: The Force Protection Officer serves as the commander's principal advisor on
antiterrorism and force protection matters. The FPO is responsible for coordinating the
implementation of FPCON measures, developing the installation AT plan, conducting vulnerability
assessments, and ensuring AT training is accomplished. The FPO does not serve as a law
enforcement investigator, conduct offensive operations, or manage financial budgets. The role is
fundamentally about coordination, planning, and advising to protect personnel and assets.
9. Which of the following is considered a high-risk terrorist target according to DoD
guidance?
A. Morale, Welfare, and Recreation facilities
B. Commissary buildings during peak hours
C. Population concentration points such as arrival/departure areas
D. All of the above
Correct Answer: D - All of the above
Rationale: DoD antiterrorism guidance identifies multiple categories of high-risk targets, including
MWR facilities where large numbers of personnel gather, commissary buildings especially during
peak usage, and population concentration points such as arrival and departure areas, gates, and
assembly points. Terrorists seek to maximize casualties and media impact, making any location
where personnel congregate a potential target. Recognizing these as high-risk areas enables security
planners to allocate resources and implement protective measures proportionate to the vulnerability
of each location.
10. What does the acronym 'THREATCON' refer to in legacy DoD terminology?
A. Threat Condition — a graduated system of alert postures
B. Threat Conference — a meeting to discuss intelligence
C. Threat Control — the process of neutralizing threats
D. Threat Construction — building defensive structures
Correct Answer: A - Threat Condition — a graduated system of alert postures
Rationale: THREATCON was the legacy term (pre-2001) for what is now called FPCON (Force
Protection Condition). It referred to a graduated system of alert postures used to standardize the
military's response to terrorist threats. The term was replaced by FPCON to provide clearer
terminology and more detailed implementation guidance. THREATCON did not refer to conferences,
control processes, or construction activities. Understanding the legacy term is important when
reviewing older doctrine and historical documents related to force protection.
11. When a suspicious unattended package is discovered at a naval facility, what is the
first action security personnel should take?
A. Pick up and move the package to a safe location
B. Open the package to determine its contents
C. Isolate the area and do not touch or approach the package
D. Spray the package with water to neutralize potential threats
Correct Answer: C - Isolate the area and do not touch or approach the package
Rationale: The first and most critical action when a suspicious unattended package is discovered is
to isolate the area and avoid touching or approaching the item. Moving the package could detonate
an explosive device, opening it could trigger a detonation mechanism, and spraying water is not a
recognized bomb disposal technique. The correct procedure is to establish a perimeter at a safe
distance, prevent others from entering the area, and immediately notify Explosive Ordnance
Disposal (EOD) personnel and the chain of command for professional assessment and disposition.
4
