DCSA SPeD Physical Security Certification (PSC) Exam V1– Defense Counterintelligence and Security Agency (DCSA) SPeD Physical Security – 2026/2027 Edition – Verified Questions and Answers

DCSA SPeD Physical Security Certification (PSC) Exam V1– Defense Counterintelligence and Security Agency (DCSA) SPeD Physical Security – 2026/2027 Edition – Verified Questions and Answers What are some techniques used in performing a security survey? (6) Observing, Questioning, Analyzing, Verifying, Investigating, Evaluating. What is the requirements document? A major result of the planning phase, the requirements document identifies the main reasons for implementing new measures or upgrading older systems. What is the purpose of a security survey? Determine and document the current security posture, Identify deficiencies and excesses in existing security measures, Compare the current posture with a determination of the appropriate level of security, Recommend improvements in the overall situation. What are three common approaches to a physical security assessment? Outside-Inward approach, Inside-Outward approach, Functional approach. Which approach to physical security assessment occurs when an assessment team takes the role of perpetrator and begins outside the facility focusing on the successive layers of security? Outside-Inward approach. Which approach to physical security assessment occurs when an assessment team takes the role of defender and works its way from the asset out toward the outer perimeter? Inside-Outward approach. Which approach to physical security assessment occurs when an assessment team evaluates security functions and disciplines and collates the findings? Functional (Security Discipline) approach. What are five criteria of a good security survey report? Accuracy, Clarity, Conciseness, Timeliness, Slant or pitch. What are the objectives of physical access control? (6) Deter potential intruders, Distinguish authorized from unauthorized people, Delay and prevent intrusion attempts, Detect intrusions and monitor intruders, Trigger appropriate incident response by communicating to security officers and police, Deny by opposing or negating the effects of an overt or covert actions. What is an asset? Anything of tangible or intangible value (people, property, information) to the organization. What is risk analysis? A process for identifying asset values, and vulnerabilities to ascertain risks. How is an asset's critically determined? An asset's criticality is based on the mission and goals of the organization and how the company would recover in the event that the asset is no longer available. What are the three steps to identifying a company's assets? Define and understand the company's primary business functions and processes, Identify site and building infrastructure and systems, Identify the company's critical tangible and intangible assets. What two types of costs should be considered when valuing an asset? Direct costs and indirect costs. What are some factors to consider in valuing assets? Injuries or deaths related to facility damage, Asset replacement costs, Revenue loss due to lost functions, Availability of backups and system redundancy, Availability of replacements, Critical support agreements in place, Critical or sensitive information value, Impact on revenue and reputation. When determining asset values, what are some direct costs? Financial losses (including value of goods lost), Increased insurance premiums, Insurance deductibles, Lost business, Labor expenses incurred as a result of the event, Management time dealing with the event, Punitive damage awards not covered by insurance. When determine asset values, what are some indirect costs? Negative media coverage, Long-Term negative consumer perception, Public relations cost to overcome image problems, Lack of insurance coverage due to higher risk category, Higher wages needed to attract future employees, Shareholder suits for mismanagement, Poor employee morale leading to work stoppages and higher turnover. What is the first step in creating an asset protection program? Identifying the business's assets. What are two types of assets? Tangible and intangible. What are two ways assets can be valued? Assign a relative value, such as a number from 1 (low) to 5 (high), based on priority. Apply a cost-of-loss formula. What is the cost-of-loss formula to calculate an asset value? K= Cp+Ct+Cr+Ci - I K= total cost of loss Cp= Cost of permanent replacement Ct= Cost of temporary substitute Cr= Total related costs (remove old asset, install new etc.) Ci= Lost income cost I= available insurance or indemnity What are the two types of adversaries? An adversary who uses intrusion to gain access to the target asset and an adversary who plans to attack the site from outside without gaining entrance. What are two common physical security compliance metrics in the public sector? Compliance of facilities and compliance of systems. What are two objectives of collecting physical security program metrics? To provide assurance to the organization on the effectiveness of the program and to facilitate improvement. What is the commonly used to provide management with a snapshot of the effectiveness and efficiency of a physical security program? Metrics summary chart. What is the purpose of a business impact analysis (BIA)? To assess and prioritize organizational activities and the resources required to deliver products and services. What is the purpose of a business continuity management system (BCMS)? To enable an organization to identify, develop, and implement policies, objectives, capabilities, processes, and programs - taking into account legal and other requirements - to address disruptive events that might impact the organization and its stakeholders. What is considered the foundation for establishing business continuity objectives, targets, programs, and plans? The business impact analysis (BIA) and risk assessment. What are the three generic and interrelated management response steps that require preemptive planning and implementation in case of a disruptive incident? Emergency Response, Continuity, Recovery. What group of individuals are responsible for developing and implementing a comprehensive plan for responding to a disruptive incident? The crisis management team (CMT). It consists of a core group of decision makers trained in incident management and prepared to respond to an event. What is the term for activities, programs, and systems developed and implemented prior to an incident that may be used to support and enhance mitigation of, response to, and recovery from disruptions? Preparedness (readiness). What is a threat? An action or event that could result in a loss or an indication that such an action or event might take place. What is a loss event profile? A list of the kinds of threats affecting the assets to be safeguarded. What is a hazard? A source of potential danger or adverse condition. Hazards are generally associated with nature. Threats or loss risk events can fall into which three distinct categories? Crimes, Non criminal events such as man-made incidents or natural disasters, Consequential events caused by an enterprise's relationship with another organization. What are some examples of noncriminal threats? Natural threats or disasters: hurricanes, tornadoes, storms, etc. Man-made threats or disasters: labor strikes, airplane crashes, electrical power failures. What is a peripheral threat? A threat that is targeted at a neighboring facility but that may have a major impact on one's own operation. What is consequential event? An event that occurs because of a relationship between events or between two different organizations-the company suffers a loss as a consequence of that event or affiliation. How is the probability that a threat will occur decided? By considering the likelihood that a loss risk event may occur in the future. What are some factors that are used in determining the probability that a threat will occur? (6) Historical data at the site, The history of like events at similar companies, The makeup of the neighborhood and immediate vicinity, Overall geographical location, Political and social conditions, Changes in the economy. What is vulnerability? Any weakness that can be exploited by an aggressor (terrorist or criminal) or that makes an asset susceptible to damage from natural hazards or consequential events. What are some factors to consider in determining asset vulnerability? (7) Lack of redundancy or backups for critical systems, Single points of failure, Collocation of critical systems and organizations, Inadequate response capability to recover from attack, Ease of aggressor access to a facility, Inadequate security measures in place, Presence of hazardous materials, Potential for collateral damage from other companies in area. What is the difference between a threat and a vulnerability in terms of an organization? Vulnerabilities are something that the organization can control to some degree, whereas threats are outside the control of the organization. What is risk avoidance? Removing any opportunity for risk to cause a loss event. What are some factors of a social environment? Demographics, Crime Rates, Population characteristics. What are some examples of an inadvertent threat? Accidents, Errors, Omissions, Peripheral threats. Of the three types of threats (intentional, natural, and inadvertent), which is generally the most difficult to identify? Inadvertent threats. What is an all-hazards perspective? A balanced approach that looks at the big picture and identifies that in the context of risk, a hazard is a contributing factor to a peril. What are the three categories of threats? Intentional threats, Natural threats, Inadvertent threats. What metric measures time responsiveness of external dependencies in meeting a security department request? External dependency responsiveness. What are some factors to consider in designing a physical security system to deny access to adversaries? (5) Type of adversary, Amount of time the adversary requires getting to the assets inside, Number and type of detectors inside and out of the site, Delays that slow down the attack, Size, Strength, and equipage of the response force. The process of identifying threats and vulnerabilities, identifying the likelihood that an event will arise from such threats or vulnerabilities, defining critical functions for operations, defining controls to reduce exposure, and evaluating cost of controls is called what? Risk assessment. What is the goal of risk management? To manage loss effectively and at the least cost. Which analysis method does not use numbers, but instead uses comparative terms? Qualitative analysis. Which analysis method utilizes numeric measures to describe the value of assets or the level of threats, vulnerabilities, impact, or loss events? Quantitative analysis. Who should be involved in the quantitative risk analysis? A multidisciplinary team of subject matter experts. What is the SWOT analysis? A situational business analysis that involves strategic evaluation of key internal and external factors. What does SWOT stand for? Strengths, Weaknesses, Opportunities, Threats. In a SWOT analysis, what are the external factors? Opportunities and threats. In a SWOT analysis, what are the internal factors? Strengths and weaknesses. What is the annual loss expectancy? The product of the cost of incident impact and the frequency of occurrence. What are some state and local requirements that should be consider for projects? Code regulations, Guidelines or standards, Permitting requirements, Contractual requirements. What conditions affect the likelihood of occurence? Physical environment, Social environment, Political environment, Historical experience, Procedures and processes, Criminal capabilities. What data may be included in an incident management system? (4) Loss event history, Threat frequency analysis, Single and annual loss expectancy, Impact assessment. What tests of systems and procedures should be considered as part of a security survey? (4) Shipping and receiving, Alarms, Computer/server room security, General access controls. With whom should you be coordinating when performing security system and procedure tests during a security survey? The building owner or manager, and, if applicable, any outside agencies that may be involved. What is checked during a security survey test on shipping and recieving. Controls are checked by physical observation of selected shipments (incoming and outgoing) against bills of lading or inventory records. What is evaluated during a security survey test on alarms? The response and reaction of facility occupants and security officers. What is tested during a security survey test on a computer room or server room? The security and access controls of computer and data processing areas during both working and nonworking hours. How are general access controls tested during a security survey? Testers evaluate the ability to gain access to the facility and selected internal areas during working and nonworking hours. If access is achieved, they determine whether employees challenge the "intruders" after the fact. How should areas, items, and issues be evaluated during a security survey? In terms of appropriateness for the situation, age, interoperability, maintenance, interoperability, aesthetics, and consistency with current use of the space. What should be reviewed when assessing key and card security during a security survey? Accountability and policy, Record keeping and inventory, Recovery procedures (for keys), Change procedures when appropriate (turnover of key personnel, after a theft, etc.) What are some examples of openings (other than windows and doors) that should be assessed during a security survey? Manholes, Skylight, Roof hatches, Ventilator and air conditioning vents and shafts, Penthouses and penthouse/roof/veranda/access, Sidewalk grates. What should be examined when assessing the protection of utilities during a security survey? Location and physical protection, Access control, Backup/emergency sources, Protection of telecommunications and data lines. What is the first step in a risk assessment? Identification and valuation of assets. What are the Four D's of risk mitigation? Deter, Detect, Delay, Deny. What are the five avenues to address risk? Risk avoidance, Risk transfer, Risk spreading, Risk reduction, Risk acceptance. What are the tasks in selecting protective measures? Select countermeasures, Test recommended hardware, Implement solution, Train security staff. Which is the risk management avenue that involves removing any opportunity for risk to cause a loss event? Risk avoidance. Which is the risk management avenue that involves purchasing insurance? Risk transfer. Which is the risk management option involving reducing vulnerability? Risk reduction. Which is the risk management option when risk is virtually impossible to eliminate after considering all other risk management options have been implemented? Risk acceptance. Which is the risk management option where assets are placed in different locations? Risk spreading. What conditions tend to increase an asset's exposure to the risk of loss? (5) Physical environment, such as location; Social environment, including crime rate and demographics; Political environment, including government stability and law enforcement resources; Historical experience, such as previous events; Procedures and processes for using and protecting assets; Criminal capabilities. What are two common approaches to measure vulnerability? Observability and exploitability. The ability of an adversary to see and identify a vulnerability is known as what? Observability. The ability of the adversary to take advantage of the vulnerability is known as what? Exploitability. When is obervability reversed? In assessing natural threats. What sources can security professionals consult to learn about crime-related events that might affect their enterprise? (6) Local police crime statistics, U.S. Department of Justice Uniform Crime Reports, The enterprise's records of prior crime, Demographic and social data, Prior criminal and civil complaints brought against the company, Intelligence from local, state, or federal law enforcement agencies. The determination of the actual cost of a security program against the impact in terms of loss reduction, financial savings, acquisition, life cycle, replacement, or other measures is known as what? Cost-benefit analysis. A measure based on a reference that involves at least two points (for example, quantity over time) is known as what? Metrics. What are the technical criteria of the Security Metrics Evaluation Tool (security MET)? Reliability, Validity, Generalizability. What are the operational criteria of the Security Metrics Evaluation Tool (Security MET)? Cost, Timeliness, Manipulation. What are the strategic criteria of the Security Metrics Evaluation Tool (Security MET)? Return on investment (ROI), Organizational relevance, Communications. What are the evaluation criteria for the Security Metrics Evaluation Tool (Security MET). Technical criteria, Operational criteria, Strategic criteria. What are three major components of a physical security program? Systems, Personnel, Compliance. What are some common types of alarms on which data can be collected? (5) Forced door, Door held open, Unauthorized access attempts, User-defined actions or alarms, Communications failure. What are two measurable performance categories for personnel? Response and training. What is the first step in asset protection? Perform a threat and vulnerability analysis. What is one potential pitfall in choosing security technology? Inability to thoroughly evaluate product claims prior to installation. What is a primary challenge for security system designers, especially in public buildings? Balance the need for public access against ensuring public safety. Before you can conduct a risk analysis based on the impact and likelihood of an unwanted event happening, what steps in the risk management process must you take first? Identify (3) Identify assets Identify threats Identify vulnerabilities Which policy should you consult to find the physical security requirements of protecting classified information? DoDM 5200.01, Volumes 1-4 DoD Information Security Program At a minimum _________ should include special and general guard orders, access and material control, protective barriers, lighting systems, locks, and Intrusion Detection Systems (IDS). Physical Security Plans The basic manual access control system is simply? personal recognition. Although there are many different types of locks, they all share three components. Locking device Switching device Operating mechanism Some key-operated locks are built into the door or container they are securing. These are also known as Mortise locks, because their case is recessed, or mortised into a door or container. The __________________ is the most common of all door locks in use today. cylindrical lock What kind of locks are used for securing classified information? Electromechanical combination locks When a container is taken out of service, the combination must be reset back to the factory settings. The factory setting for a built-in container lock is? 50-25-50. You just received a security container that has the S&G 2740 Electromechanical Safe Lock with a factory setting of 50-25-50. What should you do first? Calibrate the lock Certification and accreditation (C&A) for Storage of Classified DoD Information Systems. A. DoD Manual 5100.76M governs the C&A for Storage of Classified DoD Information Systems. B. Designated Accrediting Authority (DAAs) have the authority and responsibility for accreditation decisions. B A. Physical security is the branch of security that is only concerned with active measures designed to prevent unauthorized access. B. Physical security aims to safeguard assets against espionage, sabotage, terrorism, damage, and criminal activity. B Which of the following is true of access control measures? Access control is integral and interoperable part of DoD installation physical security programs. The installation commander/facility director is responsible for defining access control measures consistent with DoD policy. Which of the following is NOT a physical security measure? Marking classified documents. Name 3 physical security measures? Perimeter Fences Security Guards Alarm Systems What does a physical security program aim to prevent unauthorized access to? (4) Personnel Equipment Installations Information What are considered access control measures? (3) Identification Cards Security Guards Locks and Keys List the nine capabilities a security system must provide to achieve Security-in-Depth? Deter Detect Identify Track Assess Record Communicate Delay Respond Describe the elements of a restricted area? An area (land, sea, or air) in which there are special restrictive measures employed to prevent or minimize incursions and/or interference, or where special security measures are employed to prevent unauthorized entry. Restricted areas must be authorized by the installation/activity commander/director, properly posted, and employ physical security measures. List three policies or regulations that govern the DoD physical security program? DoD 5200.08-Regulation Physical Security Program DoD Manual 5100.76 Physical Security of Sensitive Conventional Arms, Ammunition, and Explosives (AA&E) DoD Manual 5105.21 Sensitive Compartmented Information (SCI) Administrative Security Manual: Administration of Physical Security, Visitor Control, and Technical Security Describe the purpose of the 5200.08-R (Physical Security Program)? The regulation implements DoD policies and provides minimum standards for the physical protection of DoD personnel, installations, operations, and related resources. Define Security-in-Depth? A determination by the senior agency official that a facility's security program consists of layered and complimentary security controls sufficient to deter, detect, and document unauthorized entry and movement within the facility. List examples of Security-in-Depth? (5) Perimeter fence Employee/visitor access control Intrusion detection system Random guard patrols Closed circuit video monitoring List examples of physical security threats? (8) Foreign intelligence services Foreign military and paramilitary forces Terrorists Saboteurs Criminals Protest groups Disaffected persons Natural disasters What are some of the considerations a physical security professional should take into account for controlling access? (7) Escort qualifications, responsibilities, and authorizations Sponsorship qualifications, responsibilities, and authorizations Access privileges at each security level and each FPCON Mission-essential employee designation, if applicable Emergency response designation, if applicable Day and time designation for access Locations authorized for access What must occur for an individual to be provided access without an escort? The individual must have been identity proofed and favorably vetted in accordance with applicable regulations. At minimum, what should inspections of AA&E storage facilities include? (5) Review physical security measures and policy compliance Review existing deviations from policy Review suitability and screening of personnel with access to AA&E Review inventory and accountability procedures Facility design and construction Which federal specification defines the manufacturing requirements for armory vault doors and security vault doors? AA-D-600D-Door Vault Security What is the central and overriding objective for nuclear security? The denial of unauthorized access, as outlined in National Security Presidential Directive-28. What factors do DoD Components consider when determining security priority for weapons systems platforms? (6) Mission Location and vulnerability Operational readiness Value Classification Replacement costs Who must approve all Intrusion Detection Equipment (IDE) installed on Open Storage Areas? DoD Components approve Underwriters Laboratories' listed equipment. What reference governs the Certification and Accreditation (C&A) for storage of DoD collateral Classified Information Systems? DODM 5200.01, DoD Information Security Program, Volume 3, Protection of Classified Information. To whom should incidents involving stolen, lost, or recovered Arms, Ammunition, and Explosives (AA&E), which cause significant news coverage or have the potential to cause such coverage, be reported? The Office of the Under Secretary of Defense for Intelligence. Who is responsible for issuing instructions governing the security of weapons systems within their inventory? Each DoD Component head. What are the four considerations/risk factors used for determining the security risk category (SRC) of sensitive conventional AA&E? Utility Casualty or damage risk Adaptability risk Portability risk What is the purpose of intrusion detection systems? To detect unauthorized penetration into a secured area. Describe the four types of lighting systems used for security lighting? Continuous lighting: A series of fixed lights arranged to continuously illuminate a given area. Standby lighting: Luminaires are either automatically or manually turned on at times when suspicious activity is detected by security personnel or an intrusion detection system. A standby system creates the impression of activity and may offer a deterrent value while also conserving energy. Emergency lighting: Emergency lighting is used during a power failure or when regular lighting is not available for any reason. This type of lighting depends on alternative power sources such as batteries or generators. Moveable lighting: Manually-operated searchlights that may be lighted during hours of darkness or as needed, and is normally used to supplement continuous or standby lighting. What is the reference that provides minimum construction requirements for fencing? UFC 4-022-03, Security Fences and Gates List the types of buildings that are exempt from certain DoD antiterrorism site design standards? (14) Low occupancy buildings Low occupancy family housing Fisher houses Town centers Enhanced use leases Transitional structures and spaces Temporary and re-locatable buildings Construction administration structures Recruiting stations in leased spaces Stand-alone gas stations and car care centers Military protective construction (designed to NATO or equivalent standards) Stand-alone franchised fast food operations Stand-alone shoppettes, minimarts, and similarly-sized commissaries Small stand-alone commercial, bank, and pharmacy facilities Name 9 types of authorized locking devices used within the Department of Defense? Cylindrical locksets Dead-bolt locksets Drop-bolt locks Padlocks Mechanical push-button combination locks Mechanical combination locks Electro-mechanical combination locks Warded locks Pin tumbler locks Which types of locks are associated with Federal Specification FF-L- 2740 and are approved for storage of all types of classified materials, regardless of classification? Electromechanical combination locks, which include the X-07, X-08, X-09, and S&G 2740, for classified material stored in security containers. Explain strengths and weaknesses of various types of padlocks? Low security padlocks (also known as secondary padlocks) are used for deterrence purposes but provide minimal resistance to force. High security padlocks deploy a high security hasp, provide maximum resistance to unauthorized entry, and may be used to secure arms, ammunition, and explosives facilities. What are some of the primary uses of fencing? (5) Provides a legal boundary by defining the outermost limit of a facility Assists in controlling and screening authorized vehicle entries into a secured area by deterring overt entry elsewhere along the boundary Supports detection, assessment, and other security functions by providing a "clear zone" for installing lighting, intrusion detection equipment, and CCTV Deters "casual" intruders from penetrating into a secured area by presenting a barrier that requires over action to penetrate Causes an intruder to make an overt action that will demonstrate intent What are examples of passive barrier systems? (11) Concrete-filled bollard Concrete median (also known as Jersey barrier) King Tut block Concrete planter Excavations and ditches Guardrails Heavy equipment tires Tire shredders Steel cable barriers Steel cable-reinforced chain link fencing Reinforced concrete knee walls What is the purpose of deploying glare projection? Makes it difficult for potential intruders to see inside the area being protected. Define the two main types of electromechanical locks according to Federal Specification FF-L 2740B? Basic Self-Contained: Does not have external power source, external data transfer port, or ability to transfer data Interoperable/Networked: Power source may be contained within and integral to lock assembly; power source may be replaceable; external data transfers shall meet FIPS standards; data transfers may be used to monitor authorized/unauthorized openings, personnel access, combination verification, and combination changes. The DoD Antiterrorism Standards are applicable to which types of buildings? (12) New construction Existing buildings Major investments Change of occupancy level Window replacement Roadway improvement projects Building additions Leased buildings Partial occupancy National Guard buildings Visitor centers and museums Expeditionary structures What are the four basic functional elements that must operate in an integrated and timely manner to achieve an overall effective security system that defeats design threats? Intrusion detection and access control sensors and/or guards Threat assessment from guards and/or CCTV Appropriately designed and located barriers Responding guards What are some of the considerations for selecting and implementing a particular intrusion detection system? (4) Completeness of coverage False and nuisance response rates Probability of detection Zone at which the alarm occurred List two reasons for which physical security programs should be tailored to local conditions? In overseas areas, COCOMS may deviate from DoD policy where required by treaties, agreements, and arrangements with foreign governments and allied forces. Threats, vulnerabilities, and critical assets may vary. Before loss of Arms, Ammunition, and Explosives (AA&E) can be attributed to any inventory or accountability discrepancy, one must first determine the loss was not a result of what three factors? Theft Abandonment Misappropriation Define the term "risk" within the context of risks, threats, and vulnerabilities? A measure of consequence of peril, hazard, or loss, which is incurred from a capable aggressor or the environment. When planning and/or responding to an emergency, with whom should coordination occur? Local, state, federal, and/or host country officials and organizations. What are the three goals of the DoD Installation Emergency Management Program? Prepare DoD installations for emergencies Respond appropriately to protect personnel and save lives Recover and restore operations after an emergency What is the role of the National Response Framework (NRF) for installation emergency management? Establishes clear objectives for a concerted national effort to prevent, prepare for, respond to, and recover from terrorist attacks, major disasters, and other domestic emergencies. The NRF provides the structure and mechanism for a consistent, nationwide approach for federal, state, and local governments to effectively and efficiently work together to manage domestic incidents, regardless of cause, size, or complexity. Define preparedness in the context of emergency management? Preparedness is the range of deliberate, critical tasks and activities necessary to build, sustain, and improve the operational capability to prevent, protect against, respond to, and recover from domestic incidents. Preparedness is a continuous process. Preparedness involves efforts at all levels of government and coordination among government, private sector, and non-governmental organizations to identify threats, determine vulnerabilities, and identify required resources. Within the National Incident Management System, preparedness is operationally focused on establishing guidelines, protocols, and standards for planning, training and exercises, personnel qualification and certification, equipment certification, and publication management. Why are Physical Security Measures employed? To prevent or reduce the potential for sabotage, theft, trespassing, terrorism, espionage, or other criminal activity. How do Security Measures ensure security? Must provide the capability to deter, detect, identify, track, assess, record, communicate, delay, and respond to unauthorized access activities. Security requirements for classified contracts are stated in? DoD 5220.22M, NISPOM The protection of DoD assets is accomplished through? The application of active and passive complimentary physical security measures. Define Security in Depth? Integrating and using (layers) active and passive complimentary physical security measures together. Explain Security in Depth Facility planning Use of barriers, fencing, signs, site lighting, and advanced technologies such as intrusion detection systems, closed circuit television (CCTV) and biometric entry control systems. When should Point Security be used? When an individual resource requires individual protection. When should Area Security be used? To protect consolidated resources, such as an installation or facility. What is Enclaving? Designating islands of extreme or high security within a sea of moderate security. Barbed wire and concertina wire may serve as a protective barrier by simply uncoiling it and laying it on the ground? T/F True Jersey barriers may be placed around buildings to prevent vehicles from getting too close to the buildings? T/F True Rapidly flowing rivers are considered active barriers? T/F False Which protective barrier would most likely be utilized for its decorative appeal? Concrete planter can serve as a protective barrier by preventing vehicle access. To be effective, clear zones should be free of which of the following? Must be free of visual obstructions such as bushes. What is Glare Projection? This method is intended to make the inside of a protected area difficult to see from outside the protected area. What is Controlled Lighting? This method is intended to limit the width of the lighted strip outside the perimeter of a protected area so as not to interfere with adjoining property, nearby highways, railroads, navigable waters, or airports. What is Surface Lighting? This method is intended to display a silhouette of any person passing between the light source and the building or to show the contrast of a person inside the building. When planning protective site lighting, you should ensure that controls and switches are installed inside the protected area and locked or guarded or inside a central station such as an alarm monitoring station? T/F True Flashlights are a reliable form of continuous lighting? T/F False Emergency lighting depends upon the power supply of the utility company? T/F False Standby lighting is the type of lighting used when the primary power source fails? T/F False Government security forces may be either military or civilian? T/F True Contract security forces may be either military or civilian? T/F True Military working dogs can seek, detect, defend their handlers, and guard suspects? T/F True Which statement best describes the mission of security forces? The mission of all government security forces, civilian or military, contract forces, and military working dogs is to protect DoD assets. What responds to a physical stimulus? Sensor/detector Receives change of state and transmits alarm? Premise Control Unit (PCU) Central point for collecting alarm status? Monitoring station What assures communications between the alarmed area and the monitoring station? Transmission Line Security CCTV camera may capture activity missed by security force personnel? T/F True CCTV can act as an intrusion detection system (IDS) when combined with video motion detection? T/F True An advantage of CCTV is that environmental factors do not affect its performance? T/F False Which of the following are access control systems? (4) Card Swipe System Badge Exchange Program Personal Recognition Iris Scanning Escorts must be able to control the visitor they are escorting throughout the duration of their visit in a controlled area? T/F True The schedules for entry and exit inspections should be posted in view of all DoD personnel? T/F False All visitors with the appropriate access level to enter a controlled area are permitted unescorted entry? T/F False Entry and exit inspections help deter the introduction of unauthorized or prohibited material into an installation or facility and help prevent the unauthorized removal of DoD assets from an installation or facility? T/F True Fixed equipment that detects metal objects? Magnetometer Detects traces of explosive material? Vapor Trace Detector Portable equipment that detects metal objects? Wand Detects prohibited items? X-ray machine Which of the following statements are true of physical security planning and implementation? (4) The risk management process must be used to plan which physical security measures should be utilized to protect DoD assets. Use of oversight tools is an important part of physical security implementation. Facility design must be considered in physical security planning. Physical security countermeasures must always be planned for when designing a facility. Which of the following would best be described as a countermeasure? Fence Who is responsible for the installation's antiterrorism program? Antiterrorism Officer Who is responsible for providing valuable information on the capabilities, intentions, and threats of adversaries? CI Support Who analyzes threats to assets and their vulnerabilities? OPSEC Officer Who must be included in the intelligence gathering process so that they can be part of coordinating emergency responses and criminal incidents on a Federal installation? Law Enforcement Who is charged with the management, implementation, and direction of all physical security programs? Physical Security Officer/Provost Marshal Who is responsible for the safety of people and property under their command? Installation Commander/Facility Director Who is responsible for mitigating risks against Defense Critical Infrastructure assets that support the mission of an installation or facility? DCIP Officer Fencing has which of the following features for DoD compliance? The steel mesh wire on a chain link fence should not be greater than 2 inches in diameter to be in compliance with DoD specifications. Which consideration do you think was more important when selecting this type of fence for this installation-cost or appearance? Cost Lighting which is continuously lit during hours of darkness? Continuous Lighting Lighting illuminated manually or automatically when suspicious activity is detected or suspected by the security force, alarm system, or motion detector? Stand-by Lighting Back-up lighting used during power failures or other emergencies when normal systems are inoperative? Emergency Lighting What is the primary purpose of continuous lighting? To deter intruders What type of barrier is a concrete Jersey barrier? Passive What is the primary purpose of a concrete Jersey barrier? To help prevent unauthorized vehicle entry. What type of barrier is an automated barrier? Active What is the primary purpose of an Active barrier? To stop vehicles for guard authorization A camera on the guard house is part of what type of physical security measure? Closed Circuit Television (CCTV) What is the primary purpose of the CCTV physical security measure? Documents authorized and unauthorized entry into a controlled area. What type of ID would you most likely be required to show a guard at a DoD Military Access Control Point? Your Common Access Card (CAC) What is manual access control? A guard asking for the proper identification for entry Emergency lighting depends upon the power supply of the utility company? T/F False Standby lighting is the type of lighting used when the primary power source fails? T/F False Certain types of lighting can incapacitate an intruder? T/F True Controlled lighting is used to illuminate the perimeter of a facility? T/F True Often used as a temporary barrier when rolled out on the ground? Concertina wire Can be used as permanent standalone fencing but is more often used as an outrigger on the top of the chain link fencing? Barbed wire It's more difficult for intruders to scale? Metal ornamental high security fencing Is a common type of perimeter fencing for DoD facilities? Chain link fencing Securing man-passable openings is one of the most overlooked physical security protective measures? T/F True Intrusion Detection Systems (IDS) prevent unauthorized entry? T/F False Cost and risk must always be considered when planning which physical security measures to use in a facility or installation? T/F True Access control systems help to prevent unauthorized entry? T/F True CCTV can deter loss, theft, or misuse of government property and resources? T/F True Operational/administrative procedures for normal and emergency situations? (SOP) Standard Operating Procedures Comprehensive protective measures for an installation, facility, or activity? (PSP) Physical Security Plan Roles and responsibilities for individual work areas such as checkpoints and guard gates? Post Orders Provisions for back-up facilities, utilities, communication and computer systems, and transportation in the event of a major emergency? (COOP) Continuity of Operations Plan Provisions for one entity, such as a DoD activity or local law enforcement, fire, and medical services, to provide security assistance to another entity? MOU/MOA Combatant Commanders issue both DoD Terrorist Threat Levels and FPCONs? T/F True Both the DIA and COCOMs issue FPCONs? T/F False True or False: Installation commanders and facility directors issue DoD Terrorist Threat Levels? False Terrorist Threat Levels are based on information about terrorist groups such as their operational capability and their intentions? T/F True FPCONs are based on various factors, such as terrorist threat analyses and DoD Terrorist Threat Levels? T/F True A system that standardizes the identification and recommended preventive actions and responses to terrorist threats against U.S. assets? Force Protection Conditions The prevention and detection of terrorist attacks against DoD assets as well as the preparation to defend against and planning for the response to the consequences of terrorist incidents? DoD AT Program Intelligence threat assessments of the level of terrorist threat faced by U.S. personnel and interests? Terrorist Threat Levels Actions taken to prevent or mitigate hostile actions against DoD assets such as DoD personnel, family members, resources, facilities, and critical information? Force Protection Internal reviews conducted by members of the organization to aid internal control and ensure cost-effective security program? Management/Self-Inspections Formal reviews conducted by senior officials in the chain-of-command? Compliance Inspections Validate baseline security posture when personnel assume security responsibilities or as a prelude to a formal inspection? Staff Assist Visits Can be self-initiated or directed by higher authorities to determine the physical security posture of an installation or facility? Surveys Most common and informal oversight tool; immediate action taken to correct deficiencies? Day-to-day Observations Which of the following are true of master key systems? The great grand master key opens all of the locks in the system. They are convenient for managers, but because of their inherent security risks, their use is discouraged. Switching device: authorizes the operating mechanism to open the lock? Combination Operating mechanism: interacts with the switching device to allow or deny entry? Cylinder Locking device: physically secures area or container? Latch You need to decide what type of locking system to use for a storage closet. The closet does not hold classified or sensitive information, but you want to deter entry. Which type of key-operated lock should you use? A built-in Lock You are making a decision about the locking system to be used in an area that stores bulk Confidential or Secret material. Which type of key-operated lock should you use? A padlock The area you are securing contains conventional arms, ammunition, and explosives (AA&E). Which type of key-operated lock should you use? Medium security padlock You have chosen locking systems for several areas in your facility. Which of the following guidelines should you now follow when considering key control? Protect keys and locks at the same level as classified information they are safeguarding. Maintain a key and lock register. Replace keys and locks if they are lost or compromised. Do not remove keys from certain premises. Do not create master keys. Appoint a key and lock custodian to ensure proper custody and handling of locks and keys. Inventory keys at each change of custody. You need to review the requirements that electromechanical locks meet. Which of the following specifications should you reference? Federal Specification FF-L-2740 You need to secure classified information. Which of these locks could you use? X-09 electromechanical lock La Gard 3330 mechanical lock S&G 8077 padlock You are selecting combination locks for your facility and must consider the requirements and features of various combination locks. Which locks are currently being produced? use? X-09 electromechanical lock You need to open a security container that has an X-09 electromechanical lock. The combination is 27-4-39. What should you do first? Turn the dial left 4 to 6 turns. You need to open a security container that has an X-09 electromechanical lock. The combination is 27-4-39. Now that the lock is powered and numbers appear on the LCD, what should you do? Dial left to the number 27. You need to open a security container that has an X-09 electromechanical lock. The combination is 27-4-39. You have dialed left and the number 27 now appears on the LCD. What should you do next? Dial right to the number 4. You need to open a security container that has an X-09 electromechanical lock. The combination is 27-4-39. You have dialed right to the second number, 4. The number 4 now appears on the LCD. What should you do next? Dial left to the number 39. You need to open a security container that has an X-09 electromechanical lock. The combination is 27-4-39. You have dialed left to the third number, 39. The number 39 now appears on the LCD. What should you do next? Turn the dial to the right to retract the lock. You need to open a security container that has an X-09 electromechanical lock. The combination is 27-4-39. Now you need to open a security container that has an S&G 2740 lock. What type of lock is S&G 2740? Electromechanical combination lock If you overshoot your combination when dialing the S&G 2740 lock, what should you do? Continue rotating the dial in the same direction for an extra turn, then stop precisely on the desired number You are responsible for creating, protecting, and changing combinations in your facility. What guidelines should you follow? (5) Do not write a combination down. Do not change a locks combination on a Friday or the day before you go on leave. Change a locks combination if the container is discovered unlocked and unattended. Maintain records of who knows lock combinations. Safeguard the combination at appropriate classification level. An ESS is a component of an overall physical protection system? T/F True An ESS must be comprised of at least two or more subsystems. Therefore, a stand-alone automated access control system, for example, would not constitute an ESS? T/F False An effective ESS must ensure that the time between detection of an intrusion and response by security forces is less than the time it takes for damage or compromise of assets to occur? T/F True You are tasked with planning an ESS for a DoD facility. What regulatory guidance document(s) should be your primary reference? UFC, 4-021-02, Electronic Security Systems Assets, threats, and vulnerabilities are all part of the risk calculation? T/F True Threats against an asset are determined when you conduct a site survey? T/F False You must consider operational and maintenance costs of an ESS when comparing the value of an asset to be protected versus the cost of the ESS to protect an asset? T/F True What can an AACS do to protect assets in a facility? (4) Allow authorized personnel to enter a controlled area after verifying credentials Assist in preventing unauthorized personnel from entering a controlled area Communicate with CCTV for assessment purposes Communicate with an IDS to sound an alarm to alert security personnel of unauthorized entry attempts A high-security facility requires an AACS that makes it extremely difficult to duplicate the user's form of verification for access. Which type of AACS is most appropriate for that facility? Biometric You have been directed to purchase the least expensive type of AACS for a given facility. Which type of AACS should you choose? Coded Which type of AACS would allow you to use your CAC as the verification method for authorized entry into a controlled area? Credential Which AACS feature would you implement to mitigate the risk of someone giving his or her credentials to another person to access a controlled area? Anti-Passback Which AACS feature would you implement to prevent individual cardholders from entering a selected empty controlled area unaccompanied? Two-Person Rule Which AACS feature would you implement to prevent a person from following another person closely in order to gain ingress through the same portal when the authorized person's credential grants access? Anti-Tailgating Which AACS feature would you implement to facilitate egress from a controlled area? REX Device Which of the following should you conduct to test the placement of IDS sensors? Acceptance Test Which of the following can be caused by an animal activating an IDS sensor? Nuisance Alarm Which of the following is part of an acceptance test? PCU Test Which type of exterior IDS sensor is good for detecting intrusion by digging and tunneling? Buried Line Sensor Which exterior IDS sensor is NOT vulnerable to bridging? Open Terrain Sensor Which exterior IDS sensor is usually the least expensive? Fence Associated Sensor Which exterior IDS sensor is also known as a line-of-sight sensor? Open Terrain Sensor Which type of sensor would be most effective in protecting a permanently secured window? Glass Break Sensor Which sensor detects heat signatures of intruders and is the most common interior volumetric sensor? Passive Infared Sensor Which sensor is used on doors, roof hatches, and windows? Balanced magnetic switch (BMS) High security switch (HSS) Monitoring a military exchange? Surveillance Viewing a CCTV monitor to determine security force response to an alarm? Alarm Assessment Viewing individuals on a CCTV camera to grant or deny access to a facility? Access Control You have received a request to add a CCTV system to a building on your installation. Which questions should you ask? (4) Will the CCTV system be used inside or outside? Will the CCTV system be used in a very well-lit area, in low lighting, or in the dark? Are there any visual obstacles that might block the system from capturing clear images? Will the system require a person to man the monitor at all times? Which of the following are considerations when planning for a DTM link? (4) What is the bandwidth of each ESS subsystem being connected? What level of security will be required? Is there an uninterruptible power supply? Can you use existing networks or will you need to create a new pathway? A wireless network is more secure than a hardwired network? T/F False Software-based integration is the preferred DTM method for most projects? T/F True A DTM allows an automated access control system to communicate with a control center? T/F False Wireline DTM, which is good for most ESS data transmission needs, has a high bandwidth? T/F False Police connection and central station monitoring generally require an increase in staffing at the facility being monitored? T/F False Proprietary station monitoring is the method used most by DoD installations? T/F True Police connection and central station monitoring are generally connected to the facility being monitored through leased telephone lines? T/F True Local alarm monitoring works best without another type of monitoring used in conjunction with it? T/F False A facility owns and operates the dispatch center and security forces? Proprietary Station The local police agency monitors a facility's alarms? Police Connection Owned by a commercial firm and not usually located on the facility being monitored? Central Station Requires roving security forces? Local Alarm Which of the following require(s) a mechanical/automated access control system or visual recognition as the access control method? Top Secret/Secret collateral open storage area Which of the following may contain a CCTV within the protected area? - Arms room - Magazine Which of the following must have vibration sensors on its walls to detect boundary penetration attempts? Magazine Which require(s) any system-associated cabling that extends beyond protected area perimeter to be installed in rigid conduit? (4) - SCIF - Top Secret/Secret collateral open storage area - Arms room - Magazine While a security lighting system may deter unsophisticated criminals or vandals, the system alone may not be sufficient to deter sophisticated criminals or terrorists? T/F True What are the two basic systems to be used to provide practical and effective security lighting? Low-level lighting is used on security personnel. Low contrast lighting helps security personnel to detect indistinct outlines of silhouettes. Which type of lighting is considered the most common? Continuous lighting is the most common lighting. Surface lighting helps to exaggerate the shadow of a potential intruder approaching a building? T/F True What is continuous lighting? Consists of a series of fixed lights arranged to flood a given area continuously during darkness with overlapping cones of light. It is essential to be consistent in all areas of the facility when it comes to security lighting? T/F False Three primary methods of using continuous lighting are? Glare projection Controlled lighting Surface lighting. Describe the purpose of 5200.08-R The regulation implements DoD policies and provides minimum standards for the physical protection of DoD personnel, installations, operations, and related Describe the purpose of 5200.08-R The regulation implements DoD policies and provides minimum standards for the physical protection of DoD personnel, installations, operations, and related resources. What reference governs the Certification and Accreditation (C&A) for storage of DoD collateral Classified Information Systems? DODM 5200.01, DoD Information Security Program, Volume 3, Protection of Classified Information. What is the reference that provides minimum construction requirements for fencing? UFC 4-022-03, Security Fences and Gates. Define the Basic Self-Contained electromechanical locks according to Federal Specification FF-L-2740B. Does not have external power source, external data transfer port, or ability to transfer data Define the interoperable/networked electromechanical locks according to Federal Specification FF-L-2740B. Power source may be contained within and integral to lock assembly; power source may be replaceable; external data transfers shall meet FIPS standards; data transfers may be used to monitor authorized/unauthorized openings, personnel access, combination verification, and combination changes What are some of the considerations for selecting and implementing a particular intrusion detection system? (4) Completeness of coverage False and nuisance response rates Probability of detection Zone at which the alarm occurred Define "Clear Zone" An area inside and outside the perimeter fence or barrier of the protective area that provides unimpeded observation Define "Controlled Lighting" Used when necessary to limit the width of the lighted strip outside the perimeter of the facility so it will not interfere with adjoining properties or infastructure Define "Surface Lighting" Used to light the surface of a building to display a silhouette of any person passing between the light sources and the building Define "Emergency Lighting" Used during a power failure or when regular lighting is not available (uses batteries or generators) Define "Active Barrier" has moving parts and requires personnel or equipment to allow entry into a facility or installation What are the 6 types of security force deployments? 1. Static Observation Post 2. Access Control Points 3. Roving Patrols 4. Response Forces 5. Security System Monitors 6. Dispatchers Define "Static Observation Posts" Guard a high priority resource; used when continuous surveillance is required What are the components of IDS? (3) Sensors, control, or transmission units Monitor units Computer monitoring stations What are the 6 criteria for IDS selection? 1. Asset criticality 2. Design 3. Environment 4. Environment 5. Location 6. Perceived threat What are the 4 operational phases of IDS? 1. Detection 2. Reporting 3. Dispatch 4. Response/Assessment What are the 3 types of IDS monitoring 1. Local 2. Proprietary 3. Central Station Define Premise Control Unit (PCU) A centralized device that receives changes of state from IDE sensors and transmits an alarm or trouble condition to the monitoring station What are the 5 characteristics for lighting consideration? 1. Watts required 2. Start (minutes) 3. Re-Strike Time 4. Color Discrimination 5. Life (hours) Define "Man-Passable Opening" and the 5 securing equipment 96 square inches or greater. Eliminated or secured by: 1. Barriers 2. Grills 3. Bars 4. Barbed wire 5. Doors w/ adequate locking devices What are the 4 terrorist threat levels? Low Moderate Significant High What 4 factors does DIA use to determine terrorist threat level? 1. Operational capability 2. Intentions 3. Activity 4. Operational environment What document describes the DoD Antiterrorism standards including FPCON and COCOM? DoD 2000.16 What are the 5 "Oversight Tools" used to implement physical security measures? 1. Day-to-Day Observations 2. Surveys 3. Staff assisted visits 4. Inspections (self and compliance) 5. Incident Reports What 5 groups are involved in physical security planning and implementation? 1. Antiterrorism Working Group (ATWG) 2. Information Systems Security Manager (ISSM) 3. Legal Officers 4. Threat Working Group (TWG) 5. Defense Critical Infrastructure Program (DCIP) working group Which term defines the following lock components: 1. Switching Device: authorizes the operating mechanism to open the lock 2. Operating Mechanism: interacts with the switching device to allow or deny entry 3. Locking Device: physically secures the area or container 1. Combination 2. Cylinder 3. Latch What is the only approved mechanical combination lock under Federal Specification FF-L-2937, used for the storage of secret and confidential information under field conditions and in military platforms , AA&E and other sensitive DOD assets? S&G 2937 is the only approved mechanical combination lock. What are the six steps of the Risk Management Process? Assess assets Assess threats Assess vulnerabilities Determine Countermeasure options Make Risk Management Decisions What type of fencing does DOD use? Chain link fence constructed of 9-guage or heavier galvanized steel mesh wore of no more than two inches in diameter be at least 6-8 feet tall with bottom no more than two inches off the ground. Planning considerations for lighting Cost of lights Positioning of lights Characteristics of lights Maintenance What are some factors to consider when selecting IDS? Asset Criticality Design considerations Environmental Considerations Locations Considerations Perceived threat factor Considerations for use of CCTV as Physical Security measure Cost of system vs benefit it provides Color vs. black and white Protection from tampering especially outdoors Sufficient lighting available Examples of manual access systems Personal Recognition Cipher Locks CAC Joint Personnel Adjudication System (JPAS) Badge ID Examples of Electronically Automated Access Control Systems Biometrics Swipe Card Readers Proximity Card Systems Key Systems What are concerns with Badge systems? Mass reissuance of badges $$$ Holder's failure to report loss to appropriate authority Require more security personnel than manual systems Lighting, weapons, CCTV, fences and locking mechanisms are examples of what category of countermeasure? Procedural Facilities Training Equipment Equipment Which of the following questions are used to identify an adversary's intent? Select all that apply: What are the vulnerabilities to the risk management system? What are the adversary's goals? What level of risk are the adversaries likely to accept? Are the adversaries willing to risk getting caught? All but the first choice After you completed all the other steps, what final chart would you use to summarize and record your information in order to get the total cost for all countermeasures? Intent Assessment Chart Collection Capability Assessment Chart Threat Assessment Chart Countermeasure Analysis Chart Countermeasure Analysis Chart To assist in analyzing threat data, adversaries are typically grouped into all except which of the following categories? Organizations Companies Governments Individuals Companies After completing the vulnerability assessment in the risk management process, the next step is which assessment? Countermeasures Cost/benefit Risk Asset Risk After completing the risk assessment step of the risk management process, what step