Critical Infrastructure Security
Protection Exam Practice Questions And
Correct Answers (Verified Answers) Plus
Rationale 2026 Q&A| Instant Download
Pdf
1. A privately contracted security supervisor assigned to a hydroelectric
power facility notices that several unauthorized individuals are using
high-powered cameras and drones near restricted intake tunnels. The
individuals refuse to identify themselves and claim they are “tourists”
documenting architecture. Under critical infrastructure protection
protocols, what should be the supervisor’s MOST appropriate
immediate response while balancing civil liberties and national
security concerns?
A. Ignore the individuals because photography of infrastructure is
constitutionally protected under all circumstances
,B. Immediately confiscate all recording devices and detain the individuals
indefinitely without law enforcement involvement
C. Notify law enforcement and facility command while documenting
suspicious surveillance indicators and maintaining observation from a safe
distance
D. Use force to expel the individuals from the public area regardless of local
laws
C.
Critical infrastructure protection doctrine emphasizes recognizing
suspicious surveillance behaviors while respecting constitutional rights.
Security personnel should report suspicious activity, document
observations, coordinate with law enforcement, and avoid unlawful
detention or confiscation absent legal authority.
2. A security officer working at a regional electrical grid control center
receives an anonymous telephone threat claiming that malware has
already been installed within the facility’s industrial control systems.
Which action BEST aligns with cybersecurity incident response
principles for critical infrastructure operators?
A. Immediately shut down the entire regional power grid without
verification
B. Notify designated cybersecurity response personnel and preserve logs,
,communications, and system integrity evidence
C. Delete all suspicious files from affected computers before investigators
arrive
D. Publicly announce the threat to social media followers to encourage
community awareness
B.
Critical infrastructure incident response requires prompt escalation to
authorized cybersecurity personnel while preserving forensic evidence.
Premature deletion of files or uncontrolled public disclosures may worsen
operational and investigative outcomes.
3. During a major sporting event hosted adjacent to a petroleum
refinery, security managers identify increased online extremist chatter
encouraging attacks against energy infrastructure. What is the MOST
appropriate protective measure under risk-based security planning
principles?
A. Cancel all refinery operations indefinitely regardless of threat credibility
B. Reduce all perimeter patrols to avoid attracting attention
C. Increase layered security measures, coordinate intelligence sharing, and
enhance access control procedures
D. Ignore the information because online threats rarely lead to physical
attacks
, C.
Risk-based infrastructure protection relies on layered defense strategies,
interagency coordination, and heightened monitoring when credible threat
indicators emerge. Proportionate security enhancements reduce
vulnerabilities while maintaining operations.
4. A contracted security employee assigned to a water treatment facility
discovers a coworker sharing access credentials with temporary
maintenance workers in order to “save time.” Which statement BEST
describes the primary security concern created by this behavior?
A. Credential sharing improves operational efficiency without creating
substantial risk
B. Shared credentials eliminate accountability and weaken access control
integrity
C. Temporary workers automatically receive unrestricted access rights under
federal law
D. Access control systems are only necessary during national emergencies
B.
Credential sharing undermines accountability, prevents accurate audit
tracking, and creates vulnerabilities in protected facilities. Effective critical
infrastructure security depends upon individualized authentication and
controlled authorization procedures.
Protection Exam Practice Questions And
Correct Answers (Verified Answers) Plus
Rationale 2026 Q&A| Instant Download
1. A privately contracted security supervisor assigned to a hydroelectric
power facility notices that several unauthorized individuals are using
high-powered cameras and drones near restricted intake tunnels. The
individuals refuse to identify themselves and claim they are “tourists”
documenting architecture. Under critical infrastructure protection
protocols, what should be the supervisor’s MOST appropriate
immediate response while balancing civil liberties and national
security concerns?
A. Ignore the individuals because photography of infrastructure is
constitutionally protected under all circumstances
,B. Immediately confiscate all recording devices and detain the individuals
indefinitely without law enforcement involvement
C. Notify law enforcement and facility command while documenting
suspicious surveillance indicators and maintaining observation from a safe
distance
D. Use force to expel the individuals from the public area regardless of local
laws
C.
Critical infrastructure protection doctrine emphasizes recognizing
suspicious surveillance behaviors while respecting constitutional rights.
Security personnel should report suspicious activity, document
observations, coordinate with law enforcement, and avoid unlawful
detention or confiscation absent legal authority.
2. A security officer working at a regional electrical grid control center
receives an anonymous telephone threat claiming that malware has
already been installed within the facility’s industrial control systems.
Which action BEST aligns with cybersecurity incident response
principles for critical infrastructure operators?
A. Immediately shut down the entire regional power grid without
verification
B. Notify designated cybersecurity response personnel and preserve logs,
,communications, and system integrity evidence
C. Delete all suspicious files from affected computers before investigators
arrive
D. Publicly announce the threat to social media followers to encourage
community awareness
B.
Critical infrastructure incident response requires prompt escalation to
authorized cybersecurity personnel while preserving forensic evidence.
Premature deletion of files or uncontrolled public disclosures may worsen
operational and investigative outcomes.
3. During a major sporting event hosted adjacent to a petroleum
refinery, security managers identify increased online extremist chatter
encouraging attacks against energy infrastructure. What is the MOST
appropriate protective measure under risk-based security planning
principles?
A. Cancel all refinery operations indefinitely regardless of threat credibility
B. Reduce all perimeter patrols to avoid attracting attention
C. Increase layered security measures, coordinate intelligence sharing, and
enhance access control procedures
D. Ignore the information because online threats rarely lead to physical
attacks
, C.
Risk-based infrastructure protection relies on layered defense strategies,
interagency coordination, and heightened monitoring when credible threat
indicators emerge. Proportionate security enhancements reduce
vulnerabilities while maintaining operations.
4. A contracted security employee assigned to a water treatment facility
discovers a coworker sharing access credentials with temporary
maintenance workers in order to “save time.” Which statement BEST
describes the primary security concern created by this behavior?
A. Credential sharing improves operational efficiency without creating
substantial risk
B. Shared credentials eliminate accountability and weaken access control
integrity
C. Temporary workers automatically receive unrestricted access rights under
federal law
D. Access control systems are only necessary during national emergencies
B.
Credential sharing undermines accountability, prevents accurate audit
tracking, and creates vulnerabilities in protected facilities. Effective critical
infrastructure security depends upon individualized authentication and
controlled authorization procedures.
