AVIATION SECURITY CERTIFICATION EXAMINATION
RYANAIR SECURITY EXAM
QUESTIONS AND
ANSWERS
Aligned with the Ryanair Security Programme,
ICAO Annex 17, EU Regulation 2015/1998,
and Irish Aviation Authority (IAA) Requirements
150 Multiple-Choice Questions
8 Examination Sections
Cognitive Levels: 25% Recall | 50% Application | 25% Analysis
75% Scenario-Based | 25% Direct Knowledge
OFFICIAL EXAM PREPARATION RESOURCE
Ryanair Security Programme | IAA-Approved Content
Examination Edition: 2026/2027
,RYANAIR SECURITY EXAM 2026/2027 - Questions and Answers Aviation Security Certification
Examination Instructions
This examination paper comprises 150 multiple-choice questions distributed across eight sections
covering aviation security foundations, the regulatory framework (ICAO, EU, IAA, NCASP), access
control and security restricted areas, passenger and baggage screening, insider threats and disruptive
passengers, aircraft and in-flight security, security culture and human factors, and emergency response.
Each question has exactly one correct answer from options A through D. The correct answer is
identified with the marker *[CORRECT]* and confirmed in the "Correct Answer" line. A rationale is
provided for every question, referencing the Ryanair Security Programme, ICAO Annex 17, EU
Regulation 2015/1998, and Irish Aviation Authority requirements as applicable.
The examination is calibrated to a cognitive distribution of approximately 25% recall, 50% application,
and 25% analysis. Approximately 75% of questions are scenario-based, reflecting real-world aviation
security situations encountered by cabin crew, flight crew, and ground staff. Approximately 25% are
direct-knowledge questions testing regulatory and procedural facts. Twenty questions are explicitly
scenario-based security decisions, fifteen questions focus on EU and ICAO regulatory requirements,
and fifteen questions address prohibited articles and screening procedures.
Candidates should approach each question by reading the stem carefully, eliminating distractors that
reflect common security misconceptions, regulatory misinterpretations, procedural errors, or
threat-assessment failures, and selecting the single best answer supported by the Ryanair Security
Programme and applicable regulatory references. The rationale provided with each question should be
reviewed after answering to reinforce learning and identify any knowledge gaps for further study.
Section 1: Aviation Security Foundations & Threat Landscape (Q1–Q20)
Q1: During pre-flight preparation at Dublin Airport, a Ryanair ground handler observes an
unattended hold bag near the security restricted area (SRA) perimeter with no passenger in
sight and no identification tag. Under the Ryanair Security Programme and ICAO Annex 17,
what is the FIRST action that must be taken?
A. Move the bag to the lost property office to free up the apron area
B. Photograph the bag, then carry it to the nearest screening point for X-ray inspection
C. Do NOT touch the bag, isolate the area, notify the security supervisor and follow
suspicious item procedures *[CORRECT]*
D. Open the bag to identify the owner so it can be reunited with the passenger before departure
Correct Answer: C
Rationale: ICAO Annex 17 and the Ryanair Security Programme require that any unattended or suspicious
item must never be touched, moved, opened, or smelled. The correct response is isolation, immediate
notification of the security supervisor / Security Control Centre, and activation of suspicious item procedures.
Options A, B, and D each involve physical interaction with the item, which could detonate an IED or destroy
forensic evidence, and are strictly prohibited.
Aligned with Ryanair Security Programme | ICAO Annex 17 | EU 2015/1998 | IAA Requirements Page 2
,RYANAIR SECURITY EXAM 2026/2027 - Questions and Answers Aviation Security Certification
Q2: Which historical aviation security incident directly led to the global implementation of
100% hold baggage screening (HBS) on passenger aircraft?
A. The September 11, 2001 coordinated hijackings in the United States
B. The Lockerbie bombing of Pan Am Flight 103 over Scotland in December 1988
*[CORRECT]*
C. The bombing of Air India Flight 182 over the Atlantic in June 1985
D. The attempted shoe bombing of American Airlines Flight 63 by Richard Reid in December 2001
Correct Answer: B
Rationale: The destruction of Pan Am Flight 103 over Lockerbie, Scotland on 21 December 1988 by a
Semtex explosive hidden inside a cassette radio in hold baggage demonstrated that passenger baggage
could not be trusted without screening. This led directly to the ICAO mandate for 100% Hold Baggage
Screening (HBS). 9/11 (Option A) led to locked flight deck doors; the Shoe Bomber (Option D) led to shoe
removal at checkpoints; the Liquid Plot (Option C, omitted) led to LAGs restrictions.
Q3: A gate agent at Ryanair's Stansted base notices a passenger behaving nervously,
sweating heavily, avoiding eye contact, repeatedly checking the airport entrance, and
carrying a heavy winter coat in mid-summer. According to the systematic observation
technique described in the Ryanair Security Programme, what is the most appropriate
course of action?
A. Confront the passenger directly and demand to know why they are behaving suspiciously
B. Ignore the behaviour as nervousness is common among first-time flyers and low-cost carrier
passengers
C. Discreetly notify the security supervisor and continue observation without alerting the
passenger, allowing trained security staff to assess further *[CORRECT]*
D. Refuse boarding immediately and call the local police to arrest the passenger at the gate
Correct Answer: C
Rationale: Systematic observation under ICAO Annex 17 and the Ryanair Security Programme requires
discreet reporting and continued observation, not confrontation (which may provoke or tip off the subject) and
not ignoring (which breaches the duty of vigilance). Refusing boarding or arresting without evidence is
outside the gate agent's authority. The correct action is escalation to trained security personnel who can
apply behaviour-detection protocols.
Q4: Which of the following is NOT classified as an 'act of unlawful interference' under ICAO
Annex 17?
A. Unlawful seizure of an aircraft in flight
B. Destruction of a parked aircraft on the ground or sabotage of air navigation facilities
C. A scheduled Ryanair flight delayed by 90 minutes due to adverse weather conditions
*[CORRECT]*
D. Hostage-taking on board an aircraft or at an airport
Correct Answer: C
Rationale: ICAO Annex 17 defines acts of unlawful interference to include unlawful seizure, sabotage,
hostage-taking, armed attack, and interference with air navigation facilities. A weather-related delay (Option
C) is a normal operational occurrence, not an act of unlawful interference. Options A, B, and D are all
explicitly listed acts of unlawful interference under Annex 17 and trigger security response protocols.
Aligned with Ryanair Security Programme | ICAO Annex 17 | EU 2015/1998 | IAA Requirements Page 3
, RYANAIR SECURITY EXAM 2026/2027 - Questions and Answers Aviation Security Certification
Q5: On approach to a Ryanair flight departing from a Mediterranean airport, the captain
reports a green laser beam striking the cockpit windscreen, causing temporary flash
blindness. Under EU Regulation 2015/1998 and Irish aviation law, what should the cabin
crew prepare for, and what is the threat category of this incident?
A. A passenger evacuation; this is an act of unlawful interference under Category 1
B. Continued approach with no action required; laser illumination is a nuisance, not a security threat
C. Crew coordination for possible go-around, captain's authority to abandon approach, and
mandatory incident reporting under EU 376/2014 and IAA procedures; this is a recognised
aerial threat to flight safety *[CORRECT]*
D. Immediate diversion to the nearest military airbase and armed police response on landing
Correct Answer: C
Rationale: Laser illumination of aircraft is a recognised threat under EU and IAA security and safety
frameworks, capable of causing flash blindness and controlled flight into terrain. The captain has authority to
abandon the approach; crew must coordinate, secure the cabin, and file a mandatory occurrence report. It is
not a Category 1 unlawful interference (Option A), and dismissing it (Option B) violates reporting duties.
Military diversion (Option D) is disproportionate unless damage or injury occurs.
Q6: The 2006 transatlantic liquid explosives plot, disrupted by UK authorities, directly
resulted in which worldwide aviation security measure that Ryanair cabin crew must enforce
at every boarding gate?
A. Installation of biometric fingerprint scanners at every airport door
B. Restrictions on Liquids, Aerosols and Gels (LAGs) in cabin baggage, currently limited to
containers of no more than 100ml each in a single transparent 1-litre bag *[CORRECT]*
C. Mandatory shoe removal and full body X-ray for all passengers
D. Ban on all electronic devices larger than a smartphone in the cabin
Correct Answer: B
Rationale: The August 2006 plot to detonate liquid explosives on transatlantic flights led ICAO, EU
Regulation 2015/1998 (laying down detailed measures for LAGs), and the IAA to impose the
100ml-container, 1-litre-bag rule still enforced today. Shoe removal (Option C) followed Richard Reid's 2001
attempt. Electronics bans (Option D) arose from 2017 laptop-bomb intelligence. Biometric scanners (Option
A) are operational enhancements, not a direct response to the 2006 plot.
Aligned with Ryanair Security Programme | ICAO Annex 17 | EU 2015/1998 | IAA Requirements Page 4
RYANAIR SECURITY EXAM
QUESTIONS AND
ANSWERS
Aligned with the Ryanair Security Programme,
ICAO Annex 17, EU Regulation 2015/1998,
and Irish Aviation Authority (IAA) Requirements
150 Multiple-Choice Questions
8 Examination Sections
Cognitive Levels: 25% Recall | 50% Application | 25% Analysis
75% Scenario-Based | 25% Direct Knowledge
OFFICIAL EXAM PREPARATION RESOURCE
Ryanair Security Programme | IAA-Approved Content
Examination Edition: 2026/2027
,RYANAIR SECURITY EXAM 2026/2027 - Questions and Answers Aviation Security Certification
Examination Instructions
This examination paper comprises 150 multiple-choice questions distributed across eight sections
covering aviation security foundations, the regulatory framework (ICAO, EU, IAA, NCASP), access
control and security restricted areas, passenger and baggage screening, insider threats and disruptive
passengers, aircraft and in-flight security, security culture and human factors, and emergency response.
Each question has exactly one correct answer from options A through D. The correct answer is
identified with the marker *[CORRECT]* and confirmed in the "Correct Answer" line. A rationale is
provided for every question, referencing the Ryanair Security Programme, ICAO Annex 17, EU
Regulation 2015/1998, and Irish Aviation Authority requirements as applicable.
The examination is calibrated to a cognitive distribution of approximately 25% recall, 50% application,
and 25% analysis. Approximately 75% of questions are scenario-based, reflecting real-world aviation
security situations encountered by cabin crew, flight crew, and ground staff. Approximately 25% are
direct-knowledge questions testing regulatory and procedural facts. Twenty questions are explicitly
scenario-based security decisions, fifteen questions focus on EU and ICAO regulatory requirements,
and fifteen questions address prohibited articles and screening procedures.
Candidates should approach each question by reading the stem carefully, eliminating distractors that
reflect common security misconceptions, regulatory misinterpretations, procedural errors, or
threat-assessment failures, and selecting the single best answer supported by the Ryanair Security
Programme and applicable regulatory references. The rationale provided with each question should be
reviewed after answering to reinforce learning and identify any knowledge gaps for further study.
Section 1: Aviation Security Foundations & Threat Landscape (Q1–Q20)
Q1: During pre-flight preparation at Dublin Airport, a Ryanair ground handler observes an
unattended hold bag near the security restricted area (SRA) perimeter with no passenger in
sight and no identification tag. Under the Ryanair Security Programme and ICAO Annex 17,
what is the FIRST action that must be taken?
A. Move the bag to the lost property office to free up the apron area
B. Photograph the bag, then carry it to the nearest screening point for X-ray inspection
C. Do NOT touch the bag, isolate the area, notify the security supervisor and follow
suspicious item procedures *[CORRECT]*
D. Open the bag to identify the owner so it can be reunited with the passenger before departure
Correct Answer: C
Rationale: ICAO Annex 17 and the Ryanair Security Programme require that any unattended or suspicious
item must never be touched, moved, opened, or smelled. The correct response is isolation, immediate
notification of the security supervisor / Security Control Centre, and activation of suspicious item procedures.
Options A, B, and D each involve physical interaction with the item, which could detonate an IED or destroy
forensic evidence, and are strictly prohibited.
Aligned with Ryanair Security Programme | ICAO Annex 17 | EU 2015/1998 | IAA Requirements Page 2
,RYANAIR SECURITY EXAM 2026/2027 - Questions and Answers Aviation Security Certification
Q2: Which historical aviation security incident directly led to the global implementation of
100% hold baggage screening (HBS) on passenger aircraft?
A. The September 11, 2001 coordinated hijackings in the United States
B. The Lockerbie bombing of Pan Am Flight 103 over Scotland in December 1988
*[CORRECT]*
C. The bombing of Air India Flight 182 over the Atlantic in June 1985
D. The attempted shoe bombing of American Airlines Flight 63 by Richard Reid in December 2001
Correct Answer: B
Rationale: The destruction of Pan Am Flight 103 over Lockerbie, Scotland on 21 December 1988 by a
Semtex explosive hidden inside a cassette radio in hold baggage demonstrated that passenger baggage
could not be trusted without screening. This led directly to the ICAO mandate for 100% Hold Baggage
Screening (HBS). 9/11 (Option A) led to locked flight deck doors; the Shoe Bomber (Option D) led to shoe
removal at checkpoints; the Liquid Plot (Option C, omitted) led to LAGs restrictions.
Q3: A gate agent at Ryanair's Stansted base notices a passenger behaving nervously,
sweating heavily, avoiding eye contact, repeatedly checking the airport entrance, and
carrying a heavy winter coat in mid-summer. According to the systematic observation
technique described in the Ryanair Security Programme, what is the most appropriate
course of action?
A. Confront the passenger directly and demand to know why they are behaving suspiciously
B. Ignore the behaviour as nervousness is common among first-time flyers and low-cost carrier
passengers
C. Discreetly notify the security supervisor and continue observation without alerting the
passenger, allowing trained security staff to assess further *[CORRECT]*
D. Refuse boarding immediately and call the local police to arrest the passenger at the gate
Correct Answer: C
Rationale: Systematic observation under ICAO Annex 17 and the Ryanair Security Programme requires
discreet reporting and continued observation, not confrontation (which may provoke or tip off the subject) and
not ignoring (which breaches the duty of vigilance). Refusing boarding or arresting without evidence is
outside the gate agent's authority. The correct action is escalation to trained security personnel who can
apply behaviour-detection protocols.
Q4: Which of the following is NOT classified as an 'act of unlawful interference' under ICAO
Annex 17?
A. Unlawful seizure of an aircraft in flight
B. Destruction of a parked aircraft on the ground or sabotage of air navigation facilities
C. A scheduled Ryanair flight delayed by 90 minutes due to adverse weather conditions
*[CORRECT]*
D. Hostage-taking on board an aircraft or at an airport
Correct Answer: C
Rationale: ICAO Annex 17 defines acts of unlawful interference to include unlawful seizure, sabotage,
hostage-taking, armed attack, and interference with air navigation facilities. A weather-related delay (Option
C) is a normal operational occurrence, not an act of unlawful interference. Options A, B, and D are all
explicitly listed acts of unlawful interference under Annex 17 and trigger security response protocols.
Aligned with Ryanair Security Programme | ICAO Annex 17 | EU 2015/1998 | IAA Requirements Page 3
, RYANAIR SECURITY EXAM 2026/2027 - Questions and Answers Aviation Security Certification
Q5: On approach to a Ryanair flight departing from a Mediterranean airport, the captain
reports a green laser beam striking the cockpit windscreen, causing temporary flash
blindness. Under EU Regulation 2015/1998 and Irish aviation law, what should the cabin
crew prepare for, and what is the threat category of this incident?
A. A passenger evacuation; this is an act of unlawful interference under Category 1
B. Continued approach with no action required; laser illumination is a nuisance, not a security threat
C. Crew coordination for possible go-around, captain's authority to abandon approach, and
mandatory incident reporting under EU 376/2014 and IAA procedures; this is a recognised
aerial threat to flight safety *[CORRECT]*
D. Immediate diversion to the nearest military airbase and armed police response on landing
Correct Answer: C
Rationale: Laser illumination of aircraft is a recognised threat under EU and IAA security and safety
frameworks, capable of causing flash blindness and controlled flight into terrain. The captain has authority to
abandon the approach; crew must coordinate, secure the cabin, and file a mandatory occurrence report. It is
not a Category 1 unlawful interference (Option A), and dismissing it (Option B) violates reporting duties.
Military diversion (Option D) is disproportionate unless damage or injury occurs.
Q6: The 2006 transatlantic liquid explosives plot, disrupted by UK authorities, directly
resulted in which worldwide aviation security measure that Ryanair cabin crew must enforce
at every boarding gate?
A. Installation of biometric fingerprint scanners at every airport door
B. Restrictions on Liquids, Aerosols and Gels (LAGs) in cabin baggage, currently limited to
containers of no more than 100ml each in a single transparent 1-litre bag *[CORRECT]*
C. Mandatory shoe removal and full body X-ray for all passengers
D. Ban on all electronic devices larger than a smartphone in the cabin
Correct Answer: B
Rationale: The August 2006 plot to detonate liquid explosives on transatlantic flights led ICAO, EU
Regulation 2015/1998 (laying down detailed measures for LAGs), and the IAA to impose the
100ml-container, 1-litre-bag rule still enforced today. Shoe removal (Option C) followed Richard Reid's 2001
attempt. Electronics bans (Option D) arose from 2017 laptop-bomb intelligence. Biometric scanners (Option
A) are operational enhancements, not a direct response to the 2006 plot.
Aligned with Ryanair Security Programme | ICAO Annex 17 | EU 2015/1998 | IAA Requirements Page 4
