Q&As Flashcards
When conducting a thorough vulnerability analysis, which of the following is a step in identifying preventive measures?
a) Determine and evaluate significant threats, hazards and exposure to determine the likelihood of occurrence.
b) Identify the assets of the organization and determine the asset value as determined by management.
c) Identify the threats to the organization and determine the impact of a loss to the organization.
d) Interview employees to understand their experiences with loss events.
Determine and evaluate significant threats, hazards and exposure to determine the likelihood of occurrence.
The process of assessing security-related risks from internal and external threats to an entity, its assets and personnel, is called a ________________.
a) Vulnerability Assessment
b) Risk Assessment
c) Security Survey
d) Loss Event Profile
Risk Assessment
This is considered the most common reliable tool for determining adequacy and foreseeability and focuses on:
The risks to the physical assets and property
The protection measures (against any risk) that comprise the realm of physical security
Measuring three basic factors: quality, reliability and cost
This process is called a ________________.
a) Risk Analysis
b) Vulnerability Analysis
c) Security Survey
d) Loss Event Survey
Security Survey
These are described as the most important written instructions for the security force which express the policies of the protected enterprise, summarize required officer duties and provide a basis for site-specific training. They are called:
a) Corporate Policy & Procedures
b) Security Department Policy & Procedures
c) Security Post Orders
d) Security Training Manual
Security Post Orders
In the following formula, what does K equal? K = Cp + Ct + Cr + Ci − I Cp = cost of permanent replacement Ct = cost of temporary substitute Cr = total related costs (remove old asset, install new, etc.) Ci = lost income cost I = available insurance or indemnity a) Return on Investment (ROI) b) Cost of Loss (COL) c) Avoided Cost of Loss (ACOL) d) Incident Frequency Factor (IFF)
Cost of Loss (COL)
Which of the following processes places more focus on evaluating vulnerabilities?
a) Risk Assessment
b) Security Survey
c) Loss Event Likelihood Profile
d) Loss Event Impact Profile
Security Survey
Which of the following is suggested as part of evaluating an Inadvertent Threat?
a) Long-term data collected on weather and other natural hazards, terrains, and environments.
b) Evaluate information provided by neighboring businesses for natural events which have caused losses.
c) Unexpected natural events can occur so some degree of all-hazard preparedness is evaluated.
d) Utility interruptions, closure of access routes, unwanted attention or traffic, full or partial operation shutdowns and productivity disruptions.
Utility interruptions, closure of access routes, unwanted attention or traffic, full or partial operation shutdowns and productivity disruptions.
A measure which is based on a reference that involves at least two points, quantity over time, is called a ___________.
a) Qualitative process
b) Measurement indicator.
c) Quantity over time process.
d) Metric indicator.
Metric indicator.
A list of the kinds of threats or hazards affecting the assets to be protected in an organization is called a _____ _______ Profile.
a) Asset Identification
b) Loss Event
c) Loss Impact
d) Security Survey
Loss Event Profile
Collecting site historical loss data, neighborhood makeup/historical loss data, overall geographical location, political and social conditions is involved in the process of determining a loss event’s ________.
a) Impact
b) Criticality
c) Likelihood
d) Observability
Likelihood
When evaluating PPS solutions, including engineering, design, hardware and software costs is part of ______________.
a) Threat assessments
b) Life cycle cost estimates
c) Cost of loss estimations
d) Loss event likelihood estimates
Life cycle cost estimates
“A weakness or organizational practice that may facilitate or allow a threat to be implemented or increase the magnitude of a loss event”, is a definition of which of the following?
a) Loss event
b) Vulnerability
c) Risk
d) Criticality
Vulnerability
(SAMPLE RISK MATRIX) High-Medium-Low/Low-Moderate-High
The above matrix is an example of a _________ evaluation.
a) Quantitative
b) Qualitative
c) Substantive
d) Objective
Qualitative
Which of the following is a TRUE statement regarding threats and vulnerabilities?
a) Vulnerability is a characteristic of the organization and controllable to some degree.
b) Threats are a characteristic of the organization and controllable to some degree.
c) Vulnerabilities are usually outside the control of the organization.
d) Threats are all predictable using a properly applied threat assessment process.
Vulnerability is a characteristic of the organization and controllable to some degree.
Which of the following is considered part of developing an effective PPS using security-in-depth principles of the 4-D’s?
a) Deter, detect, delay, and deny
b) Deter, detect, delay, and dispatch
c) Detect, delay, dispatch and detain
d) Detect, delay, deny and dispatch
Deter, detect, delay, and deny
Which of the following is considered a “Direct Cost” when considering the costs of loss?
a) Long-term negative consumer perception.
b) Higher wages needed to attract future employees.
c) Deductible expenses on insurance claims.
d) Employee turnover due to poor employee morale.
Deductible expenses on insurance claims.
Which of the following is considered an “Indirect Cost” when considering the costs of loss?
a) Additional public relations costs to overcome poor image.
b) Punitive damage awards not covered by insurance.
c) Management time dealing with a disaster.
d) Lost business from immediate post-risk incident.
Additional public relations costs to overcome poor image.
A risk mitigation technique which provides for purchasing insurance to mitigate the security risk, is BEST described as which of the following?
a) Risk Acceptance
b) Risk Assumption
c) Risk Limitation
d) Risk Transfer
Risk Transfer
When applying risk mitigation techniques, it is often not practical to address all identified risks, so which of the following statements BEST explains how to mitigate the risk?
a) Priority should be given to the threat and vulnerability that have the most likelihood to occur.
b) Priority should be given to the asset–threat and vulnerability that have the potential to cause significant impact.
c) Priority should be given to the asset and vulnerability risk with highest likelihood.
d) Priority should be given to the asset and threat risk with highest likelihood.
Priority should be given to the asset–threat and vulnerability that have the potential to cause significant impact.
Based on simulation or actual tests, one can compute the time an access control system will take to process the peak number of access requests. For an efficient access control system, response time at any card reader should be no longer than ___________ at peak load.
a) 2 seconds
b) 5 seconds
c) 30 seconds
d) 60 seconds
2 seconds
“These diagrams show complete security subsystems, including all the devices and how they are connected in a building or campus”, they are BEST described as:
a) Elevation drawings
b) Plan drawings
c) Riser drawings
d) Details drawings
Riser drawings
This type of drawing shows an area in map-like form to specify where at a particular site the security devices are located. What type of drawing is this?
a) Plan Drawing
b) Elevation Drawing
c) Details Drawing
d) Riser Drawing
Plan Drawing
A risk mitigation technique which provides for the application of physical security, policy and procedures, deployed security officers all integrated to mitigate the security risk, is BEST described as which of the following?
a) Risk Acceptance
b) Risk Assumption
c) Risk Limitation
d) Risk Transfer
Risk Limitation
Which of the following is considered to have the most significant implementation cost as a risk mitigation measure?
a) Risk Transfer
b) Risk Avoidance
c) Risk Assumption
d) Site Hardening
Site Hardening
Which of the following is considered the MOST IMPORTANT phase in the PPS Life Cycle Phase?
a) Planning Phase
b) Design and Estimation Phase
c) Procurement Phase
d) Testing and Warranty Phase
Planning Phase
In this part of the Life Cycle Phase, security staff and other members of the project team develop all the necessary documentation to support the procurement of the PPS. This is BEST described in which phase?
a) The Planning Phase
b) The Design and Estimation Phase
c) The Procurement Phase
d) The Installation, Operation and Training Phase
The Design and Estimation Phase
When tests are performed by the implementation team which involve equipment, personnel, procedures, or any combination that simulate realistic conditions and provide conclusive evidence about the effectiveness of the security system, this is BEST described as which of the following?
a) Procurement Phase
b) Installation, Operation and Training Phase
c) Commissioning and Warranty Phase
d) Maintenance, Evaluation and Replacement Phase
Commissioning and Warranty Phase
