Pass the ASIS Physical Security Professional ASIS-PSP Questions and answers with CertsForce

When a contractor must perform work beyond the original scope of the contract, they submit a change-order request. This formal document details the additional work, associated costs, and justification, and requires approval from the project manager before proceeding.

A (Schedule-of-values request) is related to progress payments.

C (Scope change request) is typically initiated by the client.

D (Justification for change) might support a change-order, but it is not a formal request document.

A catastrophic virus causes widespread and often irrecoverable damage to data on a system and its connected devices. Such viruses are designed to rapidly corrupt, delete, or overwrite data, leading to system failure and loss of operational capability.

Innocuous Bug (A) implies minimal or no harm.

Hostile worm (C) can be destructive but is not a defined term for this scenario.

Trojan Horse (D) is deceptive but does not usually cause sudden widespread destruction immediately.

The correct answer is C. Performance test.

In PSP physical security system implementation, testing is used to verify whether security equipment and systems meet required performance requirements and success metrics. The ASIS PSP Body of Knowledge includes performance requirements, success metrics, commissioning, final acceptance testing, and life-cycle evaluation as part of physical security system design and implementation.

A performance test determines measurable operating parameters of the system or equipment. For intrusion detection sensors, these parameters can include probability of detection, false alarm rate, nuisance alarm rate, sensitivity, detection coverage, and other measurable performance characteristics. Sandia’s physical security testing guidance also identifies NAR/FAR — nuisance alarm rate/false alarm rate and probability of sensing as key sensor performance metrics collected from test results.

The other options are not the best answer:

A. Safety test focuses on whether testing or equipment creates unsafe conditions.

B. Evaluation test is broader and is used to validate overall PPS effectiveness, not mainly to determine specific parameters like nuisance alarm rate.

D. Post-maintenance test is conducted after maintenance to confirm the system still works properly.

Therefore, the correct answer is C. Performance test.

Comprehensive Detailed Explanation:

A core element of an effective key control policy is ensuring accountability for all keys. This includes maintaining logs, conducting regular audits, and verifying that issued keys are returned or accounted for. This reduces the risk of unauthorized access and is fundamental in access control strategies.

A and C are arbitrary numeric limits and not standard policy practice.

D may be part of policy but is not as critical as ongoing accountability.

The Transmission Control Protocol (TCP) works with IP as part of the TCP/IP suite. It divides data into packets, numbers them sequentially, and adds error detection and correction codes. This ensures that data is transmitted reliably, in order, and without loss or corruption.

File Transfer Protocol (B) uses TCP but does not handle packet creation itself.

Information Control Protocol (C) is not a recognized protocol.

“None of the above” (D) is incorrect because TCP is the correct answer.

Throughout the life of a project, the project manager spends the most time on control activities. This includes monitoring progress, managing changes, addressing issues, ensuring compliance with scope, cost, and schedule, and keeping stakeholders informed. Control is ongoing from initiation through closeout.

A (Documentation), B (Meetings), and C (Planning) are important but represent specific tasks or phases, not the most time-consuming activity overall.

A tort is a civil wrong for which a remedy may be obtained in the form of damages. It is based on the idea that individuals owe certain duties to others and can be held liable when they breach those duties, resulting in harm or injury.

Transitivity (A), Reassembly (C), and Procurement (D) are not related to civil legal liability.

An integrated approach to managing security risk includes both investment in proactive loss prevention techniques and the financial risk transfer method of insurance. Loss prevention helps reduce the probability and impact of incidents, while insurance ensures that if a loss does occur, the financial consequences can be absorbed or mitigated. Together, they form a balanced risk treatment strategy.

References from PSP: ASIS POA – Security and Risk Mitigation Strategies; PSP Study Guide – Operational and Strategic Measures

A network security policy defines the scope of security measures within an organization’s network. It sets the rules for behavior, outlines acceptable use, identifies protected resources, defines responses to security breaches, and lays out disciplinary measures for violations.

Physical security (A) focuses on tangible access control.

Forensic investigations (C) deal with post-incident evidence gathering.

Spam filtering (D) is a specific technical control, not a policy framework.

Vicarious liability refers to an indirect legal responsibility held by an organization for the actions or omissions of its employees or agents. This is particularly relevant in the security industry when an enterprise employs or contracts security personnel. If those personnel cause harm or violate rights while performing their duties, the employer can be held liable—even if the employer did not directly engage in the act.

Strict (A) refers to liability without fault.

Negligence (B) is direct liability due to carelessness.

Loose (D) is not a recognized legal term.