Free Practice Questions for ASIS ASIS-PSP Exam

Pass systems are security control mechanisms used to manage access to restricted or sensitive areas within a facility. The common types of pass systems include:

Single Pass System: A permanent pass assigned to the user, typically used throughout employment unless access levels change.

Multiple Pass System: Involves multiple types of passes for different access levels or time periods.

Pass-Exchange System: A system requiring the surrender or exchange of one pass for another at checkpoints or entry to more restricted areas.

" Pass-control system " is not recognized as a distinct type of pass system in security literature and is not classified within the known categories defined in the ASIS Protection of Assets (POA) Manual or PSP certification materials.

Comprehensive Detailed Explanation:

Identity theft is the act of obtaining and using someone else ' s personal or financial information—such as social security numbers, bank details, or credit card information—without permission, often for committing fraud or other criminal activities.

Identity fraud (A) refers to the actual fraudulent acts committed after the identity is stolen.

Identity dissemination (C) and Identity distortion (D) are not standard legal or cybersecurity terms.

Annual Loss Expectancy (ALE) is a key financial metric used in risk management to estimate the potential dollar loss per year due to a specific risk. It is calculated as:

ALE = Single Loss Expectancy (SLE) × Annual Rate of Occurrence (ARO).

This helps quantify the financial impact of a threat, allowing better prioritization and budgeting for mitigation efforts.

B (Probability) is part of the ALE calculation but not a dollar-value measure.

C (Criticality) relates to function importance but not direct financial impact.

D (Risk) is broader and includes impact and likelihood, but ALE specifically quantifies impact in dollars.

Exterior lighting systems should be formally evaluated at installation and then at least annually to ensure proper function, coverage, and maintenance. Routine checks may occur more frequently, but full surveys are typically annual unless conditions dictate otherwise.

A, B, and C may be appropriate for operational checks, but not full surveys.

The correct answer is D. retinal pattern recognition.

In PSP physical security design, access control is part of integrated physical security systems and countermeasure implementation. ASIS describes the PSP credential as covering physical security assessments, integrated physical security systems, and implementation/evaluation of security measures.

Retinal pattern recognition is a biometric access control method. It verifies a person based on a unique physical characteristic rather than something the person carries or knows. Biometric authentication uses unique body characteristics such as retinas, fingerprints, facial structure, or other biological traits for security and authentication.

The other options provide lower security by comparison:

A. Proximity card — possession-based credential; it can be lost, stolen, shared, or cloned.

B. Computer-controlled keypad — knowledge-based credential; PINs can be observed, guessed, shared, or compromised.

C. Smart card — stronger than a basic proximity card, but still a possession-based credential unless combined with PIN or biometric verification.

D. Retinal pattern recognition — biometric; tied directly to the individual and therefore provides the highest level of security among the listed options.

Therefore, for a high-security area such as a data center, the best answer is D. retinal pattern recognition.

A crime is defined as a voluntary and intentional violation of a law by someone who is legally competent. It involves breaking a legal duty meant to protect society. This can include actions that are prohibited or omissions where action was legally required.

Corruption (A) is a specific type of crime involving abuse of power.

Law-breaking (B) is a general, non-legal term.

Fault (C) is too broad and often used in civil contexts.

Comparative fault, also known as comparative negligence, is a legal principle where the plaintiff’s own actions are taken into account when determining liability and awarding damages. If a person contributed to their own injury—e.g., by entering a restricted area—their compensation may be reduced proportionally to their share of fault.

Control tactics (A) and Defensive control (C) relate to use-of-force procedures, not legal doctrines.

This definition matches the U.S. Department of State and ASIS definitions of terrorism. It highlights the political and psychological components of terrorism, including the targeting of civilians and the intent to instill fear or send a political message.

The first step in a risk analysis is to identify or recognize potential threats. Before assessing vulnerabilities or selecting countermeasures, a security practitioner must know what they are defending against. This forms the foundation for the rest of the risk assessment process.

A (Selecting countermeasures) is done after analyzing risks.

B (Vulnerability assessment) follows threat identification.

C (Determining costs) happens later in the risk evaluation phase.

Proprietary security services are those in which the security personnel are hired, trained, and managed directly by the organization they protect. They are part of the company’s staff and are not outsourced from external firms. Proprietary security typically ensures tighter integration with company culture and policies and offers better control over personnel and procedures.

Contract security services (Answer D) involve third-party firms providing personnel who are not employees of the protected organization.

Security enforcement (Answer B) is a general term, not a specific classification.

Pilferage (Answer C) refers to theft and is unrelated to service type.