Free ASIS Physical Security Professional (PSP®) Exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the ASIS Physical Security Professional (PSP®) Exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1When planning a physical security risk assessment, what should its stated purpose identify?

   1. A. The findings the assessment will produce and the decisions it will support
   2. B. The personnel who will install the selected security equipment
   3. C. The construction specifications for every possible countermeasure
   4. D. The final acceptance tests for the future security system

   Answer: A

   Explanation: NIST directs assessors to "Identify the purpose of the risk assessment in terms of the information that the assessment is intended to produce and the decisions the assessment is intended to support." A plan should therefore state the intended output and decision use, rather than later procurement or implementation tasks.

   Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments — Section 3.1, Task 1-1

2. 2A security system's functional requirements are being drafted. What should each required security function specify?

   1. A. Functions across relevant states and operating modes
   2. B. Only the preferred model number of each component
   3. C. Only the organization's future training calendar
   4. D. Only the final contractor payment schedule

   Answer: A

   Explanation: NIST directs engineers to "Define each security function that the system is required to perform" and says functions are defined for all operating states and modes. Function statements describe required behavior before product selection.

   Reference: NIST SP 800-160: Systems Security Engineering — Section 3.4.3, SR-2.1

3. 3For a complex federal sealed-bid security project, what is the principal role of a pre-bid conference?

   1. A. Brief prospective bidders and explain complicated specifications before bid opening
   2. B. Replace the written invitation with verbal instructions from the project team
   3. C. Select the winning bidder before responses are submitted
   4. D. Approve contract changes after the award has been signed

   Answer: A

   Explanation: FAR 14.207 permits a conference "as a means of briefing prospective bidders and explaining complicated specifications and requirements" before opening. It is an explanation forum.

   Reference: Federal Acquisition Regulation, Part 14—Sealed Bidding — FAR 14.207

4. 4A security manager is defining what a facility risk assessment will cover. Which choice describes the scope of that assessment?

   1. A. The applicable parts of the organization, time frame, and relevant system context
   2. B. The final vendor shortlist, contract terms, and purchase approvals
   3. C. The tested alarm settings, as-built drawings, and operator training
   4. D. The raw incident count alone, without organizational boundaries

   Answer: A

   Explanation: NIST says to "Identify the scope of the risk assessment in terms of organizational applicability, time frame supported, and architectural/technology considerations." These are scope boundaries; vendor selection and installation deliverables follow other work.

   Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments — Section 3.1, Task 1-2

5. 5A proposed access control design meets normal operating needs but fails during a power transition. Which requirement issue does that reveal?

   1. A. Cover transitions between operating states
   2. B. A system must be assessed only in its normal state
   3. C. Equipment price determines every system mode
   4. D. A transition failure is solely a procurement issue

   Answer: A

   Explanation: NIST says required security functions include "the associated transitions between system states and modes." A design that works only before or after a transition leaves a functional gap.

   Reference: NIST SP 800-160: Systems Security Engineering — Section 3.4.3, SR-2.1

6. 6At a pre-bid conference for a federal sealed-bid security system, the agency discovers an ambiguous device specification. How should it formally correct the invitation?

   1. A. Issue a written amendment to the invitation for bids
   2. B. Treat the conference discussion alone as the revised specification
   3. C. Ask each bidder to interpret the ambiguity independently
   4. D. Wait until after award and select the interpretation used by the winner

   Answer: A

   Explanation: FAR 14.208 says changes to correct a defective or ambiguous invitation "shall be accomplished by amendment of the invitation for bids". A meeting statement alone does not make the formal change.

   Reference: Federal Acquisition Regulation, Part 14—Sealed Bidding — FAR 14.208(a)

7. 7Why should an assessment plan state its key assumptions and constraints explicitly?

   1. A. To make the selected risk model and results clearer and more repeatable
   2. B. To eliminate uncertainty from all threat and impact estimates
   3. C. To guarantee that the same countermeasure suits every facility
   4. D. To replace the need to define the assessment's scope

   Answer: A

   Explanation: NIST states, "By making assumptions and constraints explicit, there is greater clarity in the risk model selected for the risk assessment, increased reproducibility/repeatability of assessment results". It does not claim that documenting assumptions eliminates uncertainty.

   Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments — printed p. 1-3, Identify Assumptions and Constraints

8. 8Why should a security design requirement be traceable to the stakeholder's protection need?

   1. A. It shows how the technical requirement addresses the original need
   2. B. It replaces the need to measure system performance
   3. C. It proves that every vendor proposal will be compliant
   4. D. It determines the final installation labor rate

   Answer: A

   Explanation: NIST identifies "Traceability of system security requirements and associated constraints to stakeholder security requirements" as an engineering outcome. Traceability helps ensure a technical requirement has a justified protection purpose.

   Reference: NIST SP 800-160: Systems Security Engineering — Section 3.4.3, Systems Security Engineering Outcomes

9. 9During a federal sealed-bid security procurement, a bidder receives clarification needed to prepare a bid. What is the proper treatment of that clarification when other bidders would be disadvantaged without it?

   1. A. Amend the invitation and notify prospective bidders
   2. B. Keep it private because the first bidder asked the question
   3. C. Tell only bidders who attended the pre-bid meeting
   4. D. Provide it after bid opening when prices are known

   Answer: A

   Explanation: FAR 14.208(c) states that necessary or potentially prejudicial information "shall be furnished promptly to all other prospective bidders as an amendment to the invitation". Equal access governs this clarification.

   Reference: Federal Acquisition Regulation, Part 14—Sealed Bidding — FAR 14.208(c)

10. 10Before conducting a physical security risk assessment, which information inputs should the plan identify?

    1. A. Sources of threat, vulnerability, and impact information
    2. B. Only the prices of security devices offered by bidders
    3. C. Only the final acceptance criteria for installed systems
    4. D. Only the names of personnel assigned to contract management

    Answer: A

    Explanation: The preparation summary says to "Identify sources of threat, vulnerability, and impact information to be used in the risk" assessment. Those sources support risk analysis, whereas bids and acceptance criteria concern later procurement and implementation.

    Reference: NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments — printed p. 1-4, Summary of Key Activities