SPED CERT PHYSICAL SECURITY RMF QUESTIONS AND
ANSWERS #11 2026
Lighting, weapons, closed circuit TV, fences, and locking mechanisms are examples of
what category of Countermeasure?
Procedural
Facilities
Training
Equipment - correct answer Equipment
An asset value should be assigned based on the perspective of the
_________________
Asset Manager
Chief of Security
Program Manager
Asset Owner - correct answer Asset Owner
You are the one who decides what constitutes an acceptable level of risk for an
organization's assets.
Ture
False - correct answer False
Which of the following questions are used to identify an adversary's intent? (Select all
that apply)
What are the vulnerabilities to the risk management system?
What are the adversary's goals?
What level of risk are the adversaries likely to accept?
Are the adversaries willing to get caught? - correct answer What are the adversary's
goals?
What level of risk are the adversaries likely to accept?
Are the adversaries willing to get caught?
After you've completed all other steps, what final chart would you use to summarize and
record your information in order to get the total cost for all countermeasures?
Intent Assessment Chart
Collection Capability Assessment Chart
Threat Assessment Summary Chart
Countermeasure Analysis Chart - correct answer Countermeasure Analysis Chart
To assist in analyzing threat data, adversaries are typically grouped into all EXCEPT
which of the following categories?
, Organizations
Companies
Governments
Individuals - correct answer Companies
After completing the vulnerability assessment in the risk management process, the next
step is the __________ assessment.
Countermeasures
Cost/Benefit
Risk
Assest - correct answer Risk
After completing the threat assessment step of the risk management process, what step
be completed next?
Assest assessment
Countermeasure determination
Cost/benefits analysis
Vulnerability assessment - correct answer Vulnerability assessment
Which of the following is NOT a good interview question for determining an adversary's
history?
Does the adversary have the weapons or tools for exploiting or attacking an asset?
Has the adversary attacked or exploited assets and personnel before?
Has the adversary been suspected of attacking or exploiting assets?
Might some foreseeable event cause the adversary to attempt to attack in the future? -
correct answer Has the adversary been suspected of attacking or exploiting assets?
Which of the following is one of the five categories of assets?
Facilities
Countermeasures
Vulnerabilities - correct answer Facilities
Using the formula R=(I[txv]) which of the examples below poses the highest risk:
Asset is assessed as 3 (low), threat is assessed as .75 (critical), and the vulnerability is
assessed as a .74 (high).
Asset is assessed as 13 (medium), threat is assessed as .50 (high), and the
vulnerability is assessed as a .74 (high).
Asset is assessed as 80 (critical), threat is assessed as .24 (low), and the vulnerability
is assessed as a .37 (medium). - correct answer Asset is assessed as 80 (critical),
threat is assessed as .24 (low), and the vulnerability is assessed as a .37 (medium).
ANSWERS #11 2026
Lighting, weapons, closed circuit TV, fences, and locking mechanisms are examples of
what category of Countermeasure?
Procedural
Facilities
Training
Equipment - correct answer Equipment
An asset value should be assigned based on the perspective of the
_________________
Asset Manager
Chief of Security
Program Manager
Asset Owner - correct answer Asset Owner
You are the one who decides what constitutes an acceptable level of risk for an
organization's assets.
Ture
False - correct answer False
Which of the following questions are used to identify an adversary's intent? (Select all
that apply)
What are the vulnerabilities to the risk management system?
What are the adversary's goals?
What level of risk are the adversaries likely to accept?
Are the adversaries willing to get caught? - correct answer What are the adversary's
goals?
What level of risk are the adversaries likely to accept?
Are the adversaries willing to get caught?
After you've completed all other steps, what final chart would you use to summarize and
record your information in order to get the total cost for all countermeasures?
Intent Assessment Chart
Collection Capability Assessment Chart
Threat Assessment Summary Chart
Countermeasure Analysis Chart - correct answer Countermeasure Analysis Chart
To assist in analyzing threat data, adversaries are typically grouped into all EXCEPT
which of the following categories?
, Organizations
Companies
Governments
Individuals - correct answer Companies
After completing the vulnerability assessment in the risk management process, the next
step is the __________ assessment.
Countermeasures
Cost/Benefit
Risk
Assest - correct answer Risk
After completing the threat assessment step of the risk management process, what step
be completed next?
Assest assessment
Countermeasure determination
Cost/benefits analysis
Vulnerability assessment - correct answer Vulnerability assessment
Which of the following is NOT a good interview question for determining an adversary's
history?
Does the adversary have the weapons or tools for exploiting or attacking an asset?
Has the adversary attacked or exploited assets and personnel before?
Has the adversary been suspected of attacking or exploiting assets?
Might some foreseeable event cause the adversary to attempt to attack in the future? -
correct answer Has the adversary been suspected of attacking or exploiting assets?
Which of the following is one of the five categories of assets?
Facilities
Countermeasures
Vulnerabilities - correct answer Facilities
Using the formula R=(I[txv]) which of the examples below poses the highest risk:
Asset is assessed as 3 (low), threat is assessed as .75 (critical), and the vulnerability is
assessed as a .74 (high).
Asset is assessed as 13 (medium), threat is assessed as .50 (high), and the
vulnerability is assessed as a .74 (high).
Asset is assessed as 80 (critical), threat is assessed as .24 (low), and the vulnerability
is assessed as a .37 (medium). - correct answer Asset is assessed as 80 (critical),
threat is assessed as .24 (low), and the vulnerability is assessed as a .37 (medium).
