Browse all questions

The figures these questions turn on, laid out by section on dense colour pages you can print: California Guard Card cheat sheet PDF — $9.99 →

Own the complete California Guard Card (BSIS Security Guard) guide — PDF + EPUB, $9.99 →

Every question with its answer and explanation — study by topic or all at once.

Communication & PR

20 questions
7. A well-written security incident report should be characterized primarily by:
a.Clarity, brevity, and factual accuracy — written so a stranger reading later understands what happened✓
b.Vivid adjectives and emotional language that convey to whoever reads it later just how serious the incident really was on the night
c.Legal conclusions stating whether the suspect committed a crime and precisely which statute was broken by the conduct described
d.The author's own personal opinions about each of the parties involved and about how they conducted themselves throughout the encounter

BSIS report-writing standards emphasize clarity, brevity, and accuracy. Reports must convey who, what, when, where, why (if known), and how, using neutral observable facts rather than conclusions or opinions. Emotional language (b) undermines credibility in court; legal conclusions (c) are reserved for prosecutors, judges, and juries; opinions (d) expose the writer and the employer to defamation claims. The standard test: a reader who was not present should understand the incident from the report alone.

BSIS report-writing standards; CSI principle: clarity, brevity, accuracy
8. Local news reporters arrive after an incident and ask the security officer for details. The correct response is generally to:
a.Decline to comment on details, refer the reporter to the contracting client or designated employer spokesperson, and notify a supervisor✓
b.Provide a full account of the incident on the spot, so that the version that reaches the public is accurate and first-hand rather than pieced together from rumour
c.Speculate about what might have happened in order to fill the gaps in the information, since a partial account with obvious holes in it does more damage to the client than a complete one
d.Demand to see the reporter's press credentials and order them off the property at once

Standard BSIS guidance is that security officers do not speak for the client or the security company. Reporters should be politely referred to the client's designated spokesperson (often public relations or risk management) and the security officer must notify their supervisor immediately. Unauthorized statements (b, c) risk defaming parties, prejudicing investigations, and violating contracts. Demanding credentials and ordering reporters off public-accessible space (d) can create First Amendment and trespass disputes; the officer enforces the client's lawful access rules without unnecessary confrontation.

BSIS press/media protocol; client/employer chain of command
9. A representative from a city department arrives requesting access to the client's facility to conduct a code inspection. The officer should:
a.Refuse all access outright, since government officials have no special authority on privately owned property and may only enter with the owner present
b.Grant full access immediately, because refusing any request from a government inspector is itself unlawful and exposes the client to a penalty
c.Verify identification, follow the client's written posting and visitor policies, and notify a supervisor or the client contact before granting access beyond public areas✓
d.Detain the official until the client returns to the site and can decide personally whether the inspection should be allowed to go ahead, since only the owner can waive the right to exclude a visitor

Government officials operating outside a warrant or exigent-circumstance authority do not have automatic entry rights to private property. BSIS chain-of-command protocol directs the officer to verify identification, consult the client's posted procedures (which often distinguish routine visits from inspections requiring management presence), and notify the appropriate supervisor or client contact. Blanket refusal (a) may obstruct lawful authority; blanket admission (b) violates the client's policies; detention (d) lacks legal basis and exposes the officer to false-imprisonment liability.

BSIS chain-of-command protocol; client communication policies
10. The Americans with Disabilities Act (42 U.S.C. §12101 et seq.) requires public accommodations to provide reasonable accommodations to individuals with disabilities. For a security officer, the most accurate practical implication is:
a.Disabled visitors must produce written medical documentation of the disability before any accommodation is provided to them
b.Adjust standard procedures (e.g., communication method, route, response time) where reasonable to allow effective access, and welcome service animals as defined by the ADA✓
c.Service animals other than guide dogs may be excluded from the premises, since the statute names only dogs trained to lead the blind
d.The ADA applies only to government employees and public buildings, and not to security guards working in retail or commercial settings that are privately owned and operated for profit

Title III of the ADA (42 U.S.C. §12181 et seq.) requires places of public accommodation to provide reasonable modifications to policies and procedures and to allow service animals (limited to dogs and, in some cases, miniature horses, individually trained to do work for a person with a disability). Documentation is generally not required (a); only two questions are permitted regarding service animals — (1) is the animal required because of a disability and (2) what work or task is it trained to perform. Most retail and commercial settings are public accommodations covered by Title III (d is wrong). Excluding properly trained service animals (c) violates federal law.

Americans with Disabilities Act, 42 U.S.C. §12101 et seq.; Title III public accommodations
11. California is one of the most linguistically diverse states. When interacting with a limited-English-proficiency (LEP) individual, an officer should:
a.Use simple vocabulary, gestures, and any available translation tools or interpreters; avoid using minor children as interpreters✓
b.Speak more loudly and more slowly while using exactly the same English vocabulary, since volume and pace are what carry meaning across a language gap
c.Refuse to communicate at all until the person is able to make themselves understood in English
d.Assume that any limited-English speaker is undocumented and notify federal immigration authorities before continuing with the encounter at all

Best practice for LEP interactions, reinforced by California's Dymally-Alatorre Bilingual Services Act and federal civil-rights principles, is to use simple vocabulary, visual cues, professional translation services, or bilingual coworkers — not to rely on minor children, which is discouraged because of confidentiality and developmental concerns. Louder English (b) does not aid comprehension. Refusing service (c) is a civil-rights violation. Reporting based solely on perceived language ability (d) is unlawful profiling and contrary to California's status as a sanctuary jurisdiction under SB 54 (the California Values Act).

California Dymally-Alatorre Bilingual Services Act; LEP best practice
12. California's Unruh Civil Rights Act (Civil Code §51) prohibits business establishments from discriminating based on protected characteristics. Under Unruh, an LGBTQ+ guest:
a.Is entitled to the same full and equal accommodations, advantages, facilities, privileges, and services as any other guest✓
b.May be required to use a designated entrance for security reasons, provided that the alternative entrance is kept clean, well lit and staffed
c.May be denied entry wherever the security officer personally disapproves of the guest, since a private business is free to choose whom it serves
d.Has rights under the statute only while accompanied by an attorney who is able to assert those rights on the guest's behalf at the door

Civil Code §51 — the Unruh Civil Rights Act — guarantees all persons in California 'full and equal accommodations, advantages, facilities, privileges, or services' regardless of sex, race, color, religion, ancestry, national origin, disability, medical condition, genetic information, marital status, sexual orientation, citizenship, primary language, immigration status, or gender identity and expression. Differential entry routes (b), personal-belief refusals (c), or attorney-presence requirements (d) violate the Act and expose the business and the officer to statutory damages (currently up to $4,000 per violation plus attorney's fees) and injunctive relief.

Civil Rights Act of 1964 (Title II/VII); California Unruh Civil Rights Act, Civ Code §51
13. BSIS standards for guard appearance and uniform serve which primary purposes?
a.To distinguish security officers from peace officers, ensuring that no impersonation occurs, and to project professional credibility to the members of the public
b.To physically protect the officer from injury during a struggle, since the uniform fabric and the equipment belt are designed as protective gear rather than as identification
c.Both visible authority recognition (so the public knows whom to ask for help) AND prevention of impersonation of peace officers (BPC §7582.26 prohibits using insignia, uniforms, or vehicles that could be mistaken for law enforcement)✓
d.To allow off-duty officers to continue exercising their authority while they are not actually working a shift, so that a guard in uniform is always recognised as on duty

BSIS uniform standards balance two goals captured in (c): the public should recognize the security officer as available for assistance, and the uniform must clearly differ from law enforcement. Business & Professions Code §7582.26 prohibits guards from using badges, insignia, or vehicle markings that could cause a reasonable person to mistake them for sworn peace officers. (a) is partly true but incomplete; (b) confuses uniform with body armor; (d) is illegal — off-duty officers have no special authority and may not represent themselves as on-duty.

BSIS appearance standards; BPC §7582.26
14. A security guard is offered a $100 cash 'tip' by a visitor in exchange for letting them park in a restricted lot. Under BSIS ethical standards the guard should:
a.Accept the tip and grant the favour, since minor courtesies of this kind are common on commercial sites
b.Accept the tip but record it in the daily activity log for transparency, so that the supervisor can see afterwards exactly what was offered and what was given in return
c.Decline the tip but grant the favour anyway, since it is the money and not the parking space that would create the appearance of a conflict of interest
d.Decline the tip, deny the favor (it violates the client's policy), and document the bribery attempt in an incident report to the supervisor✓

Accepting compensation in exchange for ignoring or violating client policy is a textbook ethical violation and may constitute commercial bribery (PC §641.3) when in excess of $250 or a pattern of gratuities. Even small gratuities undermine trust and create future leverage. The correct response (d) is to decline both the money and the favor, and to report the attempt — which protects the officer, the employer, and the client. Documenting acceptance (b) does not cure the violation. Doing the favor for free (c) still violates client policy.

BSIS ethics curriculum; professional integrity standards
15. After an incident on a client's property, the security officer is approached at a bar by friends asking 'who got arrested?' The officer should:
a.Share the details freely, since an incident becomes a matter of public knowledge the moment police cars arrive at the scene with their lights on
b.Decline to discuss specifics; details of an incident are confidential to the client and the involved parties, and idle disclosure can violate privacy and expose the officer and employer to defamation or invasion-of-privacy claims✓
c.Share only the suspect's name but none of the surrounding details, on the view that a name by itself reveals nothing that a bystander standing outside could not have seen for themselves anyway
d.Discuss the matter freely for as long as no recording device is present anywhere in the room and nobody within earshot is writing any of it down

Incident information collected in the course of duty is the property of the client and the employer and is treated as confidential. Casual disclosure can defame uninvolved parties, identify victims (especially of sexual assaults, domestic violence, or juvenile incidents — protected by California Welfare & Institutions Code and other privacy regimes), prejudice ongoing investigations, and breach the security company's contract. Even police-attended incidents are not automatically 'public' until the agency releases information through its formal channels (a, c, d are all wrong).

BSIS confidentiality standards; CCPA / privacy duties
16. A security officer observes a fellow guard pocketing items from a recovered shoplifting incident. The officer reports the conduct to the supervisor and to BSIS. California Labor Code §1102.5 generally:
a.Allows the employer to terminate the reporting officer immediately, since going outside the company breaches the duty of loyalty an employee owes
b.Provides no protection at all for private-sector employees, because the statute reaches only public agencies
c.Prohibits the employer from retaliating against an employee for disclosing a reasonably believed violation of state or federal law to a supervisor or government agency✓
d.Requires the reporting officer to obtain a court order before making any report to a government agency, so that the disclosure is judicially authorised in advance of it being made

California Labor Code §1102.5 (amended significantly in 2014 and updated thereafter) prohibits employers from retaliating against employees who disclose information they reasonably believe shows a violation of state or federal statute or regulation, to a person with authority to investigate or correct the violation — including supervisors and government agencies such as BSIS. Remedies include reinstatement, back pay, and civil penalties. Retaliation (a) is itself unlawful; the statute applies to private employers (b); no court order is needed (d). Reporting unethical conduct is consistent with BSIS ethical duties.

California Labor Code §1102.5 (whistleblower protections)

Want these explained in order? California Guard Card — Complete Study Guide (2026) — PDF + EPUB, $9.99 · 14-day refund →

17. A clearly intoxicated and confused person is sitting in the lobby. Best-practice BSIS guidance for a security officer is to:
a.Forcibly escort the person out to the street regardless of what their medical condition might be, since a lobby is not a place for anybody to sleep
b.Speak calmly, ensure the person is safe, request medical or police evaluation if needed (intoxication can mask diabetic emergency, head injury, or other medical issues), and document✓
c.Lock the person into a back office until they have sobered up enough to leave the site safely under their own power without assistance
d.Search through the person's pockets for identification without asking them first, so that the incident report can name whoever was involved

Intoxication can mask life-threatening conditions including diabetic emergencies, head injuries, stroke, hypothermia, and overdose. BSIS guidance and officer-survival principles call for a calm tone, safety assessment, and prompt request for medical or law-enforcement evaluation (paramedics, fire, or peace officers who can invoke W&I §5150 if applicable). Forcible removal (a) risks injury and false-imprisonment / battery claims; isolation in a locked room (c) is unlawful detention; searches without consent (d) exceed limited-search authority. Document observations factually.

BSIS training; vulnerable-population guidelines; W&I Code §5150 reference
18. 'Verbal Judo' / tactical communication training, often referenced in BSIS de-escalation curricula, centers on which core principle?
a.Generating voluntary compliance through empathy, professional courtesy, and treating people with dignity — even when issuing lawful commands✓
b.Using verbal commands as loudly and as repeatedly as may be necessary until the subject finally complies with whatever has been asked of them
c.Mocking subjects into compliance through humour, on the view that a person who has been made to look foolish will stop resisting
d.Refusing to speak with subjects at all, and communicating only through physical gestures so that nothing the officer says can later be quoted back

Verbal Judo, developed by Dr. George Thompson, teaches officers to seek voluntary compliance through empathy, calm tone, professional courtesy, and treating subjects with dignity. Core skills include LEAPS (Listen, Empathize, Ask, Paraphrase, Summarize) and offering choices that preserve the subject's face. Yelling (b), mockery (c), and silence (d) escalate, damage credibility, and provoke complaints and civil litigation. The technique improves both outcomes and officer safety by reducing the frequency of physical confrontations.

Dr. George Thompson, 'Verbal Judo'; BSIS de-escalation curriculum
19. Cultural competency in security work means the officer:
a.Stereotypes individuals on the basis of visible characteristics in order to speed up decision-making on a busy site
b.Treats every cultural group in exactly the same way and ignores cultural differences entirely, so that nobody can complain of being singled out
c.Recognizes that cultural norms (eye contact, personal space, gender interaction, religious dress) vary, and adapts communication accordingly while applying policies equally✓
d.Refuses service to anyone whose customs differ from the officer's own, in order to avoid a misunderstanding that might escalate

Cultural competency is the ability to recognize that behaviors interpreted as 'suspicious' or 'rude' may simply reflect cultural norms — e.g., averted eye contact may signal respect in some cultures, modesty in dress may carry religious meaning, gendered greeting practices vary widely. The competent officer adapts communication while applying client policy uniformly. Stereotyping (a) leads to bias-based policing; treating everyone identically (b) is the older 'colorblind' model that misses important context; refusing service (d) likely violates Unruh and federal civil-rights law.

BSIS communication training; cultural-competency principles
20. A security officer is assigned to a retail client. The officer's spouse is the store manager being investigated for inventory theft. The officer should:
a.Continue with the assignment and investigate the spouse personally, in order to demonstrate objectivity and to show that no favour is being shown
b.Disclose the relationship to the security company supervisor and request reassignment to avoid a conflict of interest✓
c.Quietly tip off the spouse so that they have time to prepare a defence before the client's own investigation reaches them
d.Resign from the security company without offering any explanation to the supervisor about why the assignment is a problem

BSIS ethics standards require officers to avoid conflicts of interest and to disclose relationships that could compromise objectivity. Reassignment (b) protects the integrity of the investigation, the officer's career, and the security company's contract. Investigating a family member (a) creates legal and ethical exposure (witness tampering, evidence destruction). Tipping off the spouse (c) is potentially obstruction of justice (PC §136.1) and grounds for criminal charges. Unexplained resignation (d) abandons the duty to report and may itself raise suspicion.

BSIS communication training; conflict-of-interest principles

Emergency & Safety

20 questions
1. The PASS acronym for operating a portable fire extinguisher stands for:
a.Push (the lever down), Aim (at the top of the flames), Spray (in short bursts), Stop (once the smoke clears)
b.Pull (the tag off), Activate (the valve), Squeeze (the trigger), Survey (the room once it is out)
c.Pull (the pin), Aim (at the base of the fire), Squeeze (the handle), Sweep (side to side)✓
d.Prepare (the extinguisher), Approach (the fire), Stop (at a safe distance), Spray (steadily until out)

PASS — Pull, Aim, Squeeze, Sweep — is the standard portable-extinguisher operation procedure adopted by NFPA 10 and taught in BSIS emergency-response modules. Pull the pin to disable the safety; Aim the nozzle at the base of the flames (not the smoke or tops); Squeeze the handle to discharge; Sweep side to side across the base until the fuel is extinguished. The acronym is paired with the rule that extinguishers are only for incipient (small, contained) fires; if a fire is larger than a wastebasket, evacuate and call 911 — do not attempt suppression.

NFPA 10 (portable fire extinguishers); PASS acronym
2. Which fire extinguisher class is rated specifically for kitchen cooking-oil and animal-fat fires?
a.Class K✓
b.Class A
c.Class B
d.Class C

Class K extinguishers (potassium acetate or potassium citrate solution producing saponification) are designed for commercial-kitchen cooking-oil and animal-fat fires, which cannot safely be extinguished with water. Class A handles ordinary combustibles (wood, paper, cloth); Class B handles flammable liquids (gasoline, oil); Class C handles energized electrical equipment; Class D handles combustible metals (magnesium, lithium). Using the wrong class can be catastrophic — water on a grease fire causes a fireball; water on energized equipment can electrocute the operator.

NFPA 10; portable extinguisher classification
3. In a phased (rather than full) building evacuation, the typical pattern is:
a.Evacuate the fire floor first, then the floors immediately above and below, with additional floors as conditions require✓
b.Evacuate the entire building floor by floor, starting from the very top floor and working steadily downwards toward the street below
c.Evacuate only the floor on which the fire is actually burning, leaving every other floor in the building exactly where it is
d.Evacuate only after the fire department has arrived on scene and has given a verbal all-clear to begin moving people out of the building

Phased evacuation, used in tall buildings where total evacuation could overwhelm stairwells and impede fire-department access, evacuates the fire floor first and then the floors immediately above and below as the highest-risk areas. Additional zones evacuate as the situation develops. Total simultaneous evacuation (b) can paradoxically delay egress and trap occupants; floor-only evacuation (c) ignores the rapid vertical spread of smoke and heat; waiting for verbal clearance (d) delays life-safety action when seconds matter.

NFPA 101 Life Safety Code; building evacuation principles
4. An officer finds an unresponsive person in a hallway. The first action under standard BSIS emergency procedures is:
a.Immediately begin chest compressions before assessing the scene at all, since every second that passes without circulation costs brain tissue
b.Move the person to a more comfortable location before assessing them, so that the assessment is not being carried out on a hard tiled floor
c.Ensure the scene is safe, call 911 (or have someone call), check responsiveness and breathing, then provide care within training✓
d.Wait until the person regains consciousness on their own before acting

Standard emergency-response sequence is scene safety first (the officer is no help if they become a second casualty), then call 911 (or direct a specific person to call), then assess responsiveness and breathing, then provide care within trained scope (CPR, AED, bleeding control). Compressions before assessment (a) wastes effort if the person is breathing; moving the patient (b) risks aggravating spinal or other injuries; waiting passively (d) costs critical minutes in cardiac arrest, where survival drops roughly 10% per minute without intervention.

BSIS emergency-response training; California EMS Authority guidelines
5. California Civil Code §1714.21 provides immunity for lay rescuers who use an Automated External Defibrillator (AED). The immunity:
a.Requires the rescuer to be a licensed medical professional acting within scope
b.Generally protects a lay rescuer who uses an AED in good faith, without compensation, during an emergency, from civil liability for resulting injury✓
c.Applies only where the rescuer has signed a liability waiver beforehand
d.Eliminates all liability of every kind, including liability for gross negligence and for wilful misconduct by the rescuer during the emergency itself

Civil Code §1714.21 provides Good Samaritan protection for lay AED users acting in good faith and without compensation during a medical emergency. The immunity does NOT extend to gross negligence or willful misconduct (d), and it does require certain employer compliance for AED programs (training, maintenance, signage). It does not require medical licensure (a) — the whole point is encouraging bystander use. No waiver is needed (c). California has adopted these protections specifically to encourage AED deployment in workplaces and public buildings.

California Civil Code §1714.21 (AED Good Samaritan immunity)
6. Current American Heart Association CPR guidelines call for adult chest compressions at a rate of approximately:
a.60 to 80 compressions per minute, to a depth of about one inch
b.80 to 100 compressions per minute, at a deliberately shallow depth
c.150 to 180 compressions per minute, going as fast as is possible
d.100 to 120 compressions per minute, at a depth of at least 2 inches✓

Current AHA Basic Life Support guidelines recommend chest compressions of at least 100 to 120 per minute for adults, at a depth of at least 2 inches but no more than 2.4 inches, allowing full chest recoil between compressions, and minimizing interruptions. The cadence matches the beat of songs such as 'Stayin' Alive.' Too slow (a, b) reduces perfusion; too fast (c) prevents full chest recoil and refilling. For untrained bystanders, hands-only CPR (continuous compressions without rescue breaths) is acceptable and effective.

American Heart Association (AHA) CPR Guidelines (current edition)
7. A conscious adult is clutching their throat and unable to speak or cough. The trained first response is:
a.Have the person lie flat on their back on the floor and begin chest compressions straight away without waiting for anything else
b.Deliver abdominal thrusts (Heimlich maneuver) — stand behind, place a fist above the navel, and thrust inward and upward until the object is expelled or the person becomes unresponsive✓
c.Encourage the person to drink several glasses of water in order to wash the obstruction the rest of the way down into the stomach
d.Insert your fingers into the person's throat to retrieve the object, whether or not the object can actually be seen from outside

For a conscious adult choking on a foreign object (universal sign: hands at throat, unable to speak/cough/breathe), the standard intervention is abdominal thrusts (Heimlich maneuver) — fist placed just above the navel and below the rib cage, sharp inward and upward thrusts. If the person becomes unresponsive, lower them to the ground and begin CPR, checking the mouth for the object before each set of breaths. Blind finger sweeps (d) can push objects deeper. Water (c) can aspirate into the lungs. Lying flat first (a) loses gravity assistance.

American Red Cross choking response; AHA guidelines
8. For a victim with severe arterial bleeding from a limb that direct pressure cannot control, current bleeding-control guidance — popularized by the DHS-supported Stop the Bleed campaign — endorses:
a.Application of a commercial tourniquet 2-3 inches above the wound (not on a joint), tightened until bleeding stops; note the application time✓
b.Elevation of the injured limb only, since tourniquets are obsolete and are now understood to cause considerably more harm than the bleeding itself does
c.Pouring hot water over the wound in order to make the blood coagulate
d.Removing the victim's clothing from the injured limb and then simply waiting for the paramedics to arrive without taking any further action at all

Post-2015 trauma data — much of it from combat experience and refined by the American College of Surgeons' Stop the Bleed campaign — re-established tourniquets as life-saving for severe limb hemorrhage that direct pressure cannot control. Apply 2-3 inches above the wound (not on a joint), tighten until bleeding stops, note the application time, and never remove until a hospital can manage hemorrhage control. Elevation alone (b) is insufficient for arterial bleeding; thermal manipulation (c) is harmful; doing nothing (d) costs lives — exsanguination can occur in 2-5 minutes.

Stop the Bleed campaign; DHS / ACS bleeding-control training
9. The 'FAST' mnemonic for recognizing a stroke stands for:
a.Find the patient, Assess the injury, Stabilise the neck, then Transport
b.Face the patient, Arms at rest, Speech check, then Treatment given
c.Fever, Aches, Sweating, and Trembling in both arms and both legs
d.Face drooping, Arm weakness, Speech difficulty, Time to call 911✓

FAST is the American Stroke Association's public-recognition mnemonic: Face drooping (ask the person to smile — is one side drooping?), Arm weakness (ask to raise both arms — does one drift down?), Speech difficulty (ask to repeat a simple sentence — is it slurred or strange?), Time to call 911 immediately and note when symptoms began (eligibility for tPA clot-buster medication is roughly 3-4.5 hours from onset). Some agencies use 'BE-FAST' adding Balance and Eyes. Rapid recognition and 911 activation saves brain tissue: 'Time is brain.'

American Stroke Association FAST mnemonic
10. Classic warning signs of a heart attack (acute myocardial infarction) include:
a.Sharp stabbing pain confined to the right side of the body and to nowhere else at all during the episode
b.Chest pressure, discomfort radiating to the arm/jaw/back, shortness of breath, sweating, nausea — recognizing that women, diabetics, and the elderly may present atypically✓
c.Severe abdominal pain only, with no chest involvement of any kind at any point during the episode, and no pain radiating anywhere else in the body, into either arm, or up into the jaw
d.Sudden and complete loss of vision in both of the eyes at the very same moment

Classic heart-attack signs are chest pressure or discomfort (often described as squeezing or heaviness), radiation to the left arm, jaw, neck, or back, shortness of breath, cold sweat, nausea, and lightheadedness. Critically, women, diabetics, and elderly patients often present atypically — with fatigue, indigestion, or shortness of breath instead of classic chest pain — and these presentations are commonly missed. Call 911 immediately; chewable aspirin if conscious and not allergic. Right-side-only pain (a), isolated abdominal pain (c, possible but not classic), and bilateral vision loss (d, more suggestive of stroke) are less typical.

American Heart Association cardiac event recognition
11. The DHS-endorsed active-shooter response framework, taught in BSIS modules, is:
a.Confront, Engage, Neutralise — security personnel are expected to move toward the shooter and stop the threat themselves
b.Lock, Wait, Pray — remain exactly where you are under all circumstances until help finally arrives at the door
c.Negotiate, Persuade, Surrender — talk the shooter into putting the weapon down and giving themselves up to the officers who are waiting outside the building
d.Run (escape if possible), Hide (if escape is not possible, conceal and barricade, silence phones), Fight (as a last resort, with intent and improvised weapons)✓

DHS Run/Hide/Fight, also adopted by the FBI and ALERRT (Advanced Law Enforcement Rapid Response Training), is the consensus civilian framework. Run — evacuate if a safe path exists, leaving belongings behind. Hide — if running is unsafe, lock and barricade, turn off lights, silence phones, and stay quiet. Fight — only as a last resort when life is in immediate danger, commit fully, use improvised weapons, and act as a group when possible. Mandatory engagement (a) is not standard security guard protocol unless armed and specifically trained. Passive options (b, c) cost lives.

DHS Active Shooter Preparedness; Run/Hide/Fight framework
12. An employee answering a phone receives a bomb threat. The FBI/DHS-endorsed protocol calls for the call-taker to:
a.Hang up immediately and ignore the call as a prank, since a caller who genuinely intended to plant a device in the building would not announce it in advance over the telephone to a receptionist
b.Stay on the line, record the caller's exact words, note voice characteristics and background sounds, signal a coworker to call 911, and after the call, complete the FBI bomb-threat checklist✓
c.Demand the caller's name and warn them that the call is being traced and that they will be arrested for making a threat of this kind against a commercial building
d.Page the whole building over the public-address system to announce that a bomb threat has just been received, so that every occupant can decide for themselves whether they want to leave the premises at once

FBI/DHS bomb-threat protocol calls for keeping the caller on the line as long as possible, recording exact words verbatim, noting voice characteristics (accent, age, gender, demeanor), background sounds (traffic, machinery, music, voices), and any specific details about the device or motive. A coworker silently signals 911. The completed Bomb Threat Checklist gives investigators critical leads. Hanging up (a) destroys intelligence value; threatening the caller (c) escalates and ends the call; public PA announcements (d) cause panic and may trigger an actual detonation if a device is present.

FBI/DHS Bomb Threat Stand-Off Card and Checklist
13. A suspicious unattended package is found in a lobby. The security officer should:
a.Pick the package up and turn it over to look for a name tag or delivery label that identifies who left it there
b.Open it carefully at one corner in order to identify the contents before deciding whether the matter is worth escalating to a supervisor or to the police at all
c.Smell it or shake it gently to work out whether it contains a liquid or a powder, so that the description given to the responding officers is as precise as it can be
d.Do not touch or move it — clear the immediate area, prevent others from approaching, notify law enforcement, and follow the building's bomb-incident plan✓

DHS suspicious-package protocol is 'Recognize, Avoid, Isolate, Notify' (the RAIN model). Do NOT touch, move, open, smell, or shake the item — any of these can detonate a device or release a hazardous substance. Clear the area to a safe distance (rule of thumb: at least 300 feet for a small package, much further for a vehicle), prevent re-entry, notify law enforcement, and brief responding officers on what was observed, who reported it, and where the item is. Building bomb-incident plans should be pre-written and rehearsed.

DHS suspicious-package protocol; 'See Something, Say Something'
14. California's official earthquake response protocol — promoted by the Earthquake Country Alliance and Cal-OES — is:
a.Drop to hands and knees, take Cover under sturdy furniture (or against an interior wall), Hold On until shaking stops✓
b.Run outside immediately while the ground is still shaking, so as to get clear of the building before anything can fall on you inside it
c.Stand in a doorway, which is the safest location in any structure because the door frame carries the load of the wall above it during a quake
d.Lie flat out in the open away from the building and cover your head with your arms until the shaking has finished completely

Drop, Cover, and Hold On is the consensus protocol from Cal-OES, ECA, USGS, and FEMA. Drop to your hands and knees so the quake does not knock you over; take Cover under a sturdy table or against an interior wall protecting head and neck; Hold On to your shelter and ride it out. Running outside (b) exposes you to falling glass, masonry, and powerlines — most injuries occur from movement during shaking. Doorways (c) are myth-busted: modern doorways are no stronger than other parts of the structure. Lying in the open (d) leaves head and neck unprotected.

Cal-OES Earthquake guidance; Drop/Cover/Hold On
15. After an earthquake passes, post-shaking hazards a security officer must assess include:
a.Only structural cracks in the walls, floors and ceilings of the building itself, which the officer should photograph before anyone re-enters
b.Only the risk of a fire breaking out somewhere in the building once the shaking has stopped and the power has come back on
c.Nothing at all — once the shaking has stopped the emergency is over, the building can be reopened to staff, and normal operations may resume immediately without any further inspection being carried out at all
d.Structural damage, gas leaks (do not use elevators or any electrical switches/open flames if leak suspected), water-line breaks, hazardous spills, displaced occupants, and ongoing aftershock risk✓

Earthquakes generate cascading hazards: structural compromise (do not re-enter visibly damaged buildings); gas leaks (smell, hissing — do NOT switch lights, do NOT use phones nearby, do not light flames; evacuate and call utility/911); water-main breaks; hazmat spills; injured or trapped occupants; and aftershocks, which can be nearly as strong as the initial event. Elevators must be assumed unsafe and stairs used. Officers complete a structured walk-through, document hazards, account for occupants, and coordinate with fire and EMS — the emergency persists well after shaking ends.

BSIS emergency-response training; building emergency plans
16. During an extended commercial-property power outage, the security officer's priorities include:
a.Continuing routine patrols only on the floors that still have some light, and leaving the dark floors alone entirely until power has been restored to the whole building by the utility
b.Activating backup lighting, verifying that fire alarm/sprinkler systems remain functional, checking on stuck-elevator occupants, monitoring access points (electronic locks may fail open or closed), and maintaining a visible presence to deter opportunistic crime✓
c.Closing the building immediately and sending everyone home without coordinating with the client, the tenants or the utility company first, so that nobody is left inside in the dark
d.Letting the tenants manage the situation themselves, since a power cut is a utility problem rather than anything the security role covers, and the officer has no equipment for it

Power outages create predictable security failures: electronic locks may fail open (security risk) or closed (egress risk — fire code requires fail-safe egress); elevators trap occupants; surveillance and alarm systems may degrade; opportunistic theft increases. The officer activates backup lighting and radios, walks all areas (including dark ones with a flashlight), checks elevator phones for trapped occupants, monitors entry points, communicates with the client, and documents. Routine patrols (a) cannot be limited to lit floors; uncoordinated closure (c) creates liability; passive disengagement (d) breaches contract.

BSIS emergency-protocol training; building continuity
17. An officer observes a suspected hazardous-material spill or release with strong chemical odor. The correct immediate response is:
a.Investigate at close range in order to identify the chemical, so that the responding hazmat team is told exactly what they are dealing with
b.Use a broom and water to spread the substance out over a much wider area of floor, on the theory that diluting it reduces both the concentration and the danger to anyone nearby
c.Move upwind and uphill, evacuate the area, deny entry, call 911 / hazmat, and provide observed details (color, smell, container labels) from a safe distance✓
d.Touch a small amount of the substance to assess its texture and consistency, which helps to distinguish an ordinary spilled cleaning product from something considerably worse

Standard hazmat awareness — NFPA 472 / OSHA 1910.120 First Responder Awareness Level — directs untrained personnel to evacuate, isolate, and notify. Move UPWIND and UPHILL to escape vapor/liquid flow; evacuate occupants from the affected area; deny entry; call 911 specifying possible hazmat; and provide identifying information observed from safe distance (placards, NFPA 704 diamond, container shape, color, odor). Close approach (a), spreading (b), or contact (d) put the officer at risk and may worsen contamination. Officers do NOT mitigate the release — trained hazmat teams do.

EPA / Cal-EPA hazmat response; NFPA 472
18. California Labor Code §6401.9, added by SB 553 and effective July 1, 2024, requires most California employers to:
a.Provide every employee with personal body armour rated to stop a handgun round while they are on the premises
b.Hire armed security guards for every workplace in the state, whatever the size of the employer, the nature of the work carried on there, or the past history of the site itself
c.Establish, implement, and maintain a written Workplace Violence Prevention Plan (WVPP), train employees, log violent incidents, and conduct hazard assessments✓
d.Replace all glass entry doors and every ground-floor window with bulletproof material before the compliance deadline set out in the statute finally passes at the end of the year

SB 553, codified at Labor Code §6401.9, requires nearly all California employers (some narrow exemptions) to establish a written Workplace Violence Prevention Plan, conduct training, maintain a Violent Incident Log, and perform periodic hazard assessments. The plan must include reporting procedures, response procedures, employee-involvement provisions, and post-incident review. The law does not mandate equipment or armed guards specifically (a, b, d) — it focuses on planning, training, and recordkeeping. Security officers should be familiar with the client's WVPP.

California Labor Code §6401.9 (SB 553, effective July 1, 2024)
19. Officer survival principles taught in BSIS modules emphasize:
a.Situational awareness (Cooper's color codes — White unaware, Yellow relaxed alert, Orange specific threat focus, Red ready to act), distance, cover/concealment, and continuous threat assessment✓
b.An aggressive approach to every contact in order to assert dominance from the outset, so that no subject is tempted to test the officer
c.Wearing visible firearms at all times to deter threats, even where the officer holds only an unarmed guard registration with the Bureau
d.Avoiding contact altogether with any subject the officer deems to be possibly threatening, and calling the police out to every such encounter instead of ever making the approach personally on foot

BSIS officer-survival modules incorporate Cooper's color codes — White (unaware, vulnerable), Yellow (relaxed alert, baseline for on-duty officers), Orange (specific potential threat identified, plan forming), Red (threat materialized, ready to act). Officers maintain distance, use cover (stops bullets) versus concealment (blocks view only), watch hands (weapons appear from hands), and continuously reassess. Aggression (b) escalates; carrying a firearm without an exposed-firearms permit (BPC §7583.5) is unlawful for unarmed-guard registration; total avoidance (d) defeats the security role.

BSIS officer-survival training; situational awareness principles (Cooper's color codes)
20. Among the following pieces of equipment, which generally requires a separate BSIS permit beyond the basic Guard Card?
a.A high-output rechargeable flashlight carried on the equipment belt throughout a night patrol shift at the site
b.A two-way radio tuned to the site channel and used to call in each checkpoint time to the desk during the shift
c.A notepad and pen used to take contemporaneous notes at the scene of any incident the officer attends during the shift
d.Firearm (requires BSIS Firearms Qualification Permit / Exposed Firearm Permit under BPC §7583.5)✓

California requires guards carrying firearms on duty to hold a separate Firearm Qualification Card (sometimes called Exposed Firearm Permit) under Business & Professions Code §7583.5, in addition to the basic Guard Card registration. Similarly, baton (PC §22210), pepper spray under specified ounces, and TASER/CEW require permits or specific training under BSIS regulations. Flashlights (a), radios (b), and writing materials (c) require no separate permit. The Firearm Qualification involves a 14-hour course and live-fire qualification with renewal requirements.

BSIS equipment standards; OSHA PPE requirements

Terrorism Awareness

16 questions
1. Under the federal definition (18 U.S.C. §2331), terrorism centrally involves:
a.Any act of violence committed for purely personal reasons, such as a grievance against a particular individual or an argument that has escalated into an assault on the street
b.Activities involving violent acts dangerous to human life, intended to intimidate or coerce a civilian population, influence government policy by intimidation, or affect government conduct by mass destruction, assassination, or kidnapping✓
c.Only acts committed by foreign nationals who have entered the country for that purpose, since a citizen acting alone falls outside the statutory definition entirely
d.Only acts that result in more than one hundred deaths, which is the casualty threshold the statute sets before an incident is classified as terrorism

18 U.S.C. §2331 defines both international and domestic terrorism. The common elements: violent acts (or acts dangerous to human life) that violate criminal law, AND the actor's intent — to intimidate or coerce a civilian population, influence government policy by intimidation or coercion, or affect government conduct by mass destruction, assassination, or kidnapping. Personal motive without political/ideological coercion goal (a) is ordinary violent crime. Citizenship is not the dividing line (c) — both domestic and international terrorism exist. There is no casualty threshold (d).

FBI definition of terrorism; 18 U.S.C. §2331
2. 'Domestic terrorism' as defined by 18 U.S.C. §2331(5) is distinguished from 'international terrorism' chiefly by:
a.The severity of the casualties that the attack ends up producing, with the larger death toll marking out the international category from the domestic one
b.The use of explosives rather than any other kind of weapon, since explosive attacks are treated as the international variety and shootings as the domestic one
c.The activities occurring primarily within the territorial jurisdiction of the United States, often by US-based actors with US-focused ideologies✓
d.Whether the FBI rather than the CIA leads the investigation into the incident, which is the sole distinction that the statute itself actually draws between them

Domestic terrorism under §2331(5) involves activities that occur primarily within US territorial jurisdiction and are intended to intimidate or coerce a civilian population, influence government, or affect conduct of government by mass destruction, assassination, or kidnapping. The dividing line from international terrorism (§2331(1)) is geographic/jurisdictional, not severity (a), weapon type (b), or which agency leads (d — investigation may involve FBI Joint Terrorism Task Forces regardless). Recent threat assessments identify domestic violent extremism — including racially-motivated, anti-government, and other ideologies — as significant US threats.

18 U.S.C. §2331(5); FBI domestic terrorism framework
3. 'Lone-wolf' or homegrown violent extremism is characterized by:
a.An individual radicalizing largely independently (often online), planning attacks alone or with minimal cell support, making advance detection through traditional conspiracy investigation difficult✓
b.Large international cells operating out of foreign safe havens and directing each attack through an established chain of command that reaches all the way back to a leadership abroad which funds and approves it
c.Attacks that always involve weapons of mass destruction rather than firearms, vehicles or improvised explosive devices
d.Operations that are sponsored by a government and carried out by its agents against a target inside another country's borders

FBI / DHS threat assessments highlight that lone offenders — often radicalized through online content with minimal physical contact with formal organizations — are exceptionally difficult to detect through conspiracy-based intelligence because there is no conspiracy to penetrate. Early warning typically comes from observable pre-attack behaviors (leakage to family, online posts, surveillance, weapon acquisition) that security officers and the public may notice. This drives the importance of suspicious-activity reporting and the 'See Something, Say Something' campaign. (b), (c), and (d) describe other threat categories.

FBI / DHS lone-offender threat assessment
4. Which of the following is NOT generally listed as a Suspicious Activity Report (SAR) behavioral indicator under the Nationwide SAR Initiative?
a.Repeated photography of security cameras with no apparent purpose
b.Probing security responses, such as setting off an alarm to time how long the response actually takes
c.Acquiring large amounts of materials usable in an attack on a site
d.Routine visits by a building's regular employees during posted business hours✓

Nationwide SAR Initiative indicators include surveillance, photography of restricted/critical infrastructure with no apparent purpose, eliciting information, testing/probing of security, breach/attempted intrusion, misrepresentation, theft/diversion of materials, acquisition of expertise or supplies, weapons discovery, sector-specific incidents, and expressed/implied threats. Routine employee activity during business hours (d) is normal and not a SAR indicator — SARs require articulable behavioral concerns, not status or appearance. 28 CFR Part 23 governs intelligence-system criminal information standards to prevent unconstitutional reporting.

Nationwide Suspicious Activity Reporting Initiative (NSI); 28 CFR Part 23
5. DHS's public awareness campaign for reporting suspicious activity, often referenced in BSIS terrorism-awareness modules, is:
a.'Report Everything Suspicious You Happen To See'
b.'If You See Something, Say Something'✓
c.'Watch Your Six, Guard Your Partner’s Back'
d.'Keep Your Eyes Open And Your Mouth Shut At All Times'

'If You See Something, Say Something' is the registered DHS campaign emphasizing that observation of behavior (not appearance, race, ethnicity, or religion) is what matters, and that the public — including security officers — are critical reporting partners. The campaign directs reports to local law enforcement or 911 for emergencies, the FBI for federal jurisdiction (especially terrorism), and tip lines such as 1-855-TELL-FBI. Officers are trained to report observable behavior, not based on identity characteristics — which would violate civil-rights protections (28 CFR Part 23, federal civil-rights statutes).

DHS 'If You See Something, Say Something' campaign
6. For an observed pattern suggesting terrorism preparation that is not an immediate emergency, the most appropriate reporting channel from the BSIS curriculum is:
a.Post the observation on social media so that members of the public can crowdsource the analysis and identify the person involved rather faster than the police themselves would ever be able to do it on their own
b.Wait until the suspect has left the property and then put the matter out of mind, since nothing actually happened while they were on site
c.Report to local law enforcement (and, for terrorism nexus, the FBI's Joint Terrorism Task Force or local Fusion Center) with full factual detail, plus a written incident report to the employer✓
d.Confront the suspect directly and demand to know what their purpose on the property actually is, so that an innocent explanation can be ruled out on the spot before any report at all is made to anyone

Standard reporting flow: local law enforcement is the universal first channel (911 for emergencies, non-emergency line otherwise). For terrorism-related observations, the FBI's Joint Terrorism Task Force coordinates federal/state/local response; state Fusion Centers (in California, the State Threat Assessment Center and regional centers including JRIC) provide analysis and information sharing. Internal incident reporting to the employer parallels law-enforcement reporting. Social-media posting (a) compromises investigations and may defame; ignoring (b) abandons the SAR duty; confrontation (d) endangers the officer and tips off the suspect.

FBI Joint Terrorism Task Force (JTTF); national reporting framework
7. The 'CBRNE' acronym used in WMD-awareness training stands for:
a.Chemical, Biological, Radiological, Nuclear, Explosive✓
b.Civil, Bureau, Regional, National, and Emergency response
c.Counter, Block, Respond, Notify, and then finally Evacuate the site
d.Critical, Basic, Resource, Notification, and Element of the response

CBRNE — Chemical, Biological, Radiological, Nuclear, Explosive — is the FEMA / CISA / DOD framework for categorizing weapons of mass destruction and weapons capable of mass casualties. Chemical agents (nerve, blister, blood, choking) cause harm through toxicity; Biological agents (pathogens, toxins) cause harm through disease; Radiological agents disperse radioactive material (dirty bombs); Nuclear involves fission/fusion devices; Explosive includes IEDs and conventional explosives. Different agent categories require different protective and response measures, which is why the framework drives training and equipment planning.

FEMA / CISA CBRNE framework
8. Which set of observations would most strongly suggest a possible chemical attack rather than a routine incident?
a.A single person reporting a routine seasonal illness at the reception desk of the building, with no other person nearby reporting anything unusual
b.Multiple unexplained casualties clustered in one area, unusual odors (almonds, garlic, freshly cut grass), dead vegetation or animals in the same area, and witnesses reporting eye/respiratory irritation✓
c.A standard delivery truck unloading pallets at a posted loading dock during its usual scheduled hours, with the driver following the normal check-in procedure at the gate before entering the yard
d.Normal HVAC system operation across the whole building with no reports of distress from any occupant on any floor and no unusual smell anywhere on site

Chemical-attack indicators taught in CDC and DHS modules include sudden clustered casualties with similar symptoms, unusual odors (almonds may suggest cyanide, garlic may suggest mustard agent, freshly cut grass may suggest phosgene — although many agents are odorless), dead vegetation or animals in proximity, and witnesses reporting eye/skin/respiratory irritation. Single illness (a) is generally not a chemical attack signal; routine deliveries (c) and normal HVAC (d) do not suggest attack. Response: move upwind/uphill, deny entry, call 911 specifying possible chemical incident.

DHS CBRNE indicator training; CDC chemical-event recognition
9. Biological attacks differ from chemical attacks in detection because:
a.Biological agents are always odorous and visible to the naked eye, which is what makes an outdoor release easy to spot at the moment it happens
b.Biological attacks always produce immediate mass casualties at the scene, in the same way that a chemical release does within minutes of exposure
c.Biological agents typically have an incubation period (hours to weeks) before symptoms appear, so initial detection often comes from disease-pattern surveillance by public health rather than scene observation✓
d.Biological agents only affect animals rather than humans, so the first sign of a release is livestock or pets falling ill in the surrounding area

Most biological agents (anthrax, plague, smallpox, tularemia, viral hemorrhagic fevers, botulinum toxin) have incubation periods ranging from hours to several weeks, so unlike chemical attacks (where casualties often appear immediately), biological events frequently come to light through epidemiological surveillance — unusual clusters of disease, deaths exceeding expected patterns, or geographically unusual cases. Officers may, however, notice abandoned dispersal devices or letters with unknown powders. Most biological agents are not odorous/visible (a); they do affect humans (d); casualties may emerge gradually (b).

CDC bioterrorism indicators; Strategic National Stockpile guidance
10. The three fundamental radiological-protection principles for limiting exposure are:
a.Eat well, Drink plenty of water, and Sleep properly before each shift
b.Stop whatever you are doing, Look carefully around you, and then Listen
c.Detect the source, Identify the agent involved, and Document what you found
d.Time (minimize), Distance (maximize), Shielding (use barriers)✓

Time, Distance, and Shielding are the three core principles of radiation protection adopted by the NRC, FEMA, and ICRP. Minimize Time of exposure (dose is cumulative); Maximize Distance (intensity falls with the inverse square — doubling distance quarters intensity); use Shielding (concrete, lead, even thick walls reduce dose) between you and the source. For a security officer responding to a suspected radiological incident (e.g., dirty-bomb concern), evacuating upwind, isolating the area, increasing distance, and notifying 911 / hazmat are the immediate priorities.

NRC / FEMA radiological protection principles; ICRP standards
11. A 'dirty bomb' or radiological dispersal device (RDD) is distinguished from a true nuclear weapon by:
a.Being considerably more destructive than a nuclear weapon of comparable size, because the contamination spreads further than a blast does
b.Combining conventional explosives with radioactive material to disperse contamination; it does not produce a nuclear chain reaction or a nuclear yield✓
c.Producing an identical fission-yield explosion to a nuclear weapon, with exactly the same blast, heat and radiation effects at the point where it is detonated
d.Being limited to military use only, since the materials involved are held exclusively by defence agencies and are not in practice available to anybody else at all

An RDD uses conventional explosives to disperse radioactive material — it is NOT a nuclear weapon and does not produce a fission/fusion yield. The immediate damage is primarily the conventional blast; the longer-term concern is contamination of the area, complicating cleanup and causing fear and economic disruption. A true nuclear device produces a fission or fusion chain reaction with catastrophic blast/thermal/radiation effects. Both warrant immediate evacuation and law-enforcement response; only proper training and detection equipment can characterize the threat. Security officers focus on isolating the area and notifying authorities.

NRC / DHS radiological dispersal device (RDD) information
12. Explosive (the 'E' in CBRNE) attacks in modern terrorism most commonly involve:
a.Military-grade guided missiles only, fired at a fixed structure from a launcher positioned some distance away from the target itself
b.Nuclear bombs, which are the only devices with enough destructive power to serve the purposes that a terrorist organisation is pursuing
c.Improvised Explosive Devices (IEDs), including vehicle-borne IEDs (VBIEDs), person-borne (suicide) IEDs, and package/mailed devices✓
d.Firearms only, since a weapon that can be carried and concealed is the practical option available to an attacker acting on their own

Improvised Explosive Devices are by far the most common explosive threat — homemade devices using readily available materials, often hidden in vehicles (VBIEDs), worn by attackers (PBIEDs), placed in packages, or mailed. Standoff distances and pre-event SAR observation (probing security, surveillance, acquiring precursors) are the principal defenses. Military munitions (a) are tightly controlled; nuclear devices (b) are extremely rare; firearms (d) are a different attack mode altogether. Security officers focus on access control, suspicious-package awareness, and reporting indicators of pre-attack preparation.

DHS IED awareness training; JIEDDO guidance
13. DHS / CISA identifies how many critical infrastructure sectors whose protection is prioritized for national security?
a.Three — energy, transportation, and water, on the theory that every other sector depends on those three and that protecting them therefore protects the rest by extension
b.Eight — chemical, communications, energy, financial services, food and agriculture, government facilities, transportation, and water, with all the rest folded into one of these eight
c.Sixteen — including chemical, commercial facilities, communications, dams, defense industrial base, emergency services, energy, financial, food and agriculture, government, healthcare, IT, nuclear, transportation, water/wastewater, and critical manufacturing✓
d.Fifty — one designated sector for each state, each coordinated by that state's own homeland security office rather than by a single federal sector-risk management agency in Washington

CISA designates 16 critical infrastructure sectors under Presidential Policy Directive 21 (PPD-21): Chemical; Commercial Facilities; Communications; Critical Manufacturing; Dams; Defense Industrial Base; Emergency Services; Energy; Financial Services; Food and Agriculture; Government Facilities; Healthcare and Public Health; Information Technology; Nuclear Reactors/Materials/Waste; Transportation Systems; Water and Wastewater Systems. Each sector has a Sector Risk Management Agency. Private security guards frequently work in commercial facilities, healthcare, and transportation sectors, which makes their awareness directly relevant to homeland security.

CISA Critical Infrastructure Sectors framework
14. Protective measures that security officers contribute to critical-infrastructure protection include:
a.Only maintaining a current firearms qualification with the Bureau and re-qualifying at an approved range on the schedule the regulations set out
b.Only responding after an incident has already taken place on the site, since prevention is the client's responsibility rather than the officer's
c.Only keeping the site's compliance paperwork complete and up to date, so that an inspection by the client or by the regulator finds nothing at all missing from the file whenever it happens to be reviewed
d.Maintaining perimeter integrity, controlling access, conducting suspicious-activity awareness, performing visible patrols (deterrence), maintaining communication readiness, and reporting indicators promptly✓

Security officers contribute to critical-infrastructure protection through multiple complementary measures captured in (d): perimeter maintenance (fences, lighting, gates), access control (verification of credentials), Crime Prevention Through Environmental Design (CPTED) awareness, visible patrols as deterrence, communication readiness (radio, phones, emergency contacts), and prompt reporting of SAR indicators. Security is layered — no single measure works alone, and the security officer is one critical layer. Singular focus options (a, b, c) miss the integrated nature of protection.

DHS protective measures framework; CPTED principles
15. California's network for sharing terrorism-related intelligence among federal, state, local, and private-sector partners is built around:
a.Independent county sheriff databases only, each maintained separately by the sheriff of that particular county and not shared with any federal or state partner agency at all
b.State and regional Fusion Centers — including the State Threat Assessment Center (STAC) in Sacramento and the Joint Regional Intelligence Center (JRIC) in Los Angeles — which integrate FBI, DHS, state, local, and private-sector reporting✓
c.Public social-media monitoring only, carried out by contractors who scan open sources for keywords and pass whatever they find on to the client agencies that pay them
d.Private commercial threat-intelligence vendors only, who sell subscription reports to whichever agencies and companies happen to be willing to pay for the feed

Fusion Centers are the central national framework for state/local intelligence sharing post-9/11, supported by DHS and managed by host agencies. California operates the State Threat Assessment Center (STAC) in Sacramento and several regional Fusion Centers including JRIC (Los Angeles area), NCRIC (Northern California), and Orange County Intelligence Assessment Center. These integrate federal partners (FBI Field Offices, DHS Intelligence) with state and local law enforcement and private-sector liaisons. Private security firms participate through SAR submissions. The other options describe partial pieces of intelligence collection, not the framework.

California State Threat Assessment Center (STAC); Joint Regional Intelligence Center (JRIC)
16. When reporting suspicious activity, what civil-rights principle must the security officer observe?
a.Report primarily on the basis of the subject's apparent race, ethnicity or religion, since those characteristics are what the intelligence picture is actually built around in practice
b.Avoid reporting anything at all in order to eliminate every civil-rights risk to the officer personally and to the employing operator, since a report that is never made cannot be challenged
c.Report observable behavior that is reasonably indicative of criminal or terrorism preparation activity; do NOT base reports on race, ethnicity, national origin, religion, gender, sexual orientation, or other protected characteristics✓
d.Report only when a supervisor has specifically asked for the information, so that the decision to escalate always rests with somebody more senior than the officer on post

28 CFR Part 23 and federal civil-rights statutes (and California's analogues including the Ralph and Bane Acts) require that intelligence collection and reporting be based on reasonable suspicion of criminal activity supported by articulable behavioral facts — NOT on protected characteristics such as race, ethnicity, national origin, religion, gender, sexual orientation, or political belief. Bias-based reporting violates civil rights and undermines the credibility of legitimate threat reporting. The DHS 'See Something, Say Something' campaign explicitly emphasizes behavior over identity. Officers report what people do, not who people are.

28 CFR Part 23; federal civil-rights statutes (42 U.S.C. §1981 et seq.)
Report