COBRA Threat Assessment and Recognition 1 — Questions and Answers
Question 1: What is the primary purpose of threat assessment in a security console operation?
- To document all incidents that occur during a shift
- To identify, evaluate, and manage potential threats before they materialize (Correct answer)
- To coordinate with law enforcement on all security matters
- To maintain accurate visitor logs at all entry points
Correct answer: To identify, evaluate, and manage potential threats before they materialize
Threat assessment aims to proactively identify, evaluate, and manage potential threats before they escalate into actual incidents.
Question 2: Which behavior is most commonly associated with pre-attack surveillance by a potential threat actor?
- Asking security personnel for directions to restrooms
- Taking photographs or sketching security camera locations and entry points (Correct answer)
- Leaving a vehicle in a designated parking area for extended periods
- Wearing clothing inappropriate for the current season
Correct answer: Taking photographs or sketching security camera locations and entry points
Pre-attack surveillance typically involves gathering intelligence about security measures, including documenting camera positions, guard rotations, and entry/exit points.
Question 3: What does the informal security term 'JDLR' stand for?
- Just Document, Log, and Report
- Joint Defense and Law Response
- Just Doesn't Look Right (Correct answer)
- Jurisdiction, Detection, Location, Response
Correct answer: Just Doesn't Look Right
'JDLR' stands for 'Just Doesn't Look Right,' referring to the intuitive recognition of something that seems out of place or suspicious.
Question 4: When a console operator observes an individual repeatedly walking past a facility entrance and peering inside, this behavior is best classified as:
- Normal civilian curiosity
- Potential pre-incident surveillance (Correct answer)
- Authorized facility inspection activity
- Standard delivery verification behavior
Correct answer: Potential pre-incident surveillance
Repeated passes by a facility entrance while looking inside are classic indicators of pre-incident surveillance and should be documented and reported.
Question 5: What is 'baseline behavior' in the context of security threat recognition?
- The minimum training requirements for security personnel
- The standard operating procedures for emergency response
- The normal patterns of activity and behavior expected in a given environment (Correct answer)
- The documented history of past incidents at a facility
Correct answer: The normal patterns of activity and behavior expected in a given environment
Baseline behavior refers to the normal, expected patterns of activity in an environment, allowing security personnel to identify deviations that may signal a threat.
Question 6: Which of the following behaviors is most indicative of a potential insider threat?
- An employee who arrives consistently on time and follows all procedures
- An employee who accesses restricted areas outside their normal work hours without authorization (Correct answer)
- An employee who requests additional training on security systems
- An employee who reports suspicious activity to their supervisor
Correct answer: An employee who accesses restricted areas outside their normal work hours without authorization
Unauthorized access to restricted areas outside normal work hours is a significant behavioral indicator of a potential insider threat.
Question 7: When a console operator identifies a credible potential threat, what is the most appropriate immediate action?
- Confront the individual directly to gather more information
- Continue monitoring without action until the threat is fully confirmed
- Document observations and immediately notify supervisory personnel per established protocols (Correct answer)
- Contact law enforcement before notifying facility management
Correct answer: Document observations and immediately notify supervisory personnel per established protocols
The appropriate response is to document observations and immediately notify supervisory personnel while following established protocols, maintaining the proper chain of command.
COBRA Threat Assessment and Recognition 1
What is the primary purpose of threat assessment in a security console operation?