SIA Security Guard Exam — Questions and Answers

Question 1: What is a 'means of escape' in fire safety?

A fire blanket
A safe route that people can use to leave a building during a fire, leading to a place of safety (Correct answer)
A fire extinguisher
A sprinkler system

Correct answer: A safe route that people can use to leave a building during a fire, leading to a place of safety

A means of escape is a structural route (corridors, stairways, exits) that enables people to safely leave a building during a fire. These routes must be kept clear, well-lit, signed, and lead to a place of safety.

Question 2: A security guard finds a person who appears to have committed theft on private premises. Under what circumstances is it lawful to use force to detain them?

Force can always be used to detain shoplifters as a matter of retail security custom
Any time a security guard suspects theft
Only where a citizen's arrest under s.24A PACE is lawfully made — the offence must be indictable, a constable must not be reasonably available, and the detention must be necessary to prevent escape, harm, or loss of evidence (Correct answer)
Only if the item stolen exceeds £200 in value

Correct answer: Only where a citizen's arrest under s.24A PACE is lawfully made — the offence must be indictable, a constable must not be reasonably available, and the detention must be necessary to prevent escape, harm, or loss of evidence

Force to detain a person is only lawful when a legitimate citizen's arrest under s.24A PACE is being made (or common law self-defence/prevention of crime applies). Detaining someone with force outside these circumstances constitutes false imprisonment and potentially assault.

Question 3: What is the most important action for a security officer after safely evacuating an area following a bomb threat?

Inform members of the public of the exact nature and location of the threat
Contact their supervisor and await instructions from the police (Correct answer)
Begin searching the car park independently for suspicious vehicles
Re-enter the building to conduct a thorough search for the device themselves

Correct answer: Contact their supervisor and await instructions from the police

After evacuation, security officers must liaise with their supervisor and await police instructions, as only trained bomb disposal experts should search for or approach explosive devices.

Question 4: What does 'IIMARCH' stand for in security reporting?

Information, Intention, Method, Administration, Risk assessment, Communications, Human rights (Correct answer)
Initial, Immediate, Medical, Ambulance, Recovery, Check, Hospital
It is not a real acronym
Incident, Investigation, Management, Analysis, Report, Communication, Handover

Correct answer: Information, Intention, Method, Administration, Risk assessment, Communications, Human rights

IIMARCH is a briefing and reporting structure: Information (what happened), Intention (what you plan to do), Method (how you will do it), Administration (logistics), Risk assessment, Communications (how to communicate), and Human rights (consider rights of those involved).

Question 5: Why is it important to issue and manage visitor passes or badges?

To make visitors feel welcome
To advertise the security company
To collect personal data
To easily identify who is a visitor, ensure they are accounted for, and control their access to appropriate areas (Correct answer)

Correct answer: To easily identify who is a visitor, ensure they are accounted for, and control their access to appropriate areas

Visitor passes serve multiple security purposes: they identify the wearer as a visitor (not staff), indicate which areas they may access, show if they should be escorted, and help ensure all visitors have signed out when they leave.

Question 6: What is a 'daily occurrence book' (DOB) in security?

A book for recording weather conditions
A diary for personal appointments
A staff attendance register
A chronological log recording all events, activities, and incidents during a security shift (Correct answer)

Correct answer: A chronological log recording all events, activities, and incidents during a security shift

The DOB (also called an occurrence book or security log) is a chronological record of everything that happens during a shift — patrols, incidents, visitors, deliveries, equipment checks, alarm activations, and handover notes.

Question 7: What should a security guard do if someone claims to have forgotten their access pass?

Follow the site's procedure for verifying identity — which may include contacting the person they claim to work with, checking photo ID, and issuing a temporary pass (Correct answer)
Refuse entry completely with no alternative
Let them in if they look like they belong there
Ask them to describe their office

Correct answer: Follow the site's procedure for verifying identity — which may include contacting the person they claim to work with, checking photo ID, and issuing a temporary pass

The guard should follow the site's specific procedure, which typically involves verifying the person's identity through alternative means (photo ID, calling their manager/contact), and issuing a temporary pass if identity is confirmed.

Question 8: The Equality Act 2010 prohibits security guards from discriminating against individuals on the basis of protected characteristics. Which of the following is NOT a protected characteristic under the Act?

Disability
Political opinion (Correct answer)
Religion or belief
Race

Correct answer: Political opinion

The Equality Act 2010's nine protected characteristics are: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex, and sexual orientation. Political opinion is not a protected characteristic under the Equality Act 2010.

Question 9: What does 'contemporaneous' mean in relation to note-taking?

Notes that are typed rather than handwritten
Notes shared with contemporary colleagues
Written in modern English
Notes made at the time of or as soon as reasonably practicable after the event (Correct answer)

Correct answer: Notes made at the time of or as soon as reasonably practicable after the event

Contemporaneous notes are made at the time of the event or as soon as possible afterwards. Courts give greater weight to contemporaneous notes because they are made when the events are fresh in the writer's memory.

Question 10: What key information should be included in a security incident report?

Only information the police request
Only the guard's opinion of what happened
Date, time, location, persons involved, description of the incident, actions taken, witnesses, and the outcome (Correct answer)
Just the name of the person responsible

Correct answer: Date, time, location, persons involved, description of the incident, actions taken, witnesses, and the outcome

A comprehensive incident report includes: date, time, location, persons involved (descriptions if names unknown), factual account of what happened, actions taken, use of force (if any), witnesses, evidence preserved, and the outcome.

Question 11: What is 'tailgating' in access control?

A type of social event
Parking too close to the building entrance
Following a vehicle too closely
When an unauthorised person follows an authorised person through a secure entry point without presenting their own credentials (Correct answer)

Correct answer: When an unauthorised person follows an authorised person through a secure entry point without presenting their own credentials

Tailgating (or 'piggybacking') occurs when an unauthorised person follows closely behind an authorised person through a controlled entry point, bypassing the access control system.

Question 12: What are the four strands of the UK government's counter-terrorism strategy known as CONTEST?

Prevent, Pursue, Protect, Prepare (Correct answer)
Police, Patrol, Prosecute, Preserve
Detect, Deter, Delay, Deny
Identify, Monitor, Intercept, Respond

Correct answer: Prevent, Pursue, Protect, Prepare

CONTEST consists of four pillars: Prevent (stop radicalisation), Pursue (stop attacks in progress), Protect (strengthen protection), and Prepare (mitigate the impact of attacks).

Question 13: What is the difference between 'static' and 'mobile' security patrols?

There is no difference
Static guards remain at one location; mobile patrols travel between multiple sites in a vehicle (Correct answer)
Static guards stand still; mobile guards walk
Static guards work days; mobile guards work nights

Correct answer: Static guards remain at one location; mobile patrols travel between multiple sites in a vehicle

Static guards are assigned to one location for their shift, maintaining a continuous presence. Mobile patrols travel between multiple locations in a vehicle, making scheduled or random checks at each site.

Question 14: What should a security guard do if they encounter an intruder on site?

Ignore them if they are not causing damage
Observe from a safe distance, note their description, do not confront, call the police, and report to the control room (Correct answer)
Chase and physically restrain them
Ask them politely to leave and then forget about it

Correct answer: Observe from a safe distance, note their description, do not confront, call the police, and report to the control room

Personal safety is paramount. Observe the intruder from a safe distance, note their description, direction of travel, and any vehicle details. Do not confront them — call the police and report to the control room.

Question 15: What is the primary purpose of access control in a security context?

To ensure that only authorised persons can enter specific areas while preventing unauthorised access (Correct answer)
To provide directions to visitors
To make entry as difficult as possible for everyone
To count the number of people in a building

Correct answer: To ensure that only authorised persons can enter specific areas while preventing unauthorised access

Access control manages who can enter specific areas, ensuring only authorised personnel gain access while preventing unauthorised entry. It is a fundamental principle of physical security.

Question 16: What is the maximum travel distance to a fire exit in a building with a single escape route?

18 metres for normal risk (Correct answer)
45 metres for normal risk
No limit applies
100 metres

Correct answer: 18 metres for normal risk

In a building with a single escape route, the maximum travel distance for normal risk is typically 18 metres. Where alternative routes exist, this increases to 45 metres. High-risk areas have shorter distances.

Question 17: What is a 'key holding' service in security?

A key cutting service
A service where the security company holds keys to premises and responds to alarm activations out of hours (Correct answer)
A service for making spare keys
A locksmith service

Correct answer: A service where the security company holds keys to premises and responds to alarm activations out of hours

Key holding is a service where the security company securely holds keys to a client's premises and responds when alarms are activated outside business hours, including securing the premises if necessary.

Question 18: What should a security guard check during a fire safety patrol?

Only electrical sockets
Fire exits are clear and unlocked, fire doors are closed, escape routes are unobstructed, fire equipment is present, and no fire hazards exist (Correct answer)
Only the fire alarm panel
Only fire extinguisher locations

Correct answer: Fire exits are clear and unlocked, fire doors are closed, escape routes are unobstructed, fire equipment is present, and no fire hazards exist

A fire safety patrol should check: fire exits are unlocked and unobstructed, fire doors are closed, escape routes are clear, fire extinguishers are in place and serviced, no fire hazards are present, and fire signage is visible.

Question 19: What is 'professional scepticism' in the context of a security guard's role?

Doubting all instructions from management
Refusing to believe any information provided by the public
Documenting every interaction with excessive detail
A professional mindset of questioning and critical evaluation — not accepting situations at face value, remaining alert to manipulation, social engineering, or deception, while treating people with respect (Correct answer)

Correct answer: A professional mindset of questioning and critical evaluation — not accepting situations at face value, remaining alert to manipulation, social engineering, or deception, while treating people with respect

Professional scepticism means maintaining a questioning mindset — being aware that situations may not be as they appear, that people may attempt to deceive or manipulate security staff, and remaining alert to anomalies. It is balanced with treating people with fairness and respect.

Question 20: What should a security guard do when a delivery driver arrives at a controlled access point?

Refuse all deliveries
Wave them through immediately
Verify their identity, check the delivery is expected, log their details, issue a temporary pass, and direct them to the correct delivery point (Correct answer)
Let them find their own way around

Correct answer: Verify their identity, check the delivery is expected, log their details, issue a temporary pass, and direct them to the correct delivery point

The guard should verify the driver's identity and the delivery details, check with the relevant person that the delivery is expected, log the driver's details, issue a temporary pass, and direct them to the correct delivery area.

Question 21: What should a security guard do at the start of their shift?

Check in, review the incident log, receive a briefing from the outgoing guard, and check all equipment (Correct answer)
Go straight to the canteen
Start a patrol immediately
Wait for specific instructions from the client

Correct answer: Check in, review the incident log, receive a briefing from the outgoing guard, and check all equipment

At shift start, the guard should: sign in, receive a handover briefing from the outgoing guard, review the incident log for ongoing issues, check all equipment (radio, keys, torch, phone), and note any immediate concerns.

Question 22: Can a security guard detain (hold without arresting) a person they suspect of shoplifting on behalf of the store?

No — only police can detain anyone
Yes, but only if the store has a contractual arrangement granting this right, and even then the grounds must justify it; detention must be brief and the person must be told why they are being detained, with police called promptly (Correct answer)
Yes — SIA licensees have a statutory right to detain suspects for 30 minutes
Yes — any security guard can detain anyone they suspect of any offence for up to 2 hours

Correct answer: Yes, but only if the store has a contractual arrangement granting this right, and even then the grounds must justify it; detention must be brief and the person must be told why they are being detained, with police called promptly

Security guards have no general statutory power to detain. However, in retail environments, the store owner's property rights and the law of trespass (combined with the citizen's arrest power where applicable) can justify brief detention of a suspected shoplifter. The detention must be brief, communicated, and promptly resolved by handing to police.

Question 23: What is the primary purpose of a security patrol?

To deter criminal activity, detect security breaches, and monitor the condition of the premises (Correct answer)
To check personal messages on a mobile phone
To get exercise during the shift
To socialise with other staff

Correct answer: To deter criminal activity, detect security breaches, and monitor the condition of the premises

Security patrols serve multiple purposes: deterring criminal activity through visible presence, detecting breaches or vulnerabilities, checking the condition of the premises, and identifying hazards.

Question 24: What information should a visitor log or register typically contain?

Only the time of arrival
Only the visitor's name
Name, company, person visiting, arrival time, departure time, car registration, and badge number issued (Correct answer)
Just a signature

Correct answer: Name, company, person visiting, arrival time, departure time, car registration, and badge number issued

A comprehensive visitor log records: full name, company/organisation, person being visited, purpose of visit, arrival and departure times, vehicle registration, identification shown, and any visitor pass/badge number issued.

Question 25: Why is effective communication important between a security guard and the control room?

To arrange social events
To check on the weather forecast
To pass the time during quiet periods
To ensure real-time situational awareness, coordinate responses, and maintain a record of events (Correct answer)

Correct answer: To ensure real-time situational awareness, coordinate responses, and maintain a record of events

Regular communication with the control room ensures situational awareness, enables coordinated responses to incidents, provides welfare checks for lone workers, and creates an auditable record of the guard's activities.

Question 26: What is the correct approach to correcting a mistake in a handwritten security report?

Draw a single line through the error, write the correction nearby, initial and date the amendment (Correct answer)
Tear out the page and rewrite it
Use correction fluid (white-out) to cover the mistake
Scribble over the mistake until it is unreadable

Correct answer: Draw a single line through the error, write the correction nearby, initial and date the amendment

Draw a single line through the error (so the original text remains readable), write the correction clearly nearby, and initial and date the amendment. This maintains the integrity of the document.

Question 27: What are the three categories of access control measures?

Permanent, temporary, and emergency
Cheap, moderate, and expensive
Physical, electronic, and procedural (Correct answer)
Simple, medium, and complex

Correct answer: Physical, electronic, and procedural

Access control uses three categories: Physical (locks, barriers, fences), Electronic (card readers, biometrics, keypads), and Procedural (visitor policies, sign-in procedures, escort requirements).

Question 28: How should descriptions of people be written in a security report?

Using vague descriptions like 'suspicious-looking'
Using nicknames or slang
Just stating their ethnicity
Using objective, factual descriptors: approximate age, height, build, hair colour, clothing, and distinguishing features (Correct answer)

Correct answer: Using objective, factual descriptors: approximate age, height, build, hair colour, clothing, and distinguishing features

Descriptions should be objective and factual: approximate age, height, build, hair colour and style, clothing (top to bottom), footwear, and any distinguishing features such as tattoos, scars, or glasses.

Question 29: Why should a security guard use the 24-hour clock when writing reports?

It is required by law
It eliminates confusion between AM and PM times and is the standard used by emergency services (Correct answer)
It looks more professional
It takes up less space on the page

Correct answer: It eliminates confusion between AM and PM times and is the standard used by emergency services

The 24-hour clock eliminates ambiguity between AM and PM (e.g., 0800 vs 2000), aligns with emergency services and military time standards, and ensures precision in legal documents and evidence.

Question 30: If a security guard wishes to search a person who entered premises under a condition of search, and the person refuses, what should the security guard do?

Call the police immediately to conduct the search
Refuse the person entry to or require them to leave the premises, as the search is a condition of entry which they have refused — use reasonable force only if the person refuses to leave (Correct answer)
Force the person to comply with the search
Allow the person in without the search as a gesture of goodwill

Correct answer: Refuse the person entry to or require them to leave the premises, as the search is a condition of entry which they have refused — use reasonable force only if the person refuses to leave

If a search is a condition of entry and the person refuses, the security guard may deny entry or require them to leave the premises. The search itself cannot be forced — but the person can be denied access to or removed from private premises for refusing the condition. Reasonable force may be necessary if they refuse to leave.

Question 31: What is the 'five Ws' approach to gathering information about a security incident?

Witness, Weapon, Weather, Warning, Written
Who, What, Where, When, Why (Correct answer)
Width, Weight, Wound, Warrant, Witness
Walk, Watch, Wait, Warn, Write

Correct answer: Who, What, Where, When, Why

The five Ws — Who, What, Where, When, Why (and sometimes How) — provide a structured approach to gathering and recording all essential information about a security incident.

Question 32: What is 'social engineering' in the context of access control?

Building social housing
Designing social spaces in buildings
A type of civil engineering
Manipulating people through deception to gain unauthorised access — such as pretending to be a contractor or authority figure (Correct answer)

Correct answer: Manipulating people through deception to gain unauthorised access — such as pretending to be a contractor or authority figure

Social engineering exploits human psychology rather than technical vulnerabilities. Examples include impersonating contractors, pretending to be from IT support, or creating a fake emergency to bypass security procedures.

Question 33: What is the difference between a 'statement' and an 'incident report'?

An incident report is longer
An incident report is an internal record for the company; a statement is a formal document for police or legal proceedings (Correct answer)
A statement is always handwritten
There is no difference

Correct answer: An incident report is an internal record for the company; a statement is a formal document for police or legal proceedings

An incident report is an internal document used by the security company and client. A statement (or witness statement) is a formal legal document, usually made for the police, that may be used as evidence in court.

Question 34: What is a 'mantrap' or 'airlock' entry system?

A two-door entry system where the first door must close before the second will open, preventing tailgating (Correct answer)
A ventilation system for cleanrooms
An emergency exit mechanism
A trap for catching intruders

Correct answer: A two-door entry system where the first door must close before the second will open, preventing tailgating

A mantrap (or airlock) uses two interlocking doors — the first must close completely before the second will open. Only one person can enter the space between doors, effectively preventing tailgating.

Question 35: What is the correct procedure for a security guard discovering a health and safety hazard?

Ignore it — it's not their responsibility
Only report it if someone gets injured
Fix it themselves regardless of qualification
Make the area safe if possible, report the hazard to the site manager and log it in the incident book (Correct answer)

Correct answer: Make the area safe if possible, report the hazard to the site manager and log it in the incident book

The guard should take immediate steps to make the area safe (e.g., cordon off a wet floor), report the hazard to the site manager or facilities team, and document it in the incident log. Do not attempt repairs you are not qualified for.

Question 36: What does 'defence in depth' mean in the context of access control?

Defending the building's deepest point
Using multiple layers of security measures so that if one layer fails, others still provide protection (Correct answer)
Only protecting underground areas
Having very deep foundations

Correct answer: Using multiple layers of security measures so that if one layer fails, others still provide protection

Defence in depth means implementing multiple layers of security — perimeter fencing, CCTV, patrols, access control, intruder alarms, etc. If one layer is breached, subsequent layers continue to provide protection.

Question 37: What makes a security report admissible as evidence in court?

Being factual, contemporaneous, legible, objective, and made by the person who witnessed the events (Correct answer)
Being signed by a solicitor
Being long and detailed
Being typed on official paper

Correct answer: Being factual, contemporaneous, legible, objective, and made by the person who witnessed the events

For a report to be admissible as evidence, it should be: factual (not opinion), made contemporaneously (at the time), legible, objective, written by the person who witnessed the events, and free from alterations or corrections that could suggest tampering.

Question 38: Why should a security guard vary their patrol times and routes?

To prevent potential offenders from predicting their movements and exploiting gaps in coverage (Correct answer)
To avoid boredom
To find shorter routes
To explore different parts of the building

Correct answer: To prevent potential offenders from predicting their movements and exploiting gaps in coverage

Varying patrol times and routes makes the guard's movements unpredictable, preventing potential offenders from timing their activities to avoid detection.

Question 39: Under what circumstances can a security guard use force to protect a third party (another person) from an assault?

Only to protect themselves, not a third party
A security guard, like any citizen, can use reasonable force to protect a third party from an unlawful attack under the common law right of defence of others (Correct answer)
Only if specifically authorised by their employer in writing
Only if the third party has given verbal consent to be defended

Correct answer: A security guard, like any citizen, can use reasonable force to protect a third party from an unlawful attack under the common law right of defence of others

The common law right of self-defence extends to the defence of others. A security guard (or any citizen) may use reasonable force to prevent an unlawful assault on a third party. The force used must be reasonable and proportionate to the threat faced by the person being defended.

Question 40: What is a 'guard tour system' and what is its purpose?

An electronic system that records when and where a guard has patrolled, providing proof that checks have been completed (Correct answer)
A tourism guide for security guards
A guard's personal fitness tracker
A GPS navigation device for mobile patrols

Correct answer: An electronic system that records when and where a guard has patrolled, providing proof that checks have been completed

A guard tour system uses checkpoints (electronic tags, QR codes, or NFC points) placed around the site that the guard scans during patrols. It creates an audit trail proving patrols were completed at the correct times.

Question 41: What is the purpose of a 'sign-out' procedure for visitors?

To collect feedback about their visit
To ensure all visitors have left the premises, retrieve visitor passes, and maintain an accurate record of who is on site (Correct answer)
To remind them to come again
To say goodbye politely

Correct answer: To ensure all visitors have left the premises, retrieve visitor passes, and maintain an accurate record of who is on site

The sign-out procedure ensures all visitors are accounted for (critical during evacuations), retrieves and deactivates visitor passes, records departure times, and maintains an accurate record of who is currently on site.

Question 42: How should a security guard describe actions in a report — past tense or present tense?

Future tense
Any tense is acceptable
Present tense always
Past tense, as the report describes events that have already occurred (Correct answer)

Correct answer: Past tense, as the report describes events that have already occurred

Reports should be written in the past tense because they describe events that have already happened. For example: 'I observed a male individual enter the car park at 2230 hrs' — not 'I observe'.

Question 43: What is 'lone working' and what risks does it present for security guards?

Working on a single-storey building
Working with only one client
Working alone without direct supervision, which presents risks including confrontation, medical emergencies, and delayed assistance (Correct answer)
Working for only one security company

Correct answer: Working alone without direct supervision, which presents risks including confrontation, medical emergencies, and delayed assistance

Lone working means working alone without colleagues nearby. Risks include: confrontation without backup, medical emergencies with no one to help, vulnerability to attack, and delayed response from emergency services.

Question 44: Why is accurate report writing important for security guards?

Only to satisfy the client
To improve their English skills
Reports may be used as evidence in court, for insurance claims, internal investigations, and to demonstrate due diligence (Correct answer)
To fill time during quiet periods

Correct answer: Reports may be used as evidence in court, for insurance claims, internal investigations, and to demonstrate due diligence

Security reports may be used as legal evidence, form the basis of insurance claims, support internal investigations, demonstrate compliance with procedures, and provide a historical record of incidents.

SIA Security Guard Exam

The SIA Security Guard Exam is the licensing test for security personnel in the UK, assessing knowledge of security procedures, access control, report writing, and fire safety as required by the Security Industry Authority.

Questions

75 min

Time Limit

74%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds