Critical Thinking and Analysis Flashcards

An intelligence brief states: 'There is a medium probability that a protest will occur outside the facility on Friday.' What does 'medium probability' MOST appropriately indicate for planning purposes?

Answer: The possibility is significant enough to warrant contingency planning while maintaining normal operations

Medium probability warrants contingency planning and preparation without full resource deployment, which would be reserved for high-probability threats.

Officers receive these facts: (1) Only credentialed staff may access Level 3. (2) A fingerprint scan is required for Level 3 entry. (3) Officer Walsh accessed Level 3 at 0145. What can be DEFINITIVELY concluded?

Answer: Officer Walsh has a credential AND their fingerprint was scanned

Both conditions (credential + fingerprint scan) must be met to access Level 3. If Walsh accessed it, both conditions were satisfied.

A supervisor reviews incident data from the past year showing that 73% of unauthorized access attempts occurred between 2200 and 0200. The supervisor should MOST appropriately:

Answer: Increase patrol intensity during 2200–0200 and consider additional countermeasures for that window

Data showing 73% of incidents in a 4-hour window provides strong evidence for targeted resource allocation during that high-risk period.

Two officers submit conflicting reports about the timing of an event. Officer A states the event occurred at 1515; Officer B states it occurred at 1530. Both officers were present. The MOST appropriate interpretation is:

Answer: The discrepancy should be documented and both officers interviewed to determine the accurate timeline

Even a 15-minute discrepancy can be significant in security incidents; conflicting reports require investigation to establish the accurate timeline.

A security analyst notes that over the past month, three attempts to access a particular server room all occurred within 10 minutes of a shift change. What does this pattern MOST likely suggest?

Answer: The threat actor may have knowledge of shift schedules and is exploiting the transition period

A pattern linked to shift changes suggests the threat actor knows the schedule and is deliberately exploiting the brief vulnerability during personnel transitions.

An officer is reviewing a grant of access for a new employee. The HR database shows the employee was cleared for Level 2 access. The physical access log shows the employee has been accessing Level 3. What should the officer do FIRST?

Answer: Verify whether Level 3 access was properly authorized through a separate channel and has not yet been updated in HR records

Before taking enforcement action, the officer should verify whether the access was legitimately authorized but not yet reflected in the database — a common administrative lag.