In a physical protection system, detection is the sensing step: sensors identify something unusual and generate an alarm or event. Assessment is the next step, where you evaluate how serious that event is and decide what action to take—who to alert, how to respond, and what remediation or containment is needed. This option matches that flow by saying detection triggers events, and assessment determines both the seriousness and the appropriate actions to take. It captures the idea that detection flags something, while assessment translates that flag into a measured response. The other choices misrepresent the role of assessment (for example, limiting it to costs or only deciding seriousness) or misstate what detection does (such as reporting to external agencies, which isn't a core PPS function).

Lockdown is a response focused on restricting movement and securing the building to protect occupants when a threat is inside. The goal is to isolate the danger, keep people out of harm’s way, and give responders a safer environment to work in. It’s used when there is an active threat inside the building—like an intruder or attacker—where moving people out through exits would put them at greater risk or isn’t feasible. In a lockdown, occupants typically stay put, secure doors, turn off or silence lights and devices, and avoid windows or visibility until authorities say it’s safe to move. This differs from evacuating everyone through exterior exits, which is appropriate when the threat is outside or has been resolved. It’s not a routine drill with no security implications, and it isn’t just about locking exterior doors during business hours.

A tabletop exercise is a discussion-based activity where security teams walk through a hypothetical incident to test how the response plan would work. In this setting, participants talk through actions, decisions, and communications as if the incident were happening, but no real resources are deployed. The purpose is to surface gaps in procedures, clarify roles, validate escalation paths, and improve coordination and decision-making without the risk and cost of a live operation. This makes it the best fit for testing and refining security plans in a controlled environment. A live field drill would involve responders physically acting out the scenario; a software simulation would model assets or systems rather than human processes; and reviewing past incidents is an after-action activity focused on learning from what happened rather than practicing the current plan.

Mitigating social engineering in physical security relies on creating consistent, security-minded behavior plus solid process controls. Training equips people to recognize manipulation tactics like impersonation, pretexting, or pressure to bypass procedures. Policy enforcement establishes clear rules for verification, reporting, and handling unusual requests, so everyone follows the same safe routines. Verification procedures—such as confirming identities, validating the purpose of visits, and requiring escorts or guest logs—provide concrete checks that reduce reliance on memory or gut instinct. Strict visitor controls put those rules into practice by limiting where visitors can go, who can access what areas, and how access rights are managed. Together, these measures create layered defenses that make it much harder for a social engineer to succeed. Relying on memory, removing security staff, or granting blanket access with a badge all weaken those defenses and increase risk.