Law School Admission Test for federal honors / N/A Protective Operations and Investigative Knowledge Syllabus

What is a tourniquet used for and when should it be applied?

To stop life-threatening arterial/extremity bleeding by occluding blood flow; applied high and tight on the limb above a wound that cannot be controlled by direct pressure.

What does the acronym AED stand for and what does it do?

Automated External Defibrillator; it analyzes heart rhythm and delivers an electric shock to restore normal rhythm in sudden cardiac arrest.

What is the medical readiness purpose of identifying the nearest trauma hospital during advance work?

To pre-plan the fastest evacuation route and notify the facility so a wounded protectee receives definitive care within the 'golden hour' for maximum survival.

What is the U.S. Secret Service's longstanding dual mission?

Protection (of national leaders, visiting heads of state, and events) and investigation of financial/cyber crimes (counterfeiting, financial fraud, and related crimes).

What are the primary security features used to detect genuine U.S. currency?

Color-shifting ink, watermark, security thread, microprinting, raised/intaglio printing texture, and red and blue fibers embedded in the paper.

What is the composition of genuine U.S. paper currency?

It is made of 75% cotton and 25% linen (not wood-pulp paper), giving it a distinctive texture and embedded red and blue fibers.

How does the security thread help detect counterfeit U.S. bills?

A genuine note has an embedded vertical thread that glows a specific color under ultraviolet light and is printed with the denomination, visible when held to light.

What is a watermark and how is it used to verify currency?

A faint image (often a portrait or numeral) embedded in the paper, visible when held to light from both sides; counterfeits often lack a true watermark or have a printed imitation.

What is the role of color-shifting (optically variable) ink on U.S. notes?

The numeral in a lower corner changes color (e.g., copper to green) when the note is tilted; flat printing that doesn't shift indicates a counterfeit.

What is the proper action when you receive a suspected counterfeit note?

Do not return it to the passer; delay them if safe, note their description and any vehicle, limit handling to preserve fingerprints, and contact authorities (Secret Service/police), surrendering the note.

Define money laundering.

The process of concealing the illegal origin of criminally obtained funds to make them appear legitimate.

What are the three classic stages of money laundering?

Placement (introducing illicit cash into the financial system), Layering (moving/disguising it through complex transactions), and Integration (returning 'cleaned' funds as apparent legitimate assets).

What is 'structuring' (smurfing) in financial crime?

Breaking a large cash transaction into multiple smaller deposits below the reporting threshold (e.g., under $10,000) to evade Currency Transaction Report requirements.

What is a Suspicious Activity Report (SAR)?

A report financial institutions must file with regulators (FinCEN) documenting transactions that suggest possible money laundering, fraud, or other criminal activity.

What threshold triggers a Currency Transaction Report (CTR) in the U.S.?

Cash transactions exceeding $10,000 in a single business day must be reported by financial institutions.

What distinguishes a Ponzi scheme from a pyramid scheme?

A Ponzi scheme pays earlier investors with later investors' money under the guise of investment returns; a pyramid scheme requires participants to recruit new members who pay in, with money flowing up the recruitment chain.

What is identity theft and a common method used to commit it?

Stealing someone's personal/financial data to commit fraud; common methods include phishing, skimming card data, data breaches, and mail theft.

What is 'phishing' in cyber-enabled crime?

A social-engineering attack using fraudulent emails, messages, or websites that impersonate trusted entities to trick victims into revealing credentials, financial data, or installing malware.

What is Business Email Compromise (BEC)?

A fraud where criminals impersonate an executive or vendor via email to trick employees into wiring money or sending sensitive data to attacker-controlled accounts.

What is ransomware?

Malicious software that encrypts a victim's files or systems and demands payment (often cryptocurrency) for the decryption key.

What is digital evidence and why is the chain of custody critical for it?

Information stored or transmitted in binary form usable in court; an unbroken, documented chain of custody proves the evidence was not altered, ensuring its admissibility and integrity.

Why must digital evidence be preserved by working from a forensic copy (image) rather than the original?

Examining the original can alter timestamps or data; investigators create a verified bit-for-bit image and use a write-blocker so the original remains unchanged for court.

What is a hash value's role in digital forensics?

A cryptographic hash (e.g., SHA-256) creates a unique digital fingerprint of data; matching hashes before and after handling proves the evidence was not altered.

What is the difference between an interview and an interrogation?

An interview is a non-accusatory, information-gathering conversation with cooperative subjects; an interrogation is an accusatory questioning of a suspect believed to be involved, aimed at obtaining a confession or truth.

What are the main types of physical surveillance?

Stationary (fixed/stakeout), mobile (foot or vehicle following), and technical/electronic surveillance; coverage can be loose, close, or combined.

What is the purpose of case management in investigations?

To organize evidence, leads, documentation, timelines, and tasks so an investigation is thorough, coordinated, and legally defensible from initiation to closure.

What baseline behavior helps in detecting suspicious behavior or anomalies?

Establishing what is 'normal' for a setting so deviations (anomalies)—such as out-of-place dress, nervousness, or unusual interest—stand out as potential indicators of a threat.

What are common behavioral indicators of potential hostile surveillance or threat?

Repeated unexplained presence, photographing security measures, avoiding eye contact or cameras, nervous sweating, overdressing for weather, unusual interest in access points, and inconsistent cover stories.

What is chain of command and why must it be followed in field operations?

The clear hierarchy of authority and responsibility for orders and reporting; following it ensures coordinated action, accountability, and clear decision-making during fast-moving operations.

In ethical decision-making under pressure, what test helps evaluate a difficult choice?

Ask whether the action is legal, complies with policy/oath, withstands public scrutiny (the 'front-page' test), and is fair—choosing integrity over expedience even when no one is watching.