Observation includes three components: Noticing, interpreting, and recalling.

• A. False
• B. Noticing, interpreting, recalling
• C. True
• D. Not sure

Answer: (C)

Observation is an active, three-part process in security work: noticing the details in the environment, interpreting what those details mean in context, and recalling relevant information from memory. Noticing is gathering the raw data—the quirks, anomalies, or indicators you see. Interpreting is evaluating what those details suggest about risk or intent, assigning meaning, and determining potential significance. Recalling is pulling in policies, procedures, past incidents, or training so you know how to respond appropriately. This sequence—notice, interpret, recall—is how you build situational awareness and decide on the right action, rather than simply watching passively.