diff --git a/src/management/nfd-controller.cpp b/src/management/nfd-controller.cpp
index acd2435..0a56777 100644
--- a/src/management/nfd-controller.cpp
+++ b/src/management/nfd-controller.cpp
@@ -30,14 +30,15 @@
 
 const uint32_t Controller::ERROR_TIMEOUT = 10060; // WinSock ESAETIMEDOUT
 const uint32_t Controller::ERROR_NACK = 10800; // 10000 + TLV-TYPE of Nack header
+const uint32_t Controller::ERROR_VALIDATION = 10021; // 10000 + TLS1_ALERT_DECRYPTION_FAILED
 const uint32_t Controller::ERROR_SERVER = 500;
 const uint32_t Controller::ERROR_LBOUND = 400;
 ValidatorNull Controller::s_validatorNull;
 
-Controller::Controller(Face& face, KeyChain& keyChain)
+Controller::Controller(Face& face, KeyChain& keyChain, Validator& validator)
   : m_face(face)
   , m_keyChain(keyChain)
-  , m_validator(s_validatorNull) /// \todo #3653 accept validator as constructor parameter
+  , m_validator(validator)
 {
 }
 
@@ -136,7 +137,9 @@
       onFailure(ERROR_SERVER, msg);
       break;
     case SegmentFetcher::ErrorCode::SEGMENT_VALIDATION_FAIL:
-      BOOST_ASSERT(false); /// \todo #3653 introduce ERROR_VALIDATION
+      /// \todo When SegmentFetcher exposes validator error code, Controller::ERROR_VALIDATION
+      ///       should be replaced with a range that corresponds to validator error codes.
+      onFailure(ERROR_VALIDATION, msg);
       break;
     case SegmentFetcher::ErrorCode::NACK_ERROR:
       onFailure(ERROR_NACK, msg);
diff --git a/src/management/nfd-controller.hpp b/src/management/nfd-controller.hpp
index 7ebc5eb..3ae1cf2 100644
--- a/src/management/nfd-controller.hpp
+++ b/src/management/nfd-controller.hpp
@@ -55,7 +55,7 @@
   /** \brief construct a Controller that uses face for transport,
    *         and uses the passed KeyChain to sign commands
    */
-  Controller(Face& face, KeyChain& keyChain);
+  Controller(Face& face, KeyChain& keyChain, Validator& validator = s_validatorNull);
 
   /** \brief start command execution
    */
@@ -140,6 +140,10 @@
    */
   static const uint32_t ERROR_NACK;
 
+  /** \brief error code for response validation failure
+   */
+  static const uint32_t ERROR_VALIDATION;
+
   /** \brief error code for server error
    */
   static const uint32_t ERROR_SERVER;
diff --git a/tests/dummy-validator.hpp b/tests/dummy-validator.hpp
new file mode 100644
index 0000000..40e4bcb
--- /dev/null
+++ b/tests/dummy-validator.hpp
@@ -0,0 +1,108 @@
+/* -*- Mode:C++; c-file-style:"gnu"; indent-tabs-mode:nil; -*- */
+/**
+ * Copyright (c) 2013-2016 Regents of the University of California.
+ *
+ * This file is part of ndn-cxx library (NDN C++ library with eXperimental eXtensions).
+ *
+ * ndn-cxx library is free software: you can redistribute it and/or modify it under the
+ * terms of the GNU Lesser General Public License as published by the Free Software
+ * Foundation, either version 3 of the License, or (at your option) any later version.
+ *
+ * ndn-cxx library is distributed in the hope that it will be useful, but WITHOUT ANY
+ * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A
+ * PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more details.
+ *
+ * You should have received copies of the GNU General Public License and GNU Lesser
+ * General Public License along with ndn-cxx, e.g., in COPYING.md file.  If not, see
+ * <http://www.gnu.org/licenses/>.
+ *
+ * See AUTHORS.md for complete list of ndn-cxx authors and contributors.
+ */
+
+#ifndef NDN_TESTS_DUMMY_VALIDATOR_HPP
+#define NDN_TESTS_DUMMY_VALIDATOR_HPP
+
+#include "security/validator.hpp"
+
+namespace ndn {
+namespace tests {
+
+/** \brief a Validator for unit testing
+ */
+class DummyValidator : public Validator
+{
+public:
+  /** \brief constructor
+   *  \param shouldAccept whether to accept or reject all validation requests
+   */
+  explicit
+  DummyValidator(bool shouldAccept = true)
+  {
+    this->setResult(shouldAccept);
+  }
+
+  /** \brief change the validation result
+   *  \param shouldAccept whether to accept or reject all validation requests
+   */
+  void
+  setResult(bool shouldAccept)
+  {
+    m_decide = [shouldAccept] (const Name&) { return shouldAccept; };
+  }
+
+  /** \brief set a callback for validation
+   *  \param cb a callback which receives the Interest/Data name for each validation request;
+   *            its return value determines the validation result
+   */
+  void
+  setResultCallback(const function<bool(const Name&)>& cb)
+  {
+    m_decide = cb;
+  }
+
+protected:
+  virtual void
+  checkPolicy(const Interest& interest, int nSteps,
+              const OnInterestValidated& accept, const OnInterestValidationFailed& reject,
+              std::vector<shared_ptr<ValidationRequest>>&) override
+  {
+    if (m_decide(interest.getName())) {
+      accept(interest.shared_from_this());
+    }
+    else {
+      reject(interest.shared_from_this(), "");
+    }
+  }
+
+  virtual void
+  checkPolicy(const Data& data, int nSteps,
+              const OnDataValidated& accept, const OnDataValidationFailed& reject,
+              std::vector<shared_ptr<ValidationRequest>>&) override
+  {
+    if (m_decide(data.getName())) {
+      accept(data.shared_from_this());
+    }
+    else {
+      reject(data.shared_from_this(), "");
+    }
+  }
+
+private:
+  function<bool(const Name&)> m_decide;
+};
+
+/** \brief a DummyValidator initialized to reject all requests
+ */
+class DummyRejectValidator : public DummyValidator
+{
+public:
+  DummyRejectValidator()
+    : DummyValidator(false)
+  {
+  }
+};
+
+} // namespace tests
+} // namespace ndn
+
+#endif // NDN_TESTS_DUMMY_VALIDATOR_HPP
diff --git a/tests/unit-tests/management/nfd-controller-fixture.hpp b/tests/unit-tests/management/nfd-controller-fixture.hpp
index 9894468..492cbc2 100644
--- a/tests/unit-tests/management/nfd-controller-fixture.hpp
+++ b/tests/unit-tests/management/nfd-controller-fixture.hpp
@@ -22,6 +22,9 @@
 #ifndef NDN_TESTS_MANAGEMENT_NFD_CONTROLLER_FIXTURE_HPP
 #define NDN_TESTS_MANAGEMENT_NFD_CONTROLLER_FIXTURE_HPP
 
+#include "management/nfd-controller.hpp"
+#include "../../dummy-validator.hpp"
+
 #include "boost-test.hpp"
 #include "util/dummy-client-face.hpp"
 #include "../identity-management-time-fixture.hpp"
@@ -37,7 +40,7 @@
 protected:
   ControllerFixture()
     : face(io, m_keyChain)
-    , controller(face, m_keyChain)
+    , controller(face, m_keyChain, m_validator)
     , failCallback(bind(&ControllerFixture::fail, this, _1, _2))
   {
     Name identityName("/localhost/ControllerFixture");
@@ -49,6 +52,17 @@
     }
   }
 
+  /** \brief controls whether Controller's validator should accept or reject validation requests
+   *
+   *  Initially, the validator accepts all requests.
+   *  Setting \p false causes validator to reject all requests.
+   */
+  void
+  setValidationResult(bool shouldAccept)
+  {
+    m_validator.setResult(shouldAccept);
+  }
+
 private:
   void
   fail(uint32_t code, const std::string& reason)
@@ -61,6 +75,9 @@
   Controller controller;
   Controller::CommandFailCallback failCallback;
   std::vector<uint32_t> failCodes;
+
+private:
+  DummyValidator m_validator;
 };
 
 } // namespace tests
diff --git a/tests/unit-tests/management/nfd-status-dataset.t.cpp b/tests/unit-tests/management/nfd-status-dataset.t.cpp
index e27d4a3..bc4b495 100644
--- a/tests/unit-tests/management/nfd-status-dataset.t.cpp
+++ b/tests/unit-tests/management/nfd-status-dataset.t.cpp
@@ -135,6 +135,24 @@
   BOOST_CHECK_EQUAL(failCodes.back(), Controller::ERROR_SERVER);
 }
 
+BOOST_AUTO_TEST_CASE(ValidationFailure)
+{
+  this->setValidationResult(false);
+
+  controller.fetch<FaceDataset>(
+    [] (const std::vector<FaceStatus>& result) { BOOST_FAIL("fetchDataset should not succeed"); },
+    failCallback);
+  this->advanceClocks(time::milliseconds(500));
+
+  FaceStatus payload;
+  payload.setFaceId(5744);
+  this->sendDataset("/localhost/nfd/faces/list", payload);
+  this->advanceClocks(time::milliseconds(500));
+
+  BOOST_REQUIRE_EQUAL(failCodes.size(), 1);
+  BOOST_CHECK_EQUAL(failCodes.back(), Controller::ERROR_VALIDATION);
+}
+
 BOOST_AUTO_TEST_CASE(Nack)
 {
   controller.fetch<FaceDataset>(
diff --git a/tests/unit-tests/util/segment-fetcher.t.cpp b/tests/unit-tests/util/segment-fetcher.t.cpp
index ffcc402..8fbbb45 100644
--- a/tests/unit-tests/util/segment-fetcher.t.cpp
+++ b/tests/unit-tests/util/segment-fetcher.t.cpp
@@ -21,7 +21,7 @@
 
 #include "util/segment-fetcher.hpp"
 #include "security/validator-null.hpp"
-#include "security/validator.hpp"
+#include "../../dummy-validator.hpp"
 #include "data.hpp"
 #include "encoding/block.hpp"
 
@@ -36,33 +36,11 @@
 namespace util {
 namespace tests {
 
+using namespace ndn::tests;
+
 BOOST_AUTO_TEST_SUITE(UtilSegmentFetcher)
 
-class ValidatorFailed : public Validator
-{
-protected:
-  virtual void
-  checkPolicy(const Data& data,
-              int nSteps,
-              const OnDataValidated& onValidated,
-              const OnDataValidationFailed& onValidationFailed,
-              std::vector<shared_ptr<ValidationRequest>>& nextSteps)
-  {
-    onValidationFailed(data.shared_from_this(), "Data validation failed.");
-  }
-
-  virtual void
-  checkPolicy(const Interest& interest,
-              int nSteps,
-              const OnInterestValidated& onValidated,
-              const OnInterestValidationFailed& onValidationFailed,
-              std::vector<shared_ptr<ValidationRequest>>& nextSteps)
-  {
-    onValidationFailed(interest.shared_from_this(), "Interest validation failed.");
-  }
-};
-
-class Fixture : public ndn::tests::IdentityManagementTimeFixture
+class Fixture : public IdentityManagementTimeFixture
 {
 public:
   Fixture()
@@ -210,9 +188,9 @@
 
 BOOST_FIXTURE_TEST_CASE(SegmentValidationFailure, Fixture)
 {
-  ValidatorFailed failedValidator;
+  DummyRejectValidator rejectValidator;
   SegmentFetcher::fetch(face, Interest("/hello/world", time::seconds(1000)),
-                        failedValidator,
+                        rejectValidator,
                         bind(&Fixture::onComplete, this, _1),
                         bind(&Fixture::onError, this, _1));