ASIS CPP Exam Flashcards

Q: What is the current ASIS CPP exam format?

The CPP exam contains 200 scored multiple-choice questions and 25 unscored pretest questions. Candidates have four hours. Pretest questions are mixed into the exam and are not identified to candidates.

Q: What score is required to pass the ASIS CPP exam?

ASIS requires a scaled score of at least 650. A scaled score is a standardized transformation of the raw number correct, not the number of correct answers and not a percentage.

Q: What experience is required for CPP eligibility?

The handbook requires seven years of security experience with no higher-education degree, six with a bachelor's degree, or five with a master's degree. Each route includes at least three years in responsible charge. Holding the APP reduces the total experience requirement by one year. Experience must be full time or a primary duty, but current employment is not required.

Q: What does responsible charge mean for CPP eligibility?

Responsible charge means authority to make independent decisions and take independent actions about operational methodology and execution of a security-related project or process. It does not require supervising employees.

Q: What is the CPP retake policy after a failed attempt?

There must be at least 60 days between every exam date. A candidate may test no more than three times during the one-year eligibility period. After three failures, or when that eligibility period expires, the candidate must submit a new certification application before testing again.

Q: How long does the CPP certification remain valid?

CPP certification operates on a three-year recertification cycle. A certificant must earn and report 60 qualifying Continuing Professional Education credits during the cycle under the current ASIS recertification rules.

Q: Does ASIS publish the CPP exam pass rate?

No. ASIS does not publish a current official CPP pass rate. Percentages reported by training providers or other third parties should not be presented as an ASIS statistic.

Question 1

What is the core management idea behind enterprise security risk management (ESRM)?

Accepted Answer

Security decisions should protect assets that enable the organization's mission. Asset owners own the risks, while security professionals facilitate risk decisions and align safeguards with business priorities.

Question 2

Why should a security program define governance before choosing controls?

Accepted Answer

Governance assigns decision rights, accountability, escalation paths, and oversight. Without it, controls may exist but no one clearly owns risk acceptance, resources, or corrective action.

Question 3

What should be evaluated before adopting an AI- or IoT-enabled security control?

Accepted Answer

Evaluate the business need, accuracy, bias or privacy exposure, cybersecurity, interoperability, failure modes, human oversight, and full lifecycle cost. New capability must not create unmanaged risk.

Question 4

When is a qualitative risk assessment preferable to a quantitative one?

Accepted Answer

Use qualitative ratings when reliable loss data are limited or rapid prioritization is needed. Quantitative analysis is stronger when credible frequencies and financial impacts support numerical comparison.

Question 5

How do threat, vulnerability, and consequence work together in risk analysis?

Accepted Answer

Threat describes a potential harmful actor or event, vulnerability is a weakness it could exploit, and consequence is the resulting impact. A defensible assessment considers all three rather than treating any one as risk by itself.

Question 6

What is a consequential threat?

Accepted Answer

It is a secondary hazard created by an initial event, such as civil disorder after a prolonged outage. Planning should examine cascading effects, not only the initiating incident.

Question 7

How do risk avoidance, acceptance, transfer, and mitigation differ?

Accepted Answer

Avoidance stops the risky activity; acceptance knowingly retains the risk; transfer shifts defined financial or operational consequences; mitigation reduces likelihood or impact. The residual risk still needs an owner.

Question 8

What makes a security-program audit useful for continuous improvement?

Accepted Answer

It compares documented requirements with actual performance, records evidence and gaps, assigns corrective owners and dates, and verifies closure. A finding alone does not improve the program.

Question 9

What distinguishes an outcome metric from an activity metric in security?

Accepted Answer

An activity metric counts work performed, such as training sessions. An outcome metric shows the effect, such as fewer reporting errors or faster response, and is more useful for judging program value.

Question 10

What is the security manager's purpose in maintaining external liaison relationships?

Accepted Answer

Liaisons create trusted channels before an incident for information sharing, coordinated planning, resource access, and jurisdictional clarity. Contact lists alone are not working relationships.

Question 11

How should a security-awareness program be evaluated?

Accepted Answer

Set observable objectives, measure knowledge and behavior, analyze incident or reporting trends, and adjust content for different roles. Attendance proves delivery, not effectiveness.

Question 12

What does fiduciary responsibility require from a security manager who controls a budget?

Accepted Answer

Use funds for authorized purposes, maintain accurate records and approvals, protect assets, disclose conflicts, and support auditability. Good intentions do not replace financial controls.

Question 13

How should budget variance be used during the security budget lifecycle?

Accepted Answer

Compare actual results with the approved plan, explain material differences, forecast their effect, and take or propose corrective action. Variance analysis is a management tool, not merely a year-end report.

Question 14

What is the practical difference between a security policy and a procedure?

Accepted Answer

A policy states management intent, requirements, and accountability; a procedure gives the ordered steps for carrying it out. Procedures should trace to policy and remain workable at the operating level.

Question 15

What makes a productivity KPI suitable for a security process?

Accepted Answer

It is tied to a defined objective, uses reliable data, has an owner and target, and encourages the intended behavior. A convenient count can be misleading if it rewards speed at the expense of quality or risk.

Question 16

Why perform a job analysis before recruiting for a security position?

Accepted Answer

Job analysis identifies essential duties, competencies, authority, and working conditions. It supports defensible selection criteria, relevant screening, training plans, and performance measures.

Question 17

How does succession planning reduce security-program risk?

Accepted Answer

It identifies critical roles, potential successors, competency gaps, and development actions before a vacancy. The goal is continuity of capability, not simply naming a backup.

Question 18

What is management's role in creating an ethical security climate?

Accepted Answer

Leaders set clear conduct expectations, model them, protect confidential information, provide safe reporting channels, investigate consistently, and apply consequences without favoritism.

Question 19

What should a security service-level agreement make measurable?

Accepted Answer

Define the service, performance standard, measurement method, reporting interval, escalation process, remedies, and responsibilities. Monitoring those terms turns a vendor promise into manageable performance.

Question 20

What should an investigation plan establish before fact-finding begins?

Accepted Answer

Define the allegation, objectives, scope, authority, legal or policy constraints, resources, evidence sources, roles, milestones, and reporting path. The plan should also protect independence and confidentiality.

Question 21

What information makes a chain-of-custody record defensible?

Accepted Answer

Identify the item, collector, date, time, location, condition, packaging, every transfer, purpose, and final disposition. Each handoff should show who controlled the evidence and when.

Question 22

What must be resolved before using surveillance technology in an investigation?

Accepted Answer

Confirm lawful authority, necessity, proportionality, scope, privacy limits, data handling, operator competence, and approval. Capabilities such as drones or robotics do not remove legal and ethical constraints.

Question 23

How should a manager choose resources for a specialized investigation?

Accepted Answer

Match the allegation and evidence to needed expertise, independence, legal authority, tools, and preservation methods. Cyber, financial, intellectual-property, and violent-crime matters may require different specialists.

Question 24

What makes an investigative interview more reliable and defensible?

Accepted Answer

Use a planned, lawful, noncoercive approach; account for language and culture; ask open questions before specifics; document accurately; and preserve required rights. Seek counsel when legal exposure exceeds the investigator's authority.

Question 25

How should preemployment screening be scoped?

Accepted Answer

Tie each check to job-related risk, obtain required consent, use reliable sources, protect the data, and apply criteria consistently. More intrusive screening is not automatically more defensible.

Question 26

Why may personnel screening continue after hiring?

Accepted Answer

Promotion, retention, or assignment to a sensitive role can change the risk and required trust level. Any rescreening must follow law and policy, be job related, give notice where required, and protect confidentiality.

Question 27

Why should workplace threat assessment focus on behavior rather than a profile?

Accepted Answer

No reliable demographic profile predicts violence. A multidisciplinary team should evaluate concerning behavior, context, capability, stressors, protective factors, and changes over time, then select proportionate interventions.

Question 28

What should a travel-security plan provide beyond a destination risk rating?

Accepted Answer

Provide traveler briefing, tracking and contact methods, medical and evacuation options, escalation triggers, local support, and a response protocol. Risk intelligence is useful only when it drives decisions and assistance.

Question 29

What should drive the design of an executive-protection program?

Accepted Answer

A current threat and vulnerability assessment should drive protective intelligence, advance work, transportation, staffing, communications, medical support, and liaison. The proprietary-versus-contract choice follows requirements and risk.

Question 30

What evidence should a physical security survey gather?

Accepted Answer

Combine document review, site observation, interviews, system records, tests, and asset or threat data. A checklist organizes the work, but evidence and analysis support the findings.

Question 31

Why compare facility drawings with actual site conditions during a survey?

Accepted Answer

Renovations, undocumented pathways, changed uses, and disabled devices can make drawings inaccurate. Field validation reveals dependencies and gaps that a desk review can miss.

Question 32

What does a physical security gap analysis compare?

Accepted Answer

It compares current safeguards and performance with risk-based requirements or an approved target state. The resulting gaps should be prioritized by risk, feasibility, and dependency.

Question 33

How should detection, delay, and response be related in a protection design?

Accepted Answer

Detection must provide enough reliable warning, and barriers must delay the adversary long enough for an effective response to arrive and intervene. A strong barrier alone may only postpone an unopposed loss.

Question 34

How should physical countermeasures be selected from a risk assessment?

Accepted Answer

Choose a layered mix that addresses identified threats and vulnerabilities, meets legal and operational needs, integrates with existing systems, and produces acceptable residual risk at sustainable lifecycle cost.

Question 35

How should a manager balance security personnel and technology?

Accepted Answer

Assign automation to consistent sensing, logging, and control while preserving trained people for judgment, communication, exception handling, and response. Staffing and technology must be designed as one operating system.

Question 36

What should be defined before accepting a new physical security system from a vendor?

Accepted Answer

Define measurable requirements, interfaces, test cases, documentation, training, defect resolution, and acceptance authority in the procurement package. Factory, site, and commissioning tests should trace to those criteria.

Question 37

How do predictive, preventive, and corrective maintenance differ?

Accepted Answer

Predictive maintenance uses condition data to anticipate failure; preventive maintenance follows planned intervals; corrective maintenance restores a failed or deficient asset. A resilient program deliberately combines them.

Question 38

What makes an information security survey integrated rather than purely technical?

Accepted Answer

It examines physical, procedural, personnel, system, awareness, destruction, and recovery controls together, then traces data flows and dependencies across facility and network boundaries.

Question 39

What do confidentiality, integrity, and availability each protect?

Accepted Answer

Confidentiality prevents unauthorized disclosure, integrity prevents unauthorized or undetected alteration, and availability keeps information and services accessible when needed. Controls may support more than one objective.

Question 40

What effect should a legal hold have on normal records disposition?

Accepted Answer

It suspends routine destruction for information potentially relevant to a legal or regulatory matter. The organization should identify custodians and systems, preserve content and metadata, document actions, and release the hold only with authority.

Question 41

Why does information classification come before choosing many safeguards?

Accepted Answer

Classification ties sensitivity, value, legal duties, and business impact to handling rules. It lets the organization apply proportionate access, storage, transmission, retention, and destruction controls.

Question 42

What makes authentication truly multifactor?

Accepted Answer

It uses independent factor categories, such as something known, possessed, or inherent. Two passwords are two credentials of one factor type, so they do not provide true multifactor authentication.

Question 43

How does data masking differ from encryption?

Accepted Answer

Encryption transforms data with a cryptographic key and can be reversed by an authorized holder. Masking obscures selected values for display or use; depending on the method, it may be irreversible.

Question 44

What governance is needed before a penetration test?

Accepted Answer

Obtain written authorization and define scope, timing, methods, excluded assets, data handling, stop conditions, contacts, reporting, and remediation ownership. Testing without these rules can itself create an incident.

Question 45

How should crisis threats be prioritized for planning?

Accepted Answer

Compare credible likelihood, consequences, vulnerabilities, dependencies, and existing capability, then consider the cost and effect of mitigation. Rare but catastrophic events may still demand preparation.

Question 46

What decision does a business impact analysis support?

Accepted Answer

It identifies critical activities, dependencies, impacts over time, and acceptable disruption, helping leaders set recovery priorities and resource needs. It does not estimate how likely each threat is.

Question 47

What is the value of an all-hazards crisis plan?

Accepted Answer

It builds common capabilities—command, communications, accountability, resource management, and recovery—that work across many events, while hazard-specific annexes address unique actions such as CBRNE controls.

Question 48

What should a mutual-aid agreement establish before a crisis?

Accepted Answer

Define activation authority, resources, command relationships, communications, qualifications, cost and liability terms, logistics, and demobilization. A verbal expectation may fail when every party is under pressure.

Question 49

How do an emergency operations center and incident command relate?

Accepted Answer

Incident command directs tactical operations at or near the incident. The EOC supports coordination, policy, information, and resource allocation across the organization; it should not create competing tactical command.

Question 50

How should recovery reduce risk from the next crisis?

Accepted Answer

Restore priority operations, support affected people, document decisions, and use damage assessment and after-action findings to correct root causes. Rebuilding the same vulnerability only restores the prior risk.

Free ASIS CPP Exam Flashcards

Filter by Topic

Jump to Card

About These ASIS CPP Flashcards

Topics Covered

Frequently Asked Questions

ASIS CPP

Explore More ASIS International Certifications

ASIS PSP Physical Security Professional

ASIS Associate Protection Professional (APP)

ASIS Professional Certified Investigator (PCI)

More From This Family