CPP Cheat Sheet 2026

The 30 highest-yield CPP facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. Which domain is part of the current CPP exam content outline? → Security Principles and Practices
2. Under Enterprise Security Risk Management (ESRM), who typically makes the final decision about accepting a security risk? → The asset owner or business leader
3. What must a CPP applicant submit to document their experience? → An application describing security work history, which ASIS may verify
4. Where does a CPP typically submit recertification credits and the application? → Through ASIS International's certification portal
5. In a business impact analysis, what does the Recovery Time Objective (RTO) define? → The target time within which a function must be restored after disruption
6. How many total multiple-choice questions are on the CPP exam, including unscored pretest items? → 225
7. In an investigation, which interview approach is generally recommended for obtaining truthful information from a cooperative witness? → Non-accusatory, open-ended questioning
8. A CPP discovers that his employer is falsifying safety inspection records. After internal reporting fails, the most appropriate next step is: → Report to the appropriate regulatory authority through lawful channels
9. Piggybacking (or tailgating) is a threat specifically addressed by which physical control? → Mantraps or airlock vestibules
10. An investigator suspects inventory theft at a distribution center. Which step should normally come first? → Define the scope and objectives and review existing records
11. A security manager calculates Annualized Loss Expectancy (ALE). Which formula is correct? → Single Loss Expectancy × Annualized Rate of Occurrence
12. During an internal investigation, an interviewer threatens an employee with arrest unless she confesses. This primarily risks: → A coerced, unreliable confession and potential civil liability
13. In the intelligence cycle, which phase involves converting raw collected data into a finished product for decision-makers? → Analysis and production
14. What is the primary function of an Emergency Operations Center (EOC) during a major incident? → To coordinate strategic-level support and resources for incident command
15. How should challenges in applied methods and techniques be addressed? → Apply systematic problem-solving, seek expert guidance when needed, and document decisions
16. How many continuing professional education (CPE) credits must a CPP earn per three-year recertification cycle? → 60
17. A CPP volunteers as a chapter officer in an ASIS local chapter. How is this generally viewed for recertification? → As a qualifying professional development activity
18. What is the importance of understanding 'legal and ethical standards' for security professionals? → It ensures compliance with laws and prevents legal issues
19. Granting users only the minimum access rights needed to perform their jobs describes which principle? → Least privilege
20. Directing visitors to a single entrance with walkways, landscaping, and building layout is best described as: → Natural access control
21. An ASIS member receives a gift basket worth $25 from a vendor during the holidays. Under typical corporate ethics policies, the best action is to: → Follow the organization's gift policy, disclosing or declining as required
22. Which study area belongs in the Personnel Security domain? → Background investigations, pre-employment screening, and workplace violence prevention
23. How long is the CPP recertification cycle? → Three years
24. In a corporate fraud investigation, the 'fraud triangle' concept holds that fraud requires which three elements? → Pressure, rationalization, and opportunity
25. What quality assurance measure supports assessment and evaluation? → Regular self-assessment, peer review, and adherence to established standards
26. In the context of professional ethics, 'due diligence' most closely means: → Exercising the care a reasonable professional would in the same circumstances
27. What is the primary objective of Business Continuity Planning (BCP)? → To ensure critical business functions can continue during and after a disruption
28. What is the main purpose of applying defense in depth to a protected asset? → To make sure the failure of one control does not expose the asset
29. What does 'chain of custody' ensure in a corporate investigation? → Evidence handling is documented from collection to presentation
30. Which step comes FIRST in a structured security risk assessment? → Identifying and valuing assets