Certified Protection Professional (CPP) Exam — Questions and Answers

Question 1: A CPP earns 20 credits each year of the cycle. Do they meet the CPP requirement?

Yes, 60 credits over three years meets the requirement (Correct answer)
Yes, but only if all are from one event
No, they need 90
No, credits must all be earned in year three

Correct answer: Yes, 60 credits over three years meets the requirement

Twenty credits per year over three years equals the 60 credits required.

Question 2: A security manager publicly criticizes a competitor's firm with unverified claims of incompetence to win a client. Which ethical principle is violated?

Duty to report crimes to law enforcement
Not maliciously injuring the professional reputation of colleagues (Correct answer)
Obligation to maintain competence
Duty of diligence to the employer

Correct answer: Not maliciously injuring the professional reputation of colleagues

The ASIS Code prohibits maliciously injuring the professional reputation or practice of colleagues, clients, or employers.

Question 3: How can CPP professionals maintain their continuing education?

By reading security-related journals.
By participating in a combination of courses, webinars, and workshops. (Correct answer)
By attending in-person workshops only.
By completing online courses and attending webinars.

Correct answer: By participating in a combination of courses, webinars, and workshops.

CPP professionals can maintain their continuing education and earn recertification credits through diverse methods. Participating in a combination of activities, such as completing online courses, attending webinars, and engaging in workshops, offers flexibility and ensures a comprehensive approach to staying current in the security field. This variety allows professionals to choose learning methods best suited to their needs and schedules.

Question 4: A security director is calculating the annualized loss expectancy (ALE) for a threat. Which formula is correct?

ALE = Asset value - Countermeasure cost
ALE = Single loss expectancy x Annual rate of occurrence (Correct answer)
ALE = Asset value x Exposure factor
ALE = Single loss expectancy / Annual rate of occurrence

Correct answer: ALE = Single loss expectancy x Annual rate of occurrence

ALE equals the single loss expectancy multiplied by how often the loss is expected each year.

Question 5: Which of the following is a key purpose of a daily activity report (DAR)?

Advertising security services
Evaluating officer salaries
Replacing incident reports
Creating a chronological record of shift events and observations (Correct answer)

Correct answer: Creating a chronological record of shift events and observations

DARs document routine shift activity and provide a historical record.

Question 6: Granting users only the minimum access rights needed to perform their jobs describes which principle?

Least privilege (Correct answer)
Defense in depth
Security through obscurity
Separation of duties

Correct answer: Least privilege

Least privilege limits access to what is strictly necessary, reducing the damage from misuse or compromise.

Question 7: In addition to the "Protection of Assets" (POA) reference set, what other valuable resources does ASIS International provide to aid CPP candidates in their exam preparation?

Online forums with unverified security advice.
Outdated college textbooks on criminal justice.
ASIS International certification review courses and practice exams. (Correct answer)
Unofficial study groups on social media.

Correct answer: ASIS International certification review courses and practice exams.

In addition to the POA, ASIS International provides official certification review courses and practice exams specifically designed to aid CPP candidates. These resources are developed by the certifying body, ensuring their accuracy and relevance to the current exam content. They offer structured learning, expert guidance, and realistic exam simulation, making them highly valuable for comprehensive preparation.

Question 8: Which body administers the CPP certification and handles certificant ethics complaints?

ASIS Professional Certification Board (Correct answer)
International Foundation for Protection Officers
ASIS Board of Directors Finance Committee
U.S. Department of Homeland Security

Correct answer: ASIS Professional Certification Board

The ASIS Professional Certification Board (PCB) governs the CPP, PSP, PCI, and APP certifications and their ethics enforcement.

Question 9: How should professionals apply assessment and evaluation in daily practice?

Follow standards only for complex tasks
Only when being evaluated
Consistently integrate best practices into every aspect of professional work (Correct answer)
Apply principles selectively based on convenience

Correct answer: Consistently integrate best practices into every aspect of professional work

Consistent application of professional standards ensures quality outcomes and builds professional credibility.

Question 10: A CPP serves on an ASIS council and helps develop security guidelines. How might this count toward recertification?

It cannot count because it is volunteer work
It replaces the whole recertification requirement
It may qualify as a professional contribution for CPE credit (Correct answer)
It counts only if the CPP is paid

Correct answer: It may qualify as a professional contribution for CPE credit

Volunteer leadership and standards work for the profession can count as professional activities toward CPE.

Question 11: A candidate relies only on memorizing definitions. Why is this risky for the CPP exam?

Many questions are scenario-based and test how to apply management judgment (Correct answer)
The exam has no multiple-choice questions
Definitions are never tested on the CPP
The exam is fully open-book

Correct answer: Many questions are scenario-based and test how to apply management judgment

CPP questions often ask for the best management decision in a scenario, not just recall.

Question 12: In the context of crisis response, what does 'consequence management' focus on?

Identifying and prosecuting perpetrators responsible for the incident
Preventing future similar crises through enhanced security measures
Minimizing the impact of an incident and facilitating recovery (Correct answer)
Managing media and public perception of the organization's response

Correct answer: Minimizing the impact of an incident and facilitating recovery

Consequence management addresses the immediate and long-term effects of an incident, working to minimize harm and restore normal operations as quickly as possible.

Question 13: What is the most effective way to organize study materials for the CPP exam?

By completing one subject per day.
By prioritizing the easiest subjects first.
By breaking materials into manageable sections based on the CPP domains. (Correct answer)
By reviewing only practice exams.

Correct answer: By breaking materials into manageable sections based on the CPP domains.

The CPP exam is structured around specific domains, such as Security Principles and Practices, Business Principles, and Investigations. Organizing study materials according to these domains allows for a systematic and comprehensive approach to learning. This method ensures all required knowledge areas are covered thoroughly and helps candidates understand the interconnectedness of different security concepts, mirroring the exam's structure.

Question 14: What quality assurance measure supports assessment and evaluation?

Regular self-assessment, peer review, and adherence to established standards (Correct answer)
Annual review is sufficient
Quality checks are unnecessary for experienced professionals
Quality only matters for new practitioners

Correct answer: Regular self-assessment, peer review, and adherence to established standards

Ongoing quality assurance through self-assessment, peer review, and standards adherence ensures continuous improvement.

Question 15: Which lighting type is most recommended for perimeter security at a large industrial facility because it is energy-efficient and activates only when motion is detected?

Continuous standby lighting
Controlled or motion-activated lighting (Correct answer)
Emergency backup lighting
Glare projection lighting

Correct answer: Controlled or motion-activated lighting

Motion-activated lighting conserves energy and provides a visible deterrent cue when activity is detected near the perimeter.

Question 16: What role do practice exams play in preparing for the CPP exam?

They provide a sample of exam content and timing practice. (Correct answer)
They replace the need for studying.
They offer detailed explanations for every question.
They ensure memorization of all facts.

Correct answer: They provide a sample of exam content and timing practice.

Practice exams are crucial for CPP preparation because they familiarize candidates with the format, question types, and difficulty level of the actual exam. They also provide valuable practice in time management, which is essential for completing the lengthy exam within the allotted period. This helps reduce test anxiety, identify knowledge gaps, and refine exam-taking strategies.

Question 17: During an internal investigation, an interviewer threatens an employee with arrest unless she confesses. This primarily risks:

A coerced, unreliable confession and potential civil liability (Correct answer)
Stronger evidence for termination
A more efficient investigation
Improved employee morale

Correct answer: A coerced, unreliable confession and potential civil liability

Threats and coercion produce unreliable statements and expose the organization to claims such as false imprisonment or intentional infliction of distress.

Question 18: When an error is discovered in a handwritten official log, the proper correction method is to:

Leave it and add nothing
Tear out the page
Use correction fluid and rewrite
Draw a single line through it, initial, and date the correction (Correct answer)

Correct answer: Draw a single line through it, initial, and date the correction

A single-line strike with initials keeps the original legible and shows accountability.

Question 19: In a business continuity plan, what does the Recovery Point Objective (RPO) measure?

The maximum acceptable amount of data loss, measured in time before the disruption (Correct answer)
The point at which leadership declares a disaster
The maximum acceptable downtime of a process
The location of the alternate recovery site

Correct answer: The maximum acceptable amount of data loss, measured in time before the disruption

The RPO sets how far back data may be restored, which drives backup frequency.

Question 20: A CPP writes and publishes an article on security risk assessment in a professional journal. How is this activity generally treated?

It counts only for PSP holders
It is prohibited as a conflict of interest
It may qualify for CPE credit as a professional contribution (Correct answer)
It only counts if the author is paid

Correct answer: It may qualify for CPE credit as a professional contribution

Publishing professional content is a recognized category of CPE activity.

Question 21: If the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2, what is the annualized loss expectancy (ALE)?

$10,000 (Correct answer)
$50,200
$250,000
$5,000

Correct answer: $10,000

ALE = SLE × ARO, so $50,000 × 0.2 = $10,000.

Question 22: Which type of corporate investigation is specifically concerned with identifying the unauthorized disclosure of proprietary business information?

Trade secret / intellectual property theft investigation (Correct answer)
Workplace harassment investigation
Supply chain audit
Workers' compensation fraud investigation

Correct answer: Trade secret / intellectual property theft investigation

A trade secret investigation focuses on detecting and documenting the theft or unauthorized sharing of confidential business information.

Question 23: What is 'crisis creep' in the context of security management?

The gradual escalation of a minor incident into a full crisis when not addressed promptly (Correct answer)
Slow emergency service response times that worsen an incident's impact
The progressive spread of misinformation through social media during an emergency
Unauthorized personnel infiltrating a designated crisis response zone

Correct answer: The gradual escalation of a minor incident into a full crisis when not addressed promptly

Crisis creep occurs when a situation is not initially recognized as a crisis and gradually escalates due to delayed or inadequate response.

Question 24: The concept of 'territorial reinforcement' in CPTED is best illustrated by:

Installing higher fences
Increasing security officer headcount
Using signage, landscaping, and pavement to delineate public from private space (Correct answer)
Adding more surveillance cameras

Correct answer: Using signage, landscaping, and pavement to delineate public from private space

Territorial reinforcement uses physical and symbolic cues to signal ownership, making intruders feel unwelcome and easily noticed.

Question 25: A key benefit of a standardized incident report form is:

Removing supervisor review
Eliminating the need for narratives
Consistent data capture that supports trend analysis (Correct answer)
Reducing reporting to once per month

Correct answer: Consistent data capture that supports trend analysis

Standard forms ensure uniform data that can be analyzed for patterns.

Question 26: In crisis communications, what is a 'dark site'?

A classified secure communications channel for senior management
A pre-built website kept offline and ready to activate during a crisis (Correct answer)
A facility that has lost all power during an emergency
An emergency operations center operating under blackout conditions

Correct answer: A pre-built website kept offline and ready to activate during a crisis

A dark site is a pre-designed website kept inactive until a crisis occurs, enabling rapid deployment of crisis communications without building content under pressure.

Question 27: In business continuity planning, what characterizes a 'warm site'?

A fully operational duplicate of the primary site capable of immediate activation
A cold storage facility requiring four to six weeks of preparation before becoming operational
A site with basic infrastructure already in place requiring equipment installation and configuration before use (Correct answer)
A mobile operations trailer deployed directly to the disaster location

Correct answer: A site with basic infrastructure already in place requiring equipment installation and configuration before use

A warm site has basic infrastructure such as power, network connectivity, and space pre-installed, but requires additional equipment setup before becoming operational, typically within 24 to 72 hours.

Question 28: Which topic is MOST relevant for CPP continuing education credit?

Crisis management and business continuity planning (Correct answer)
Personal fitness training certification
Advanced watercolor painting
Gourmet cooking techniques

Correct answer: Crisis management and business continuity planning

CPE activities should relate to the security management domains the CPP covers, such as crisis management.

Question 29: What is the foundational principle of communication and documentation in the Certified Protection Professional field?

Avoiding all challenging situations
Maximizing personal advancement
Maintaining competence, integrity, and service to stakeholders (Correct answer)
Following the easiest path available

Correct answer: Maintaining competence, integrity, and service to stakeholders

The foundational principles of communication and documentation in Certified Protection Professional center on maintaining competence, integrity, and quality service.

Question 30: After implementing new countermeasures, what step in the risk management cycle should follow?

Monitor and review effectiveness on an ongoing basis (Correct answer)
Destroy the original assessment
Immediately remove older controls
Stop all further assessments

Correct answer: Monitor and review effectiveness on an ongoing basis

Risk management is cyclical, requiring continuous monitoring to confirm controls remain effective as conditions change.

Question 31: A security proposal to executives that lacks a cost-benefit analysis is most likely to:

Automatically receive full funding
Be approved quickly
Be forwarded to legal
Struggle to gain support due to unclear business value (Correct answer)

Correct answer: Struggle to gain support due to unclear business value

Executives need to see costs weighed against risk reduction to justify investment.

Question 32: Which business metric best shows senior management the value of a security program?

Number of guard posts
Hours of officer training
Total camera count
Return on investment and loss reduction figures (Correct answer)

Correct answer: Return on investment and loss reduction figures

Executives respond best to financial measures such as ROI and documented reductions in losses.

Question 33: Which type of evidence is a witness's testimony that they saw the suspect remove the cash?

Direct evidence (Correct answer)
Hearsay
Circumstantial evidence
Demonstrative evidence

Correct answer: Direct evidence

Direct evidence proves a fact without requiring inference, such as an eyewitness account of the act.

Question 34: A written statement taken from a witness should ideally be:

Written by the investigator in their own words without review
Summarized verbally only
In the witness's own words, reviewed, and signed by the witness (Correct answer)
Unsigned to protect the witness

Correct answer: In the witness's own words, reviewed, and signed by the witness

Statements in the witness's own words that they review and sign carry the most credibility.

Question 35: Positioning windows, lighting, and landscaping so that legitimate users can easily observe an area applies which CPTED principle?

Natural surveillance (Correct answer)
Target hardening
Territorial reinforcement
Natural access control

Correct answer: Natural surveillance

Natural surveillance raises the chance that intruders will be seen, which deters crime.

Question 36: What is the recommended sequence for applying the risk management process when planning physical security upgrades?

Identify assets → Analyze threats → Assess vulnerabilities → Select countermeasures (Correct answer)
Implement → Assess → Identify → Evaluate
Budget → Design → Install → Monitor
Train staff → Audit → Report → Fund

Correct answer: Identify assets → Analyze threats → Assess vulnerabilities → Select countermeasures

The standard risk management cycle begins with asset identification, then threat and vulnerability analysis before selecting proportionate countermeasures.

Question 37: Security metrics reported to management are most useful when they:

Link security performance to organizational objectives (Correct answer)
Are presented only annually
Focus solely on number of guard hours
Count activities without context

Correct answer: Link security performance to organizational objectives

Meaningful metrics show how security supports business goals, not just activity counts.

Question 38: A 'standoff distance' in physical security is best described as:

The buffer zone between a facility perimeter and a protected structure (Correct answer)
The minimum distance between security officers on patrol
The range at which surveillance cameras become ineffective
The gap between fencing panels

Correct answer: The buffer zone between a facility perimeter and a protected structure

Standoff distance is the measured space between a potential vehicle-borne threat and a building to reduce blast impact.

Question 39: How many continuing professional education (CPE) credits must a CPP earn per recertification cycle?

90
45
30
60 (Correct answer)

Correct answer: 60

CPPs must earn 60 CPE credits during each three-year recertification cycle.

Question 40: Which U.S. law restricts how employers may use consumer reports, including background check results, in employment decisions?

Privacy Act of 1974
Gramm-Leach-Bliley Act (GLBA)
Fair Credit Reporting Act (FCRA) (Correct answer)
Sarbanes-Oxley Act (SOX)

Correct answer: Fair Credit Reporting Act (FCRA)

The FCRA requires employers to obtain written consent, provide pre-adverse action notices, and follow dispute procedures when using background reports for employment decisions.

Question 41: What is the primary purpose of maintaining a chain of custody for physical evidence?

To identify the suspect's accomplices
To reduce storage costs for evidence
To speed up the discovery process
To prove the evidence has not been altered, substituted, or tampered with (Correct answer)

Correct answer: To prove the evidence has not been altered, substituted, or tampered with

A documented chain of custody establishes evidence integrity so it remains admissible and credible.

Question 42: What is the primary purpose of a Post-Incident Analysis (PIA) following a crisis event?

To identify lessons learned and improve future planning and response (Correct answer)
To satisfy mandatory regulatory reporting requirements only
To document financial losses for insurance claim purposes
To assign individual blame and accountability for the crisis

Correct answer: To identify lessons learned and improve future planning and response

A PIA primarily aims to extract lessons learned from the actual crisis response, enabling organizations to improve their plans, training, and capabilities.

Question 43: Which of the following online resources can be useful for CPP exam preparation?

Online flashcards and quizzes
Social media groups
Online video tutorials and webinars (Correct answer)
Free trial security software

Correct answer: Online video tutorials and webinars

Online video tutorials and webinars offer dynamic and engaging ways to learn complex security concepts, often providing visual explanations and expert insights. These resources can reinforce understanding beyond traditional text-based study, making them particularly effective for visual or auditory learners. They complement other study methods by offering diverse perspectives and interactive learning opportunities.

Question 44: A CPP is selected for a recertification audit but cannot produce proof for several claimed activities. What is the likely outcome?

The CPP's cycle is extended by five years
The audit is automatically passed
Credits without documentation may be disallowed, which could affect recertification (Correct answer)
ASIS assumes the credits are valid

Correct answer: Credits without documentation may be disallowed, which could affect recertification

Claims without documentation can be rejected in an audit, which could leave the CPP short of the required credits.

Question 45: Which three elements make up Cressey's fraud triangle?

Threat, vulnerability, and impact
Pressure, opportunity, and rationalization (Correct answer)
Greed, access, and collusion
Motive, weapon, and target

Correct answer: Pressure, opportunity, and rationalization

Cressey found that occupational fraud generally needs financial pressure, an opportunity, and a rationalization.

Question 46: When security staff use surveillance video for purposes unrelated to security, such as tracking a coworker's personal life, the primary issue is:

Improper camera maintenance
Failing to record audio
Exceeding storage retention limits
Misuse of information and invasion of privacy (Correct answer)

Correct answer: Misuse of information and invasion of privacy

Using security data for personal purposes breaches privacy and the duty to use information only for legitimate purposes.

Question 47: The ASIS/SHRM Workplace Violence Prevention and Intervention standard recommends which key element for assessing concerning behavior?

Annual polygraph testing of all staff
A multidisciplinary threat assessment team (Correct answer)
Immediate termination of any reported employee
Relying solely on local law enforcement

Correct answer: A multidisciplinary threat assessment team

A multidisciplinary team (security, HR, legal, mental health) provides balanced evaluation and management of potential threats.

Question 48: Which is a recognized best practice in executive protection to reduce predictability?

Varying routes and departure times (Correct answer)
Publishing the executive's travel schedule internally
Using a single, highly visible vehicle
Always using the same secure route

Correct answer: Varying routes and departure times

Varying routes and times makes it harder for adversaries to plan surveillance and attacks.

Question 49: Which type of writing is most appropriate for a security policy statement?

Broad, directive statements of intent approved by management (Correct answer)
Informal guidance with optional language
Step-by-step technical instructions
Narrative and descriptive

Correct answer: Broad, directive statements of intent approved by management

Policies state management's intent and direction, while procedures provide step-by-step detail.

Question 50: How should challenges in communication and documentation be addressed?

Delegate all challenges to supervisors
Apply systematic problem-solving, seek expert guidance when needed, and document decisions (Correct answer)
Avoid challenges and stick to familiar tasks
Ignore challenges until they resolve themselves

Correct answer: Apply systematic problem-solving, seek expert guidance when needed, and document decisions

Systematic problem-solving combined with appropriate consultation and documentation ensures challenges are addressed effectively.

Question 51: Which documentation practice is best for a CPP during the recertification cycle?

Keep certificates and records of completed activities in case of audit (Correct answer)
Ask colleagues to vouch for attendance later
Keep no records and estimate at renewal
Submit only the activity titles without proof

Correct answer: Keep certificates and records of completed activities in case of audit

Recertification applications may be audited, so certificants should retain proof of CPE activities.

Question 52: What quality assurance measure supports communication and documentation?

Quality checks are unnecessary for experienced professionals
Annual review is sufficient
Regular self-assessment, peer review, and adherence to established standards (Correct answer)
Quality only matters for new practitioners

Correct answer: Regular self-assessment, peer review, and adherence to established standards

Ongoing quality assurance through self-assessment, peer review, and standards adherence ensures continuous improvement.

Question 53: Which element should appear first in a well-structured investigative report?

An executive summary of findings (Correct answer)
Copies of all evidence logs
A detailed chronology of interviews
The investigator's personal opinions

Correct answer: An executive summary of findings

An executive summary up front lets decision-makers quickly grasp the key findings and conclusions.

Question 54: Which type of risk assessment relies primarily on descriptive ratings such as high, medium, and low rather than dollar values?

Qualitative (Correct answer)
Stochastic
Actuarial
Quantitative

Correct answer: Qualitative

Qualitative assessments use relative descriptive scales instead of precise numerical or monetary values.

Question 55: A CPP writes a book chapter on investigative interviewing that is published during the cycle. Is it eligible for CPE?

No, only seminars count
Only if ASIS published it
Only if the CPP was not paid for it
Yes, publishing security-related work can qualify as a professional contribution (Correct answer)

Correct answer: Yes, publishing security-related work can qualify as a professional contribution

Authoring published, security-related material is recognized as a contribution to the profession.

Question 56: A former employer's client approaches a consultant about work related to a confidential project she handled. What is the primary ethical concern?

Pricing the engagement fairly
Using confidential information gained from the prior engagement (Correct answer)
Scheduling conflicts
Insurance coverage requirements

Correct answer: Using confidential information gained from the prior engagement

Professionals must not exploit confidential information from previous employers or clients.

Question 57: According to routine activity theory, which three elements must converge for a crime to occur?

Motive, means, and opportunity
Threat, vulnerability, and asset
A motivated offender, a suitable target, and the absence of a capable guardian (Correct answer)
Pressure, opportunity, and rationalization

Correct answer: A motivated offender, a suitable target, and the absence of a capable guardian

Routine activity theory says crime occurs when these three elements meet in time and space.

Question 58: Compared with other ASIS certifications such as PSP or PCI, how does the CPP CPE requirement differ?

They are all identical at 100 credits
CPP requires fewer credits
CPP requires more credits per cycle (Correct answer)
CPP has no CPE requirement

Correct answer: CPP requires more credits per cycle

CPP requires 60 credits per cycle, more than the PSP and PCI requirements.

Question 59: How should professionals apply applied methods and techniques in daily practice?

Consistently integrate best practices into every aspect of professional work (Correct answer)
Follow standards only for complex tasks
Apply principles selectively based on convenience
Only when being evaluated

Correct answer: Consistently integrate best practices into every aspect of professional work

Consistent application of professional standards ensures quality outcomes and builds professional credibility.

Question 60: What is the importance of understanding 'legal and ethical standards' for security professionals?

It provides guidance on how to punish offenders
It helps them monitor employee productivity
It allows them to make decisions without restrictions
It ensures compliance with laws and prevents legal issues (Correct answer)

Correct answer: It ensures compliance with laws and prevents legal issues

Understanding 'legal and ethical standards' is crucial for security professionals because it ensures compliance with laws and prevents legal issues. Adhering to these standards guides decision-making, protects individual rights, and maintains the integrity and credibility of security operations. It helps professionals avoid liabilities and operate within acceptable societal and professional boundaries.

Question 61: Which practice best preserves the integrity of an officer's original field notes?

Rewriting them neatly after shift and discarding the originals
Sharing them with witnesses for correction
Typing them into email and deleting the notebook
Keeping the originals unaltered and retaining them per policy (Correct answer)

Correct answer: Keeping the originals unaltered and retaining them per policy

Original notes may be subpoenaed and must be retained unaltered as the basis of the report.

Question 62: Which best describes a physical security survey?

An employee opinion poll about workplace safety
A review of criminal records of current staff
An on-site examination of a facility to identify vulnerabilities and recommend improvements (Correct answer)
A financial audit of the security department budget

Correct answer: An on-site examination of a facility to identify vulnerabilities and recommend improvements

A security survey is a critical on-site analysis that evaluates current protections and recommends corrective measures.

Question 63: Using pavement treatments, signage, and low fencing to show where private property begins is an example of which CPTED strategy?

Territorial reinforcement (Correct answer)
Natural surveillance
Activity support
Maintenance and management

Correct answer: Territorial reinforcement

Territorial reinforcement creates a sense of ownership and clearly separates public space from private space.

Question 64: A security manager wants to reduce a hazard. Under the hierarchy of controls, which option is generally the MOST effective?

Issuing personal protective equipment
Installing engineering controls such as guards
Posting warning signs and training staff
Eliminating the hazard entirely (Correct answer)

Correct answer: Eliminating the hazard entirely

Elimination physically removes the hazard and sits at the top of the hierarchy, above substitution, engineering, administrative controls, and PPE.

Question 65: How should challenges in safety and compliance be addressed?

Apply systematic problem-solving, seek expert guidance when needed, and document decisions (Correct answer)
Avoid challenges and stick to familiar tasks
Delegate all challenges to supervisors
Ignore challenges until they resolve themselves

Correct answer: Apply systematic problem-solving, seek expert guidance when needed, and document decisions

Systematic problem-solving combined with appropriate consultation and documentation ensures challenges are addressed effectively.

Question 66: An event has a single loss expectancy (SLE) of $50,000 and an annualized rate of occurrence (ARO) of 0.2. What is the annualized loss expectancy (ALE)?

$250,000
$5,000
$10,000 (Correct answer)
$50,200

Correct answer: $10,000

ALE equals SLE multiplied by ARO, so $50,000 x 0.2 = $10,000.

Question 67: When closing an investigation and preparing the final report, which element is MOST important to include for legal and operational purposes?

Factual findings, evidence collected, conclusions, and recommended corrective actions (Correct answer)
Financial cost analysis of the investigation
Investigator's personal opinions about the subject's character
A list of all persons interviewed with personal contact information

Correct answer: Factual findings, evidence collected, conclusions, and recommended corrective actions

A final investigation report must document factual findings and evidence objectively, draw conclusions, and recommend actions to prevent recurrence.

Question 68: Under the Fourth Amendment, private security officers acting independently of police are generally:

Treated as sworn officers
Fully bound by Miranda requirements
Not subject to constitutional search restrictions (Correct answer)
Required to obtain warrants

Correct answer: Not subject to constitutional search restrictions

Constitutional limits generally apply only to government actors, so purely private security is usually not bound by them, though civil and criminal laws still apply.

Question 69: An after-action report following an emergency exercise should mainly identify:

Media coverage received
Who to discipline
Only the costs incurred
Strengths, weaknesses, and corrective actions (Correct answer)

Correct answer: Strengths, weaknesses, and corrective actions

After-action reports capture lessons learned and drive improvement plans.

Question 70: What is the minimum experience required to sit for the Certified Protection Professional (CPP) exam?

10 years of security experience
3 years of security experience
7 years of security experience
5 years of security experience (Correct answer)

Correct answer: 5 years of security experience

To be eligible for the Certified Protection Professional (CPP) exam, candidates must meet specific experience requirements. One of the primary pathways requires a minimum of five years of security management experience, with specific criteria for being in "responsible charge" of a security function. This ensures candidates possess practical, professional expertise at a management level in the field.

Question 71: How many continuing professional education (CPE) credits must a CPP earn per recertification cycle?

90
30
45
60 (Correct answer)

Correct answer: 60

CPP holders must earn 60 CPE credits during each three-year certification cycle.

Question 72: Which element is most essential to ensure an effective Crisis Management Team (CMT)?

External crisis management consultants with no internal team members
Cross-functional representation including security, legal, HR, and communications (Correct answer)
A dedicated media relations specialist as the sole spokesperson
Only senior operations management with decision-making authority

Correct answer: Cross-functional representation including security, legal, HR, and communications

Effective CMTs require cross-functional representation to simultaneously address operational, legal, human resource, and communications dimensions of a crisis.

Question 73: Which of the following is best described as a leading security metric?

Total dollar value of losses last year
Percentage of employees who completed security awareness training (Correct answer)
Number of workplace injuries recorded
Number of thefts reported last quarter

Correct answer: Percentage of employees who completed security awareness training

Leading indicators measure activities that predict future performance, unlike lagging indicators that count past incidents.

Question 74: How should a security professional approach 'physical security'?

By relying solely on electronic surveillance
By implementing security systems only during emergencies
By focusing on employee background checks only
By continuously assessing vulnerabilities and implementing preventative measures (Correct answer)

Correct answer: By continuously assessing vulnerabilities and implementing preventative measures

A security professional should approach 'physical security' by continuously assessing vulnerabilities and implementing preventative measures. This involves a dynamic process of evaluating physical assets, identifying weaknesses in defenses, and deploying layered security solutions like access controls, surveillance, and barriers. Proactive and ongoing assessment ensures that physical security remains robust against evolving threats.

Question 75: Which of the following is required for eligibility to take the CPP exam?

Completion of a security management internship
Completion of a bachelor's degree
Completion of 5 years of security management experience (Correct answer)
Completion of a security management diploma program

Correct answer: Completion of 5 years of security management experience

Eligibility for the CPP exam is based on a combination of education and professional experience. A key requirement for most candidates is demonstrating at least five years of security management experience, with a portion of that time spent in responsible charge of a security function. This ensures candidates have practical, leadership-level experience in the field, which is crucial for the advanced nature of the certification.

Question 76: When designing a video surveillance system, what should primarily determine the required camera resolution and pixel density?

The operational purpose, such as detection, recognition, or identification (Correct answer)
The color of the monitored area
The length of cable runs
The camera brand

Correct answer: The operational purpose, such as detection, recognition, or identification

Defining whether a view must detect, recognize, or identify drives the pixels-on-target requirement.

Question 77: Which of the following best describes the purpose of a recertification audit?

To punish all applicants
To verify the accuracy and integrity of claimed CPE activities (Correct answer)
To reset the exam score
To increase the credit requirement

Correct answer: To verify the accuracy and integrity of claimed CPE activities

Audits protect credential integrity by confirming claimed activities.

Question 78: An exterior intrusion sensor is triggered by a deer crossing the detection zone. How is this alarm classified?

Tamper alarm
False alarm
Valid alarm
Nuisance alarm (Correct answer)

Correct answer: Nuisance alarm

Nuisance alarms are caused by environmental or non-threat stimuli such as animals or weather, while false alarms stem from equipment faults.

Question 79: Which statement best describes how CPE credits relate to the CPP exam domains?

Only legal topics count
Any topic counts regardless of relevance
Activities should relate to security management and the body of knowledge (Correct answer)
Only physical security topics count

Correct answer: Activities should relate to security management and the body of knowledge

Qualifying activities must be relevant to the security profession and its body of knowledge.

Question 80: How should continuing education requirements knowledge be maintained and updated?

Through continuous professional development, current literature review, and professional networking (Correct answer)
Knowledge updates are only needed every five years
Initial training provides lifelong competence
Learning stops after certification

Correct answer: Through continuous professional development, current literature review, and professional networking

Professional competence requires ongoing development through education, literature review, and engagement with the professional community.

Question 81: An access control system is tuned so tightly that authorized employees are often rejected. Which error rate is too high?

Nuisance alarm rate
Crossover error rate
False acceptance rate (Type II error)
False rejection rate (Type I error) (Correct answer)

Correct answer: False rejection rate (Type I error)

A false rejection (Type I error) occurs when a legitimate user is denied access.

Question 82: What is the primary purpose of an Emergency Action Plan (EAP)?

To establish security protocols for daily operations
To outline budget allocations for security equipment
To provide procedures for employees during emergencies requiring evacuation or shelter-in-place (Correct answer)
To document post-incident investigations

Correct answer: To provide procedures for employees during emergencies requiring evacuation or shelter-in-place

An EAP provides documented procedures to guide employees during emergencies, including evacuation routes and shelter-in-place protocols.

Question 83: What does 'risk management' involve in the context of security operations?

Identifying, assessing, and mitigating risks (Correct answer)
Monitoring security camera footage
Investigating security breaches
Analyzing crime statistics

Correct answer: Identifying, assessing, and mitigating risks

In the context of security operations, 'risk management' involves identifying, assessing, and mitigating potential threats and vulnerabilities. This systematic process helps organizations understand their security landscape, prioritize risks based on likelihood and impact, and implement effective countermeasures. The goal is to reduce the probability and severity of security incidents.

Question 84: Why is continuing education especially important in the security field?

It replaces the need for ethics
It only matters for entry-level guards
Security practices never change
Security threats, technologies, and regulations constantly change (Correct answer)

Correct answer: Security threats, technologies, and regulations constantly change

Rapidly evolving threats and technologies require ongoing learning to remain effective.

Question 85: What is the primary goal of a Certified Protection Professional (CPP)?

To conduct background checks
To enforce laws and regulations
To manage and oversee security operations (Correct answer)
To design security systems

Correct answer: To manage and oversee security operations

The primary goal of a Certified Protection Professional (CPP) is to manage and oversee security operations comprehensively. This involves developing security policies, implementing risk management strategies, and supervising security personnel and systems. CPPs are responsible for ensuring the overall safety and protection of assets, people, and information within an organization.

Question 86: Which is the best method to ensure security staff understand ethical expectations in gray-area situations?

Scenario-based training with discussion of real dilemmas (Correct answer)
Avoiding discussion to prevent confusion
Providing only a list of prohibited acts
Requiring staff to memorize the code verbatim

Correct answer: Scenario-based training with discussion of real dilemmas

Scenario-based training develops judgment for situations rules do not explicitly cover.

Question 87: A CPP falsely claims on a résumé to hold a PSP certification. If discovered, the likely consequence from the certification board is:

Disciplinary action, which may include revocation of the CPP (Correct answer)
No action because PSP is a separate credential
A requirement to retake only the PSP exam
A verbal warning only

Correct answer: Disciplinary action, which may include revocation of the CPP

Misrepresenting credentials violates the certification code of professional responsibility and can lead to sanctions including revocation.

Question 88: A penetration test of a facility's physical security is best described as what type of evaluation?

Compliance-based document review
Performance-based testing of the system's effectiveness (Correct answer)
Financial audit of security spending
Purely qualitative interview process

Correct answer: Performance-based testing of the system's effectiveness

Penetration testing measures how well the security system actually performs against a simulated adversary.

Question 89: Which crime prevention approach uses natural surveillance, access control, and territorial reinforcement?

Defensible zoning
CPTED (Correct answer)
Situational policing
Broken windows enforcement

Correct answer: CPTED

Crime Prevention Through Environmental Design (CPTED) relies on natural surveillance, natural access control, and territorial reinforcement.

Question 90: What is the foundational principle of applied methods and techniques in the Certified Protection Professional field?

Maintaining competence, integrity, and service to stakeholders (Correct answer)
Following the easiest path available
Maximizing personal advancement
Avoiding all challenging situations

Correct answer: Maintaining competence, integrity, and service to stakeholders

The foundational principles of applied methods and techniques in Certified Protection Professional center on maintaining competence, integrity, and quality service.

Question 91: How does continuing education benefit an organization that employs a CPP?

It guarantees no security incidents
It helps keep the organization's security leadership current on threats, standards, and best practices (Correct answer)
It removes the need for security policies
It replaces regulatory compliance audits

Correct answer: It helps keep the organization's security leadership current on threats, standards, and best practices

Ongoing learning helps CPPs apply current best practices to protect organizational assets.

Question 92: What is the main purpose of tabletop exercises in crisis management?

To replace the need for written plans
To test physical barriers against vehicle attacks
To certify officers for firearms
To walk key personnel through a simulated scenario and test plans, roles, and decision-making in a low-stress setting (Correct answer)

Correct answer: To walk key personnel through a simulated scenario and test plans, roles, and decision-making in a low-stress setting

Tabletop exercises are discussion-based simulations that validate plans and clarify roles without deploying resources.

Question 93: The Incident Command System (ICS) was developed primarily to address which operational problem?

Poor multi-agency coordination and communication during incidents (Correct answer)
Inadequate federal funding for local emergency response
Lack of physical security technology at incident scenes
Insufficient training for individual security personnel

Correct answer: Poor multi-agency coordination and communication during incidents

ICS was designed to solve chronic problems of poor coordination, conflicting communication, and unclear command authority when multiple agencies respond to the same incident.

Question 94: A security awareness program is most effective when communications are:

Delivered once at hiring
Limited to written policy manuals
Ongoing, varied in format, and tailored to the audience (Correct answer)
Sent only after an incident

Correct answer: Ongoing, varied in format, and tailored to the audience

Repeated, audience-tailored messaging sustains awareness and changes behavior.

Question 95: In a workplace investigation, why are open-ended questions preferred at the start of an interview?

They encourage a narrative account and reduce leading the witness (Correct answer)
They make the witness more defensive
They shorten the interview
They are required by OSHA

Correct answer: They encourage a narrative account and reduce leading the witness

Open-ended questions draw out a free narrative and avoid planting information the witness did not provide.

Question 96: Granting employees only the access they need to do their jobs reflects which principle?

Unity of command
Least privilege (Correct answer)
Defense in depth
Separation of duties

Correct answer: Least privilege

Least privilege reduces exposure by limiting access rights to the minimum needed for assigned tasks.

Question 97: Credits from activities completed BEFORE the current cycle began can usually be claimed for that cycle.

True, any past activity counts
True, if the activity was longer than eight hours
False, credits must be earned within the current cycle dates (Correct answer)
True, if the CPP was not yet certified

Correct answer: False, credits must be earned within the current cycle dates

CPE credits must be earned within the recertification cycle they are claimed for.

Question 98: Concentric circles of protection place the most valuable assets:

In the innermost layer (Correct answer)
At the reception desk
At the outer perimeter
In the parking area

Correct answer: In the innermost layer

Concentric protection puts the most critical assets at the center, behind several layers.

Question 99: Positioning office windows so employees can easily see the parking lot best illustrates which CPTED principle?

Natural access control
Natural surveillance (Correct answer)
Territorial reinforcement
Target hardening

Correct answer: Natural surveillance

Natural surveillance places legitimate users where they can observe activity, increasing the perceived risk to offenders.

Question 100: How many domains does the current CPP exam outline contain?

9
5
6
7 (Correct answer)

Correct answer: 7

The CPP covers seven domains: Security Principles, Business Principles, Investigations, Personnel Security, Physical Security, Information Security, and Crisis Management.

Question 101: Why is 'crisis management' a critical domain for Certified Protection Professionals?

To prepare for and respond to emergencies effectively (Correct answer)
To supervise security personnel
To manage security technology systems
To reduce workplace accidents

Correct answer: To prepare for and respond to emergencies effectively

'Crisis management' is a critical domain for Certified Protection Professionals because it involves preparing for and responding to emergencies effectively. CPPs develop plans and procedures to mitigate the impact of unforeseen events, ensuring business continuity and the safety of personnel and assets. Their expertise helps organizations navigate crises with minimal disruption and maximum resilience.

Question 102: What is the primary method by which a Certified Protection Professional (CPP) maintains their certification after the initial certification period?

By paying an annual membership fee to ASIS International.
By receiving positive performance evaluations from their employer.
By retaking the full CPP certification exam every year.
By accumulating and reporting Continuing Professional Education (CPE) credits. (Correct answer)

Correct answer: By accumulating and reporting Continuing Professional Education (CPE) credits.

To maintain their Certified Protection Professional (CPP) certification after the initial period, individuals must actively engage in ongoing professional development. This is primarily achieved by accumulating and reporting a specified number of Continuing Professional Education (CPE) credits over a three-year cycle. These credits demonstrate that the professional remains current with evolving industry knowledge and best practices.

Question 103: Which federal regulation requires employers with 10 or more employees to have written Emergency Action Plans?

ISO 31000
NFPA 101
HIPAA
OSHA 29 CFR 1910.38 (Correct answer)

Correct answer: OSHA 29 CFR 1910.38

OSHA 29 CFR 1910.38 requires employers with 10 or more employees to maintain written Emergency Action Plans covering fire and other workplace emergencies.

Question 104: Which ASIS document type is developed through a consensus process and approved as an American National Standard?

ASIS chapter newsletters
Security Management magazine editorials
ASIS/ANSI standards such as the Risk Assessment standard (Correct answer)
Vendor product white papers

Correct answer: ASIS/ANSI standards such as the Risk Assessment standard

ASIS standards go through an ANSI-accredited consensus process, so they are authoritative study references.

Question 105: Before releasing an investigative report outside the security department, the manager should first:

Review it for accuracy and consult legal counsel regarding privilege and disclosure (Correct answer)
Post it publicly
Delete supporting notes
Send it directly to the subject

Correct answer: Review it for accuracy and consult legal counsel regarding privilege and disclosure

Legal review protects privilege and prevents improper disclosure.

Question 106: Which of the following is a recommended study resource for the CPP exam?

Self-help books on leadership
Certified Protection Professional (CPP) Exam Study Guide (Correct answer)
Security job training manuals
Online forums and social media groups

Correct answer: Certified Protection Professional (CPP) Exam Study Guide

The Certified Protection Professional (CPP) Exam Study Guide is specifically developed by ASIS International, the certifying body, to align directly with the exam's content outline. It provides structured, authoritative information covering the domains and knowledge areas tested on the exam. This makes it an essential and highly recommended resource for comprehensive and targeted preparation.

Question 107: Which risk treatment option is being used when a company purchases insurance to cover potential theft losses?

Risk acceptance
Risk avoidance
Risk transfer (Correct answer)
Risk spreading

Correct answer: Risk transfer

Insurance shifts the financial burden of a loss to a third party, which is risk transfer.

Question 108: A CPP attends a full-day security seminar with six hours of instruction. Under the usual CPE convention, how many credits does this typically represent?

3 credits
6 credits (Correct answer)
12 credits
1 credit

Correct answer: 6 credits

CPE credits are generally earned at one credit per hour of qualifying instruction.

Question 109: How should professionals apply industry best practices in daily practice?

Only when being evaluated
Consistently integrate best practices into every aspect of professional work (Correct answer)
Apply principles selectively based on convenience
Follow standards only for complex tasks

Correct answer: Consistently integrate best practices into every aspect of professional work

Consistent application of professional standards ensures quality outcomes and builds professional credibility.

Question 110: What is the purpose of the CPP certification?

To ensure candidates are proficient in basic security duties.
To qualify candidates for security guard positions
To validate advanced professional competence in security management (Correct answer)
To provide a foundation in criminal justice

Correct answer: To validate advanced professional competence in security management

The CPP certification is a globally recognized credential that signifies a high level of expertise and leadership in security management. Its purpose is to validate that certified individuals possess advanced professional competence across a broad range of security principles and practices. It distinguishes experienced security professionals who have demonstrated comprehensive knowledge and skills, elevating their professional standing.

Question 111: Which of the following is LEAST likely to qualify as a CPE activity for a CPP?

Completing a security-related webinar
Attending the ASIS Global Security Exchange (GSX) sessions
Taking a vacation unrelated to security (Correct answer)
Serving on an ASIS council or committee

Correct answer: Taking a vacation unrelated to security

CPE activities must relate to security management and professional development.

Question 112: A security consultant is offered a commission by an equipment manufacturer for recommending its cameras to a client. What is the ethical course?

Accept it but split it with the client
Accept it since the cameras are good quality
Decline it or fully disclose it to the client, keeping recommendations objective (Correct answer)
Accept it only if the amount is under $500

Correct answer: Decline it or fully disclose it to the client, keeping recommendations objective

Undisclosed vendor commissions compromise objectivity, so a consultant must decline or disclose them to the client.

Question 113: A CPP earns 70 credits in one cycle. What is the generally safe assumption about the extra 10 credits?

They extend the certification by one year
They should not be counted on for the next cycle; each cycle requires its own 60 credits (Correct answer)
They automatically roll into the next cycle
They convert into a cash refund

Correct answer: They should not be counted on for the next cycle; each cycle requires its own 60 credits

Each cycle stands on its own, so certificants should plan to earn the full requirement within each period.

Question 114: In a security survey, why should the surveyor review past incident reports?

To calculate staff payroll
To identify loss patterns and trends that indicate vulnerabilities (Correct answer)
To determine building tax assessment
To discipline employees who reported incidents

Correct answer: To identify loss patterns and trends that indicate vulnerabilities

Historical incident data reveals patterns that help focus the assessment on real problem areas.

Question 115: Which domain is part of the current CPP exam content outline?

Cyber Penetration Testing
Aviation Security Law
Fire Suppression Engineering
Security Principles and Practices (Correct answer)

Correct answer: Security Principles and Practices

Security Principles and Practices is one of the seven CPP domains and carries the largest weight.

Question 116: When must CPE credits be earned to count toward the current CPP recertification?

Any time before initially passing the exam
Within the current three-year certification cycle (Correct answer)
Only in the final month of the cycle
Within ten years of the renewal date

Correct answer: Within the current three-year certification cycle

Credits must be earned during the active certification period being renewed.

Question 117: A CPP finishes a three-credit-hour college course in criminal justice. How would this most likely be treated for recertification?

It counts only if taken before the CPP was earned
It earns exactly one CPE credit no matter its length
It can earn multiple CPE credits as qualifying formal education (Correct answer)
It is not eligible because it is academic

Correct answer: It can earn multiple CPE credits as qualifying formal education

Relevant college coursework completed during the cycle can earn CPE credit in proportion to its length.

Question 118: Why should a CPP keep certificates of attendance and agendas for CPE activities?

They are required for initial exam registration
They replace the need to submit a recertification application
They support the recertification application if it is selected for audit (Correct answer)
They let the CPP skip the next cycle's credits

Correct answer: They support the recertification application if it is selected for audit

ASIS may audit recertification applications, and certificants must be able to document the credits they claimed.

Question 119: When is a security countermeasure generally considered cost-effective?

When it eliminates all risk to the asset
When it matches what competitors use
When it is the least expensive option available
When its total cost is less than the reduction in expected loss it provides (Correct answer)

Correct answer: When its total cost is less than the reduction in expected loss it provides

A cost-effective countermeasure produces a loss reduction greater than its lifecycle cost.

Question 120: Which CPP content domain carries the largest weight on the current exam?

Information Security
Security Principles and Practices (Correct answer)
Crisis Management
Physical Security

Correct answer: Security Principles and Practices

Security Principles and Practices is the most heavily weighted domain, at about 22% of the exam.

Question 121: In an investigative interview, what is the primary difference between an interview and an interrogation?

Interviews are always recorded; interrogations are not
Interviews are non-accusatory information gathering; interrogations are accusatory and aim to obtain an admission (Correct answer)
Interrogations may only be done by police
Interviews require legal counsel to be present

Correct answer: Interviews are non-accusatory information gathering; interrogations are accusatory and aim to obtain an admission

An interview gathers information in a non-accusatory way, while an interrogation is accusatory and seeks an admission from a suspect.

Question 122: Which crisis communication principle is most critical for maintaining organizational credibility during a major incident?

Being transparent and timely with accurate information (Correct answer)
Restricting all media access to the affected facility
Limiting all communications to internal stakeholders only
Providing exhaustive technical details to the public immediately

Correct answer: Being transparent and timely with accurate information

Transparency and timely release of accurate information prevents speculation, builds trust with stakeholders, and protects the organization's credibility during a crisis.

Question 123: When evaluating a proposed countermeasure, which analysis compares its total cost with the reduction in expected loss?

Cost-benefit analysis (Correct answer)
Gap analysis
Root cause analysis
SWOT analysis

Correct answer: Cost-benefit analysis

Cost-benefit analysis checks whether the loss reduction justifies the countermeasure's lifecycle cost.

Question 124: During a crisis, who should normally serve as the single authorized voice to the media?

The security vendor's account manager
A designated spokesperson per the crisis communication plan (Correct answer)
The first officer on scene
Any employee who witnessed the event

Correct answer: A designated spokesperson per the crisis communication plan

A designated spokesperson ensures consistent, accurate, and approved messaging.

Question 125: How many multiple-choice questions are on the CPP exam?

175
225 (Correct answer)
150
200

Correct answer: 225

The CPP exam has 225 multiple-choice questions, including 25 unscored pretest items.

Question 126: What is the primary security concern with 'island parking lots' (parking lots not connected to perimeter fencing)?

They increase operational costs
They complicate visitor management
They require more lighting equipment
They eliminate natural standoff distance and allow vehicles close access to buildings (Correct answer)

Correct answer: They eliminate natural standoff distance and allow vehicles close access to buildings

Uncontrolled parking adjacent to a building negates standoff distance, leaving the structure vulnerable to vehicle-borne explosive devices.

Question 127: How should professionals apply safety and compliance in daily practice?

Follow standards only for complex tasks
Only when being evaluated
Consistently integrate best practices into every aspect of professional work (Correct answer)
Apply principles selectively based on convenience

Correct answer: Consistently integrate best practices into every aspect of professional work

Consistent application of professional standards ensures quality outcomes and builds professional credibility.

Question 128: Under the Weingarten rights established by the NLRB, which employees are entitled to have a representative present during an investigatory interview?

All private-sector employees, regardless of union status
Only executives
Unionized employees who reasonably believe the interview may lead to discipline and request a representative (Correct answer)
Only government employees

Correct answer: Unionized employees who reasonably believe the interview may lead to discipline and request a representative

Weingarten rights apply to union-represented employees who request representation when they reasonably fear discipline.

Question 129: What ethical standard governs core concepts and principles practice?

Ethical standards are optional for certified professionals
Ethics are personal opinions, not professional requirements
Ethics only apply in academic settings
Adherence to the profession's code of ethics and applicable laws and regulations (Correct answer)

Correct answer: Adherence to the profession's code of ethics and applicable laws and regulations

Professional ethics codes and applicable laws provide the framework for ethical practice in every professional field.

Question 130: What is the primary function of an Emergency Operations Center (EOC) during a major incident?

To coordinate strategic-level support and resources for incident command (Correct answer)
To serve as a forward staging area for first responders
To triage and process injured personnel
To store emergency supplies and equipment for field deployment

Correct answer: To coordinate strategic-level support and resources for incident command

An EOC provides a centralized location where decision-makers coordinate strategic support, allocate resources, and manage information flow during major incidents.

Question 131: In security system procurement, what is the main purpose of a Request for Proposal (RFP)?

To solicit detailed vendor solutions and pricing against defined requirements (Correct answer)
To publish a press release
To terminate an existing contract
To pay vendors in advance

Correct answer: To solicit detailed vendor solutions and pricing against defined requirements

An RFP describes requirements and invites vendors to propose solutions and prices for comparative evaluation.

Question 132: Which document formally describes the security requirements and constraints that a new facility must meet during its design and construction phase?

Security operations manual
Post orders
Incident response plan
Basis of Design (BOD) / Security Design Criteria (Correct answer)

Correct answer: Basis of Design (BOD) / Security Design Criteria

The Basis of Design or Security Design Criteria document captures all security performance requirements that architects and engineers must incorporate.

Question 133: Which approach does ASIS promote for aligning security with organizational risk and asset owners' decisions?

Six Sigma Black Belt methodology
Enterprise Security Risk Management (ESRM) (Correct answer)
Zero-based budgeting
Total Quality Management

Correct answer: Enterprise Security Risk Management (ESRM)

ESRM, promoted by ASIS, frames security as a partnership in managing risk with asset owners.

Question 134: When investigating workplace violence threats, which behavioral indicator is generally considered the highest risk factor?

Social withdrawal
Explicit threats combined with a grievance and access to weapons (Correct answer)
Reduced productivity
Chronic tardiness

Correct answer: Explicit threats combined with a grievance and access to weapons

Research consistently shows that the combination of a stated intent to harm, a specific grievance, and means of carrying it out is the most reliable predictor of violence.

Question 135: Which of the following is an OSHA-recordable injury rather than first aid only?

Applying a cold compress to a bruise
Using a non-prescription medication at nonprescription strength
Cleaning a wound and applying a bandage
Receiving sutures to close a laceration (Correct answer)

Correct answer: Receiving sutures to close a laceration

Sutures count as medical treatment beyond first aid, so the case is recordable.

Question 136: Which information security control is an example of a technical (logical) control?

Acceptable use policy
Firewall rules (Correct answer)
Guard patrols
Security awareness training

Correct answer: Firewall rules

Firewalls are technical controls enforced by hardware and software.

Question 137: Why is it important to involve stakeholders from multiple departments in a security risk assessment?

To transfer liability to other departments
To avoid needing executive approval
To reduce the length of the final report
They provide knowledge of assets, operations, and impacts that security staff may lack (Correct answer)

Correct answer: They provide knowledge of assets, operations, and impacts that security staff may lack

Cross-functional input ensures assets and consequences are accurately identified and the results gain buy-in.

Question 138: OSHA has no specific workplace violence standard. Under which provision can it still cite an employer for failing to address a recognized violence hazard?

The Hazard Communication Standard
29 CFR 1910.38
Section 11(c)
The General Duty Clause, Section 5(a)(1) (Correct answer)

Correct answer: The General Duty Clause, Section 5(a)(1)

Section 5(a)(1) requires employers to keep the workplace free of recognized hazards likely to cause death or serious harm, which includes workplace violence.

Question 139: Under the time-based concept of physical protection, an intrusion is defeated only when which condition is met?

Detection occurs after the adversary reaches the target
Barriers are rated for at least 60 minutes
Detection plus response time is less than the delay the adversary faces after detection (Correct answer)
Response time is shorter than detection time

Correct answer: Detection plus response time is less than the delay the adversary faces after detection

The response force must arrive before the adversary completes the task, so delay after detection must exceed response time.

Question 140: A CPP falsely reports CPE credits on a recertification application. What is the most likely result?

Possible disciplinary action, including revocation, under the ASIS Code of Ethics (Correct answer)
No consequence if the fee was paid
An automatic extension of the cycle
A warning letter with no further effect

Correct answer: Possible disciplinary action, including revocation, under the ASIS Code of Ethics

Falsifying credentials breaks ethical obligations and can lead to sanctions such as revocation.

Question 141: Which international standard specifically governs Business Continuity Management Systems?

ISO 9001
ISO 27001
ISO 22301 (Correct answer)
NIST SP 800-53

Correct answer: ISO 22301

ISO 22301 is the international standard that specifies requirements for planning, establishing, implementing, and improving a Business Continuity Management System.

Question 142: Which is a key limitation of quantitative risk assessment?

Reliable numerical data for probability and impact is often unavailable (Correct answer)
It ignores asset value
It never supports budget decisions
It cannot be expressed in dollars

Correct answer: Reliable numerical data for probability and impact is often unavailable

Quantitative methods depend on accurate data, which is often scarce for security events.

Question 143: Which security domain would a course on pre-employment background screening support for CPE purposes?

None, because it is HR
Fine arts protection only
Culinary safety
Personnel security (Correct answer)

Correct answer: Personnel security

Background screening is a core part of personnel security, which is a CPP domain.

Question 144: The Recovery Point Objective (RPO) in business continuity planning refers to:

The financial cost threshold that triggers full BCP activation
The maximum acceptable amount of data loss measured in time (Correct answer)
The minimum staffing level required for essential operations to function
The physical alternate location designated for recovery operations

Correct answer: The maximum acceptable amount of data loss measured in time

RPO defines the maximum acceptable data loss measured in time, determining how frequently data must be backed up to meet recovery requirements.

Question 145: What does the 'all-hazards approach' in emergency planning refer to?

Focusing exclusively on man-made threats
Preparing a separate plan for each type of potential hazard
Using a single comprehensive plan to address multiple types of emergencies (Correct answer)
Planning only for natural disasters

Correct answer: Using a single comprehensive plan to address multiple types of emergencies

The all-hazards approach develops one comprehensive emergency plan with common core elements applicable to many different types of emergencies.

Question 146: Which source is generally considered the LEAST reliable for assessing the local crime threat to a facility?

Commercial crime-risk forecasting data
Local police crime statistics
The facility's documented incident reports
Anecdotal rumors from a single unverified individual (Correct answer)

Correct answer: Anecdotal rumors from a single unverified individual

Unverified anecdotal information lacks the reliability of documented, systematic data sources.

Question 147: How many continuing professional education (CPE) credits must a CPP holder earn per three-year recertification cycle?

45
90
30
60 (Correct answer)

Correct answer: 60

CPPs must earn 60 CPE credits every three years to recertify.

Question 148: A security director wants to determine whether a new CCTV system reduced parking lot incidents. Which evaluation approach is most valid?

Compare incident rates before and after installation while controlling for other variables (Correct answer)
Ask guards whether they feel safer
Review the vendor's marketing materials
Count the number of cameras installed

Correct answer: Compare incident rates before and after installation while controlling for other variables

Before-and-after comparison controlling for confounding factors gives the most defensible measure of effectiveness.

Question 149: When studying physical security, which sequence of protective functions should a candidate master?

Plan, do, check, act
Deter, detect, delay, respond (Correct answer)
Identify, assess, mitigate, transfer
Prevent, protect, mitigate, recover

Correct answer: Deter, detect, delay, respond

The classic physical security model layers deterrence, detection, delay, and response.

Question 150: How is the CPP exam scored?

Raw percentage, with 70% needed to pass
Pass/fail based on the top 50% of candidates
Points per domain, with every domain passed separately
Scaled score, with 650 needed to pass (Correct answer)

Correct answer: Scaled score, with 650 needed to pass

ASIS reports CPP results on a scaled score from 200 to 800, and 650 is required to pass.

Question 151: How should challenges in professional standards and ethics be addressed?

Apply systematic problem-solving, seek expert guidance when needed, and document decisions (Correct answer)
Avoid challenges and stick to familiar tasks
Ignore challenges until they resolve themselves
Delegate all challenges to supervisors

Correct answer: Apply systematic problem-solving, seek expert guidance when needed, and document decisions

Systematic problem-solving combined with appropriate consultation and documentation ensures challenges are addressed effectively.

Question 152: In a layered physical protection system, what is the primary purpose of the 'delay' function?

To discourage adversaries from choosing the target
To record evidence for later prosecution
To reduce insurance premiums
To give the response force time to arrive before the adversary completes the attack (Correct answer)

Correct answer: To give the response force time to arrive before the adversary completes the attack

Delay measures buy time between detection and adversary success so responders can interrupt the attack.

Question 153: An investigator suspects inventory theft at a distribution center. Which step should normally come first?

Terminate all shift employees
Interrogate the most likely suspect
Define the scope and objectives and review existing records (Correct answer)
Install covert cameras without a plan

Correct answer: Define the scope and objectives and review existing records

Investigations start with planning, which means defining objectives and reviewing available documents before moving on to people.

Question 154: Which factor is MOST important when evaluating the vulnerability of an asset?

The asset's age
The weaknesses that could be exploited by a threat (Correct answer)
The number of employees nearby
The color of the building

Correct answer: The weaknesses that could be exploited by a threat

Vulnerability is defined by exploitable weaknesses in protection that a threat could use.

Question 155: Which workplace violence prevention element is MOST important for early intervention?

Armed guards at every entrance
Annual fire drills
A multidisciplinary threat assessment team (Correct answer)
Metal detectors only

Correct answer: A multidisciplinary threat assessment team

A threat assessment team that includes HR, legal, security, and mental health input can spot and manage concerning behavior early.

Question 156: Nonverbal cues observed during an interview should be:

Considered alongside verbal content and documented objectively (Correct answer)
Treated as proof of deception
Reported as the main finding
Ignored entirely

Correct answer: Considered alongside verbal content and documented objectively

Nonverbal behavior can guide questioning but is not conclusive evidence of deception.

Question 157: How should applied methods and techniques knowledge be maintained and updated?

Knowledge updates are only needed every five years
Through continuous professional development, current literature review, and professional networking (Correct answer)
Initial training provides lifelong competence
Learning stops after certification

Correct answer: Through continuous professional development, current literature review, and professional networking

Professional competence requires ongoing development through education, literature review, and engagement with the professional community.

Question 158: What does 'chain of custody' ensure in a corporate investigation?

Evidence handling is documented from collection to presentation (Correct answer)
Witnesses sign confidentiality agreements
Evidence is stored offsite
Only police may handle evidence

Correct answer: Evidence handling is documented from collection to presentation

Chain of custody documents every person who handled the evidence, which preserves its integrity and admissibility.

Question 159: A CPP teaches a security course at a local community college. How might this affect recertification?

It disqualifies the CPP from recertifying
Instruction may earn CPE credit (Correct answer)
It replaces the Code of Ethics requirement
It only counts if taught overseas

Correct answer: Instruction may earn CPE credit

Teaching or instructing on security topics is commonly an acceptable CPE activity.

Question 160: In crisis management, the recovery time objective (RTO) refers to:

The time to evacuate a building
The maximum acceptable data loss measured in time
The target time to restore a function after disruption (Correct answer)
The interval between drills

Correct answer: The target time to restore a function after disruption

RTO is the target duration within which a business process must be restored after a disruption.

Question 161: Which component of emergency planning identifies available resources and determines what additional resources may be needed?

Incident command structure
Threat assessment matrix
Communication cascade plan
Resource inventory and gap analysis (Correct answer)

Correct answer: Resource inventory and gap analysis

Resource inventory and gap analysis catalogs existing resources and identifies shortfalls that must be addressed before an emergency occurs.

Question 162: Which access control technology uses card credential data combined with a unique PIN to achieve two-factor authentication?

Proximity-only reader
Card plus PIN reader (Correct answer)
Barcode wand reader
Biometric iris scanner

Correct answer: Card plus PIN reader

A card plus PIN system combines something you have (the card) with something you know (the PIN) for stronger authentication.

Question 163: Chain-of-custody documentation must record:

Each person who handled the evidence, with dates, times, and purpose (Correct answer)
Only the final storage location
Only the evidence collector's name
The investigator's opinion of the evidence

Correct answer: Each person who handled the evidence, with dates, times, and purpose

An unbroken record of every transfer supports the evidence's admissibility.

Question 164: Which study area belongs in the Personnel Security domain?

Background investigations, pre-employment screening, and workplace violence prevention (Correct answer)
Cybersecurity incident response
Mutual aid agreements with emergency services
Perimeter fencing and intrusion detection

Correct answer: Background investigations, pre-employment screening, and workplace violence prevention

Personnel Security covers screening, vetting, and protecting people inside the workforce.

Question 165: What must a CPP applicant submit to document their experience?

Only a résumé with no contact details
Tax returns showing security income
An application describing security work history, which ASIS may verify (Correct answer)
Notarized letters from three police chiefs

Correct answer: An application describing security work history, which ASIS may verify

Applicants describe their security work history on the application, and ASIS reviews it and may audit or verify it.

Question 166: What happens if a CPP application is approved?

The CPP is awarded right away
The candidate becomes eligible to schedule the exam (Correct answer)
The candidate receives a provisional CPP for one year
The candidate must complete a mandatory ASIS course first

Correct answer: The candidate becomes eligible to schedule the exam

Approval only makes the candidate eligible to schedule and sit for the exam; the credential comes after passing.

Question 167: In the classic risk formula, risk is most commonly expressed as a function of which three elements?

Probability, insurance, and liability
Threat, vulnerability, and consequence (Correct answer)
Asset, budget, and staffing
Threat, deterrence, and response

Correct answer: Threat, vulnerability, and consequence

Risk is generally assessed as the combination of threat likelihood, vulnerability to that threat, and the consequence or impact of loss.

Question 168: What is the primary objective of Business Continuity Planning (BCP)?

To prevent all potential business disruptions from occurring
To establish redundant IT backup systems for all applications
To ensure critical business functions can continue during and after a disruption (Correct answer)
To document security incidents for insurance and legal purposes

Correct answer: To ensure critical business functions can continue during and after a disruption

BCP aims to ensure that critical business functions can continue operating with minimal interruption during and after any type of disruptive event.

Question 169: Under the ASIS Code of Ethics, members must safeguard confidential information and exercise due care to prevent its:

Improper disclosure (Correct answer)
Encryption
Destruction
Archiving

Correct answer: Improper disclosure

The ASIS Code requires members to protect confidential information and use due care to prevent improper disclosure.

Question 170: What is a fundamental experience requirement for candidates seeking the CPP certification?

Any form of employment.
General volunteer work.
Casual security observation.
Professional security experience, including a specific period in responsible charge of a security function. (Correct answer)

Correct answer: Professional security experience, including a specific period in responsible charge of a security function.

A fundamental requirement for CPP certification is demonstrating substantial professional security experience. This includes not only a minimum number of years in the field but also a specific period where the candidate held "responsible charge" of a security function. This signifies leadership and decision-making authority, ensuring candidates have practical, high-level experience relevant to security management.

Question 171: What quality assurance measure supports applied methods and techniques?

Regular self-assessment, peer review, and adherence to established standards (Correct answer)
Annual review is sufficient
Quality only matters for new practitioners
Quality checks are unnecessary for experienced professionals

Correct answer: Regular self-assessment, peer review, and adherence to established standards

Ongoing quality assurance through self-assessment, peer review, and standards adherence ensures continuous improvement.

Question 172: A client asks a security consultant to write a vulnerability report that understates risks to avoid budget increases. The consultant should:

Omit the findings entirely
Report findings accurately and objectively (Correct answer)
Write two versions and let the client choose
Write the report as requested since the client is paying

Correct answer: Report findings accurately and objectively

Truthfulness and integrity require that professional findings be reported accurately regardless of client preference.

Question 173: Which type of emergency preparedness exercise tests procedures through group discussion without physical movement of personnel?

Functional exercise
Full-scale exercise
Tabletop exercise (Correct answer)
Field exercise

Correct answer: Tabletop exercise

A tabletop exercise gathers key personnel to verbally walk through a simulated scenario, testing decision-making and procedures without physical deployment.

Question 174: A worker dies in a workplace incident. How soon must the employer report the fatality to OSHA?

Within 8 hours (Correct answer)
Within 24 hours
Within 7 calendar days
Within 72 hours

Correct answer: Within 8 hours

OSHA requires fatalities to be reported within 8 hours; inpatient hospitalizations, amputations, and eye losses must be reported within 24 hours.

Question 175: How many years must employers keep OSHA 300 logs, 300A summaries, and 301 incident reports?

3 years
1 year
5 years (Correct answer)
30 years

Correct answer: 5 years

OSHA injury and illness records must be kept for 5 years after the end of the calendar year they cover.

Question 176: What does the Recovery Time Objective (RTO) define in business continuity planning?

The time required to detect and confirm a business disruption
The maximum acceptable downtime before a business function must be restored (Correct answer)
The total cost to fully restore a disrupted business function
The percentage of operational data that may be lost during recovery

Correct answer: The maximum acceptable downtime before a business function must be restored

RTO defines the maximum tolerable downtime for a critical business function, establishing the deadline by which that function must be restored after a disruption.

Question 177: Which document guides an organization's continued operation of essential functions after a disruptive event?

Post order
Employee handbook
Business continuity plan (Correct answer)
Security survey

Correct answer: Business continuity plan

A business continuity plan keeps critical functions running during and after a disruption.

Question 178: What is the FIRST step a security professional should take when a potential crisis is identified?

Activate the emergency response team
Recognize and officially declare the crisis (Correct answer)
Notify the media of the situation
Evacuate the facility immediately

Correct answer: Recognize and officially declare the crisis

Recognizing and declaring the crisis is the essential first step because it triggers the formal response process and activates notification chains.

Question 179: Which NFPA standard specifically addresses active shooter and hostile event response programs?

NFPA 72
NFPA 3000 (Correct answer)
NFPA 730
NFPA 101

Correct answer: NFPA 3000

NFPA 3000 sets out an integrated program for preparing for and responding to active shooter and hostile events.

Question 180: Which organization grants the CPP credential?

(ISC)²
International Foundation for Protection Officers
ASIS International (Correct answer)
National Fire Protection Association

Correct answer: ASIS International

The CPP is awarded by ASIS International through its Professional Certification Board.

Question 181: Which intrusion detection sensor detects movement by measuring changes in infrared energy within its field of view?

Microwave sensor
Balanced magnetic switch
Glass-break acoustic sensor
Passive infrared (PIR) sensor (Correct answer)

Correct answer: Passive infrared (PIR) sensor

PIR sensors detect changes in thermal (infrared) energy caused by a moving warm body.

Question 182: Post orders for contract security officers should be:

Kept by the vendor and not shared with the client
Verbal only, to allow flexibility
Identical for every post on the site
Written, specific to the post, and reviewed periodically (Correct answer)

Correct answer: Written, specific to the post, and reviewed periodically

Written, post-specific orders that are kept current define duties and reduce liability.

Question 183: A recertification application is selected for audit. What will the CPP most likely be asked to provide?

A retake of the CPP exam
Supporting documentation for claimed CPE activities (Correct answer)
Letters from three clients
A new background check

Correct answer: Supporting documentation for claimed CPE activities

Audits verify that claimed CPE activities are documented and legitimate.

Question 184: Which of these is an ethical obligation tied to keeping a CPP designation?

Endorsing products for compensation
Representing credentials and qualifications truthfully (Correct answer)
Charging clients the highest possible fees
Sharing exam questions with colleagues

Correct answer: Representing credentials and qualifications truthfully

The ASIS Code of Ethics requires honesty, including truthful representation of one's credentials.

Question 185: Why do study guides tell CPP candidates to use the official ASIS domain outline when building a study plan?

It lists the tasks and knowledge areas the exam questions are written from (Correct answer)
It replaces the need for any reference books
It has the actual exam questions
It is required reading before you can register

Correct answer: It lists the tasks and knowledge areas the exam questions are written from

Exam items are mapped to the outline's tasks and knowledge statements, so it shows what will be tested.

Question 186: What ethical standard governs assessment and evaluation practice?

Ethical standards are optional for certified professionals
Ethics only apply in academic settings
Adherence to the profession's code of ethics and applicable laws and regulations (Correct answer)
Ethics are personal opinions, not professional requirements

Correct answer: Adherence to the profession's code of ethics and applicable laws and regulations

Professional ethics codes and applicable laws provide the framework for ethical practice in every professional field.

Question 187: Which type of protective lighting is most commonly used and consists of fixed luminaires arranged to flood an area continuously during darkness?

Continuous lighting (Correct answer)
Standby lighting
Movable lighting
Emergency lighting

Correct answer: Continuous lighting

Continuous lighting is the most common protective lighting system, providing steady illumination of an area.

Question 188: Which concept should candidates review for the Business Principles and Practices domain?

Evidence chain of custody
Fire suppression system types
Budgeting, financial analysis, and cost-benefit justification of security programs (Correct answer)
Lock cylinder pinning

Correct answer: Budgeting, financial analysis, and cost-benefit justification of security programs

This domain tests whether security leaders can manage budgets and justify spending in business terms.

Question 189: Which of the following is NOT a requirement for CPP eligibility?

A bachelor's degree in security management
5 years of professional security management experience
Completion of a security internship (Correct answer)
Completion of the application form

Correct answer: Completion of a security internship

While practical experience is crucial for CPP eligibility, a formal security internship is not a mandatory requirement. The core experience requirements focus on a specific number of years in professional security management, often with a portion in "responsible charge" of a security function. Educational attainment can sometimes reduce the required years of experience, but an internship is not a standalone prerequisite.

Question 190: Which experience requirement applies to a CPP candidate without a bachelor's degree?

Three years of security experience with no supervisory role
Five years of any professional experience
Ten years of law enforcement experience only
Seven years of security experience, including three years in responsible charge (Correct answer)

Correct answer: Seven years of security experience, including three years in responsible charge

Without a bachelor's degree, candidates need seven years of security experience, including three in responsible charge.

Question 191: Records retention schedules for security documents should be based primarily on:

The security manager's preference
Legal, regulatory, and organizational requirements (Correct answer)
Available storage space
Whether the documents are typed

Correct answer: Legal, regulatory, and organizational requirements

Retention must satisfy legal and regulatory obligations as well as business needs.

Question 192: How should assessment and evaluation knowledge be maintained and updated?

Learning stops after certification
Knowledge updates are only needed every five years
Initial training provides lifelong competence
Through continuous professional development, current literature review, and professional networking (Correct answer)

Correct answer: Through continuous professional development, current literature review, and professional networking

Professional competence requires ongoing development through education, literature review, and engagement with the professional community.

Question 193: Which multi-volume ASIS publication is the main reference for CPP exam preparation?

Principles of Security Management
Security Supervision and Management
The Handbook for Effective Physical Security
Protection of Assets (POA) (Correct answer)

Correct answer: Protection of Assets (POA)

ASIS's Protection of Assets set covers every CPP domain and is the main study reference.

Question 194: A security manager presenting a budget request to senior leadership should primarily frame it in terms of:

Technical specifications of equipment
Historical crime statistics only
Industry jargon to show expertise
Business risk reduction and return on investment (Correct answer)

Correct answer: Business risk reduction and return on investment

Executives respond best to security proposals tied to business value and risk reduction.

Question 195: How does educational attainment factor into the CPP eligibility requirements?

Only security focused PHD's are acceptable.
Educational attainment is not considered.
Only high school diplomas are acceptable.
Higher levels of education can sometimes substitute for a portion of the required professional experience. (Correct answer)

Correct answer: Higher levels of education can sometimes substitute for a portion of the required professional experience.

ASIS International recognizes that higher education contributes to a candidate's knowledge base and can enhance their professional capabilities. Therefore, while professional experience is paramount, a bachelor's degree or higher can sometimes reduce the total number of years of security experience required to sit for the CPP exam. This flexibility acknowledges diverse pathways to achieving the necessary expertise for the certification.

Question 196: When writing a report that may be used in litigation, an officer should:

Include speculation to be thorough
Omit facts that weaken the company's position
Write in clear, factual language and avoid unnecessary jargon (Correct answer)
Use abbreviations to save space

Correct answer: Write in clear, factual language and avoid unnecessary jargon

Clear, complete, factual reports hold up under legal scrutiny.

Question 197: What is the primary purpose of a Business Impact Analysis (BIA)?

To assess the security department's performance against industry benchmarks
To identify critical business functions and quantify the impact of their disruption (Correct answer)
To evaluate the financial markets and economic factors affecting the business
To measure the specific impact of cybersecurity incidents on IT systems only

Correct answer: To identify critical business functions and quantify the impact of their disruption

A BIA identifies which business functions are critical, determines the operational and financial impact of their disruption, and establishes recovery priorities and time objectives.

Question 198: Under the GHS-aligned Hazard Communication Standard, how many sections must a Safety Data Sheet contain?

12
16 (Correct answer)
10
8

Correct answer: 16

HazCom 2012 requires SDSs in a standardized 16-section format.

Question 199: What is a 'hot site' in business continuity planning?

A fully equipped alternate facility that can be activated immediately after a disruption (Correct answer)
A facility located in a temperate region to avoid natural disaster exposure
A backup site requiring 24 to 72 hours of preparation before becoming operational
An internal software-only backup system for critical enterprise applications

Correct answer: A fully equipped alternate facility that can be activated immediately after a disruption

A hot site is a fully operational alternate facility with all necessary hardware, software, and connectivity that can be activated immediately or within hours of a primary site failure.

Certified Protection Professional (CPP) Exam

The CPP certification demonstrates an individual's expertise in security management, including security principles, practices, and business operations.

200

Questions

240 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

asisonline.org — Test delivery, fees, passing score, retake policy, score release, time limit, eligibility, score validity, retake fee, test dates · verified Oct 2026