Mixed Deck — All CPP Topics Flashcards

A security manager calculates the annualized loss expectancy for a threat. Which formula is correct?

Answer: Single loss expectancy × annual rate of occurrence

ALE equals the single loss expectancy multiplied by the annualized rate of occurrence.

Which of the following is considered a primary and essential study resource provided by ASIS International for CPP exam preparation?

Answer: The "Protection of Assets" (POA) reference set.

The "Protection of Assets" (POA) reference set is the foundational body of knowledge for the CPP certification, published by ASIS International. It is considered the primary and essential study resource because it comprehensively covers all the domains and principles tested on the exam. Candidates are expected to have a deep understanding of the information contained within the POA to succeed.

Besides earning CPE credits, what must a CPP continue to do to stay certified?

Answer: Follow the ASIS Code of Ethics

Certificants must keep following the ASIS Code of Ethics, or their certification can be revoked.

Which law requires colleges receiving federal aid to publish an annual security report with campus crime statistics?

Answer: The Clery Act

The Jeanne Clery Act requires institutions to disclose crime statistics and security policies in an annual security report.

Under the Weingarten rights established by the NLRB, which employees are entitled to have a representative present during an investigatory interview?

Answer: Unionized employees who reasonably believe the interview may lead to discipline and request a representative

Weingarten rights apply to union-represented employees who request representation when they reasonably fear discipline.

Which experience requirement applies to a CPP candidate without a bachelor's degree?

Answer: Seven years of security experience, including three years in responsible charge

Without a bachelor's degree, candidates need seven years of security experience, including three in responsible charge.

What is the recommended sequence for applying the risk management process when planning physical security upgrades?

Answer: Identify assets → Analyze threats → Assess vulnerabilities → Select countermeasures

The standard risk management cycle begins with asset identification, then threat and vulnerability analysis before selecting proportionate countermeasures.

Under the ASIS Enterprise Security Risk Management (ESRM) approach, who is ultimately responsible for deciding whether to accept a given security risk?

Answer: The asset owner or business leader

ESRM positions security as an advisor while the asset owners make final risk acceptance decisions.

A mailroom employee finds a package with excessive postage, no return address, and an oily stain. What is the best practice response?

Answer: Do not open it, isolate the area, evacuate, and notify authorities

Suspicious packages should be left undisturbed, the area isolated and evacuated, and trained responders notified.

Restricting sensitive information to people whose duties require it, even if they hold the right clearance, applies which principle?

Answer: Need to know

Need to know limits disclosure to people who need the information for their work, regardless of clearance level.

Which practice BEST supports a smooth CPP recertification?

Answer: Logging CPE activities and keeping proof throughout the cycle

Tracking credits and keeping documentation as you go prevents last-minute gaps and helps with audits.

In the widely used workplace violence typology, violence by a current or former employee against coworkers is classified as which type?

Answer: Type III, worker-on-worker

Type III covers violence by current or former employees against coworkers or supervisors.

Which of the following is the best example of a security professional's duty of loyalty to an employer?

Answer: Protecting the employer's proprietary information even after leaving the job

Loyalty includes protecting confidential and proprietary employer information during and after employment.

How is the CPP exam scored?

Answer: Scaled score, with 650 needed to pass

ASIS reports CPP results on a scaled score from 200 to 800, and 650 is required to pass.

With limited exceptions, which federal law prohibits most private employers from requiring lie detector tests of applicants or employees?

Answer: The Employee Polygraph Protection Act of 1988

The EPPA bars most private employers from using polygraphs, with exceptions such as certain security service firms and ongoing theft investigations.

Under the time-based concept of physical protection, an intrusion is defeated only when which condition is met?

Answer: Detection plus response time is less than the delay the adversary faces after detection

The response force must arrive before the adversary completes the task, so delay after detection must exceed response time.

Which of the following is a domain covered by the CPP exam?

Answer: Operations and physical security management

The CPP exam covers several key domains that reflect the breadth of security management responsibilities. Operations and physical security management is one of these core domains, encompassing topics like access control, surveillance, security personnel deployment, and emergency procedures. This domain is fundamental to protecting assets and personnel in various organizational settings, making it a critical area of expertise for CPPs.

What generally happens if a CPP does not complete recertification by the end of the cycle?

Answer: The certification lapses and the person may no longer use the CPP designation

Without recertification, the credential is no longer active, and the holder may not present themselves as a CPP.

Which ASIS resource helps candidates stay current between exam cycles and earn CPE credit?

Answer: Security Management magazine and ASIS educational programs such as webinars and GSX

ASIS publications, webinars, and the GSX conference provide current content and count toward CPE credits.

Under the Stored Communications Act (SCA), a company that wishes to access an employee's personal email account stored on a third-party server generally must:

Answer: Obtain employee consent or a valid legal process (warrant/court order)

The SCA restricts unauthorized access to stored electronic communications, requiring either voluntary consent or lawful legal process to access third-party-hosted accounts.