The ASIS International Certified Security Investigator (CSI) credential is one of the most respected certifications for security professionals who conduct workplace and corporate investigations. Earning it demonstrates command of investigative fundamentals, interview and interrogation techniques, undercover operations, legal aspects of investigations, and report writing — the five domains that make up the CSI exam.
This free printable PDF gives you realistic exam-style questions across all five domains so you can review offline, identify your weak areas, and walk into the exam with confidence. Download it below and work through every question — answer explanations are included.
The ASIS CSI exam tests knowledge across five domains. Here is what you need to know for each.
This domain covers the complete investigative process from complaint or assignment through investigation planning, evidence collection, analysis, and final reporting. You need to understand the types of investigations a security investigator handles — internal (HR/employment matters, theft, fraud, misconduct) versus external (criminal background, insurance) — and the critical distinction between a security investigation and a law enforcement investigation. Security investigators have no arrest authority and work under the civil standard of proof (preponderance of evidence — more likely than not), not the criminal standard (beyond reasonable doubt). Evidence collection procedures, chain of custody requirements, and investigative planning are all tested in this domain.
The exam draws a sharp line between an interview (non-accusatory, information-gathering conversation with any witness or subject) and an interrogation (accusatory, used only after guilt has been established to a reasonable degree). The cognitive interview technique — a research-backed method that increases accurate recall without leading the subject — is a tested concept. Prepare to answer questions about open versus closed questioning strategies, behavioral indicators of deception (both verbal and non-verbal), proper statement-taking procedures, and the rights of interviewees. Special population considerations — including how to interview juveniles, trauma victims, and union employees — round out this domain.
Undercover investigations require careful planning and proper organizational authorization before deployment. You need to know how to manage undercover operatives, maintain documentation, and keep evidence handling clean throughout the operation. The legal and ethical limits of undercover work — including what instructions can and cannot be given to operatives — are heavily tested. Post-operation steps include testifying about undercover findings in a way that protects the operative's identity to the extent possible, and minimizing organizational liability from the operation.
This domain covers the legal framework around security investigations. Civil versus criminal investigations differ in standard of proof, procedure, and outcome. Rules of evidence — relevance and admissibility — apply even in internal investigations when findings may later be used in court. Chain of custody is mandatory for any evidence that may be introduced in litigation. Privacy law is extensively tested: the Electronic Communications Privacy Act (ECPA) governs electronic surveillance and wiretapping; recording consent laws vary by state (one-party vs. two-party consent); and employee monitoring in the workplace carries specific legal requirements. Negligent hiring liability, defamation risks from false investigation conclusions, and false imprisonment exposure from detaining subjects improperly are all tested topics. Document and records retention obligations close out this domain.
A CSI investigation is only as valuable as its documentation. Investigation reports follow a standard structure: executive summary, facts (chronological narrative of what was done and found), analysis (what the facts mean), conclusions (did the alleged conduct occur?), and recommendations (disciplinary, policy, legal action). Digital evidence preservation — metadata integrity, forensic imaging, write-blockers — is tested alongside physical evidence organization. When testifying, you must understand the difference between a fact witness (testifies only to personal observations) and an expert witness (renders opinions based on expertise). Deposition preparation, handling hostile cross-examination, and managing confidential source information during testimony are also covered.
The printable PDF is a great focused study tool, but timed online practice builds the recall speed you need for a multiple-choice exam. Our CSI practice test covers all five ASIS CSI exam domains with hundreds of questions, randomized answer choices, and detailed explanations for every item. Combining PDF review sessions with timed online practice tests is the most effective preparation strategy for the CSI certification exam.
Pay particular attention to the legal aspects domain — candidates with strong field investigation experience often underestimate how precisely the exam tests statutory knowledge (ECPA, consent laws, chain of custody). Use the study checklist above to make sure you cover every domain before your exam date.
| Pros | Cons |
|---|---|
| Validates your knowledge and skills objectively | Study materials can be expensive |
| Increases job market competitiveness | Exam anxiety can affect performance |
| Provides structured learning goals | Requires dedicated preparation time |
| Networking opportunities with other certified professionals | Retake fees apply if you don't pass |
Try these questions from our free Certified Security Investigator practice tests. The correct answer and an explanation follow each question.
A company relies on a single supplier for a critical component. A CSI would flag this as which type of risk?
Answer: B. Single point of failure / supply chain risk
Dependence on a single supplier creates a single point of failure and supply chain vulnerability that could disrupt operations.
When evaluating a facility's key control program during a survey, which finding represents the MOST serious vulnerability?
Answer: A. Keys are labeled with room numbers for convenience
Labeling keys with room numbers enables a lost or stolen key to be used immediately against the targeted lock, creating a critical vulnerability.
Which section of a formal incident report typically contains the investigator's conclusions and recommendations?
Answer: C. Summary and Recommendations
The Summary and Recommendations section is where investigators present their analytical conclusions and proposed next steps.
A 'tabletop exercise' is most useful for:
Answer: B. Identifying gaps in plans through facilitated discussion without deploying resources
Tabletop exercises gather key stakeholders to walk through scenarios verbally, exposing plan gaps, coordination issues, and decision-making weaknesses without operational disruption.