Certified Security Manager (CSM) Exam — Questions and Answers

Question 1: In Certified Security Manager, what is the PRIMARY purpose of regular personal protective equipment maintenance?

To comply with warranty terms only
To ensure reliability, safety, and extend useful service life (Correct answer)
To create documentation for audits
To justify maintenance staff positions

Correct answer: To ensure reliability, safety, and extend useful service life

Regular maintenance ensures equipment remains reliable and safe while maximizing its useful service life.

Question 2: How do security audits contribute to asset protection?

By ignoring external security threats.
By focusing solely on financial records.
By reducing the need for employee involvement in security.
By identifying areas of vulnerability and improving security (Correct answer)

Correct answer: By identifying areas of vulnerability and improving security

Security audits are vital for asset protection as they systematically evaluate the effectiveness of existing security controls and practices within an organization. These audits uncover weaknesses, non-compliance, or gaps in security measures that could be exploited by threats. By identifying these vulnerabilities, organizations can implement corrective actions and continuously improve their security posture, thereby better protecting their valuable assets.

Question 3: A key card reader that logs every entry and exit attempt, including failed attempts, supports which security principle?

Least privilege
Separation of duties
Need-to-know
Accountability and auditability (Correct answer)

Correct answer: Accountability and auditability

Logging all access attempts creates an audit trail that supports accountability, enabling security managers to investigate incidents and detect anomalies.

Question 4: A security manager is evaluating a new access control system. Which factor is MOST important when assessing biometric system accuracy?

The color of the reader housing
Equal Error Rate (EER) — the point where false acceptance rate equals false rejection rate (Correct answer)
The number of USB ports on the reader
Reader installation height

Correct answer: Equal Error Rate (EER) — the point where false acceptance rate equals false rejection rate

EER is the standard metric for biometric accuracy — the lower the EER, the more accurate the system at correctly identifying and rejecting users.

Question 5: Where does PPE sit in the hierarchy of controls?

Immediately after elimination
First, before engineering controls
Last, after elimination, substitution, engineering and administrative controls (Correct answer)
Equal to engineering controls

Correct answer: Last, after elimination, substitution, engineering and administrative controls

PPE is the last line of defense because it does not remove the hazard and depends on correct user behavior.

Question 6: What is the role of auditing in security policy enforcement?

It only applies to network security.
It focuses only on financial auditing.
It ensures compliance with policies and identifies weaknesses (Correct answer)
It limits the need for security training.

Correct answer: It ensures compliance with policies and identifies weaknesses

Auditing in security policy enforcement involves systematically reviewing security controls, processes, and practices within an organization. This process verifies that established policies are being followed consistently and helps uncover any deviations, vulnerabilities, or areas for improvement. By identifying weaknesses, organizations can proactively strengthen their security posture and ensure ongoing compliance, thereby enhancing overall security.

Question 7: What is the MOST effective way to stay current with developments in workplace ergonomics & health for Certified Security Manager?

Relying on experience gained early in career
Participating in professional development, industry events, and peer collaboration (Correct answer)
Following a single expert opinions
Reading only internal communications

Correct answer: Participating in professional development, industry events, and peer collaboration

A multi-faceted approach including formal development, industry events, and peer collaboration provides the broadest perspective on current developments.

Question 8: What is the primary legal consideration when deploying audio recording capabilities alongside CCTV surveillance in the United States?

Audio is only permitted outdoors, not inside buildings
Audio recording has no additional legal requirements beyond video surveillance
Many US states require at least one-party or all-party consent for audio recording, which may restrict covert audio capture (Correct answer)
Audio recording is federally prohibited in all commercial settings

Correct answer: Many US states require at least one-party or all-party consent for audio recording, which may restrict covert audio capture

Audio recording laws vary significantly by state, with some requiring all-party consent; security managers must verify compliance with applicable state wiretapping and eavesdropping statutes before deploying audio.

Question 9: Under the Electronic Communications Privacy Act (ECPA), which of the following monitoring activities by an employer is generally permissible?

Recording personal conversations in private spaces
Intercepting personal cell phone calls without consent
Wiretapping home phone lines of employees
Monitoring employee emails on company systems with prior notice (Correct answer)

Correct answer: Monitoring employee emails on company systems with prior notice

ECPA generally permits employers to monitor electronic communications on company-owned systems when employees have been given prior notice of the monitoring policy.

Question 10: At what 8-hour time-weighted average noise level must OSHA require a hearing conservation program?

100 dBA
85 dBA (Correct answer)
70 dBA
120 dBA

Correct answer: 85 dBA

The OSHA action level is 85 dBA as an 8-hour TWA, triggering monitoring, audiometry and hearing protection availability.

Question 11: Why is it important to have clear communication during a crisis?

It ensures timely, accurate information and coordinated efforts (Correct answer)
It helps prioritize the issues based on personal preferences.
It focuses solely on media relations.
It reduces the number of people involved in the crisis.

Correct answer: It ensures timely, accurate information and coordinated efforts

Clear communication during a crisis is paramount because it ensures that all stakeholders receive timely and accurate information, preventing misinformation and reducing panic. This coordinated flow of information enables effective decision-making, aligns response efforts, and helps maintain trust with employees, customers, and the public during uncertain times.

Question 12: Under the FCRA, what must an employer do BEFORE taking adverse action based on a third-party background report?

Give the applicant a copy of the report and a summary of rights (Correct answer)
Notify local law enforcement
Obtain a second report from another vendor
Delete the report immediately

Correct answer: Give the applicant a copy of the report and a summary of rights

The FCRA requires a pre-adverse action notice with the report copy and the Summary of Rights so the person can dispute errors.

Question 13: A security officer uses excessive force during an arrest. The injured party files a civil lawsuit. What is the most likely legal theory under which the victim would sue?

Intentional tort of battery or negligence (Correct answer)
Breach of fiduciary duty
Negligence per se based on OSHA violations
Criminal battery prosecuted by the state

Correct answer: Intentional tort of battery or negligence

Excessive force claims against private security are typically brought as intentional torts (battery) or negligence claims in civil court, since victims seek monetary compensation.

Question 14: Which element of a well-formed policy states who is covered by it?

Revision history
Scope (Correct answer)
Enforcement clause
Glossary

Correct answer: Scope

The scope section identifies the people, systems, and data to which the policy applies.

Question 15: Under U.S. law, when a private security officer detains a suspected shoplifter, this action is most commonly justified under which legal principle?

Merchant's privilege (shopkeeper's privilege) (Correct answer)
Federal commerce clause powers
Citizen's arrest authority
Police officer equivalent authority

Correct answer: Merchant's privilege (shopkeeper's privilege)

Shopkeeper's privilege allows merchants and their agents to detain suspected shoplifters for a reasonable time using reasonable force to investigate, provided there is probable cause.

Question 16: What is the PRIMARY objective of fire prevention & protection within the Certified Security Manager profession?

To ensure quality outcomes through standardized practices and continuous improvement (Correct answer)
To maintain the status quo without change
To create additional requirements for practitioners
To limit the scope of professional activities

Correct answer: To ensure quality outcomes through standardized practices and continuous improvement

The primary objective is ensuring quality outcomes through established standards while continuously improving practices and processes.

Question 17: What is the primary purpose of emergency response planning?

To prevent any external involvement in crisis situations.
To focus only on emergency response training.
To ensure effective response and minimize impact (Correct answer)
To delay responses until external authorities arrive.

Correct answer: To ensure effective response and minimize impact

The primary purpose of emergency response planning is to establish clear guidelines and actions for an organization to follow during a crisis. This preparation ensures an effective and coordinated response, which is crucial for minimizing the impact of the emergency on people, assets, and operations, and facilitating a quicker recovery.

Question 18: Why is a disaster recovery plan crucial for asset protection?

It delays asset recovery until the cause of the disaster is found.
It reduces the response time for external agencies.
It focuses only on financial recovery.
It ensures rapid recovery and asset protection during a crisis (Correct answer)

Correct answer: It ensures rapid recovery and asset protection during a crisis

A disaster recovery plan (DRP) is crucial for asset protection because it outlines the procedures and resources needed to restore critical operations and assets after a disruptive event. By having a predefined plan, organizations can minimize downtime, prevent further damage, and ensure the swift recovery of essential data, systems, and physical assets. This proactive planning mitigates the long-term impact of crises and safeguards organizational continuity.

Question 19: A qualitative fit test using Bitrex or saccharin relies on:

Visual inspection by the supervisor
A particle counter
The wearer detecting taste of the test agent (Correct answer)
Pressure gauge readings

Correct answer: The wearer detecting taste of the test agent

Qualitative tests are pass/fail based on whether the wearer tastes or smells the agent, unlike quantitative tests that use instruments.

Question 20: Why is it essential to conduct risk assessments in personnel and asset protection?

To identify vulnerabilities and improve security measures (Correct answer)
To reduce the number of employees.
To increase company expenses.
To ensure employee negligence.

Correct answer: To identify vulnerabilities and improve security measures

Risk assessments are essential in personnel and asset protection because they systematically identify potential threats and vulnerabilities that could impact employees and organizational assets. By understanding these specific risks, organizations can prioritize and implement appropriate security controls and mitigation strategies. This proactive approach allows for the most effective allocation of resources to enhance overall security and reduce potential losses.

Question 21: Which technique is a qualitative risk analysis method?

Monte Carlo simulation
Return on security investment formula
Risk matrix scoring based on expert judgment (Correct answer)
Annualized loss expectancy calculation

Correct answer: Risk matrix scoring based on expert judgment

Qualitative methods rank risks using descriptive scales rather than monetary values.

Question 22: Which security technology standard governs the interoperability of IP-based physical security devices such as cameras and access control systems from different manufacturers?

NIST SP 800-53
ASIS SPC.1
ISO 27001
ONVIF (Open Network Video Interface Forum) (Correct answer)

Correct answer: ONVIF (Open Network Video Interface Forum)

ONVIF is an industry standard that enables IP-based security devices from different manufacturers to communicate and interoperate, reducing vendor lock-in.

Question 23: What consequence can result from failing to maintain proper regulatory compliance & standards standards in Certified Security Manager?

Loss of certification, legal penalties, and reputational damage (Correct answer)
Lower training requirements
Reduced workload for staff
Increased customer satisfaction

Correct answer: Loss of certification, legal penalties, and reputational damage

Non-compliance can result in serious consequences including certification revocation, legal penalties, fines, and significant reputational damage.

Question 24: What must occur before an employee is fit tested or required to wear a respirator?

A supervisor's verbal approval only
A medical evaluation to confirm they can use one (Correct answer)
A written exam on filter chemistry
Purchase of a personal respirator

Correct answer: A medical evaluation to confirm they can use one

OSHA requires a medical evaluation before fit testing or use because respirators can strain the heart and lungs.

Question 25: In security technology, what does 'IP camera' refer to?

An in-perimeter camera mounted outdoors
An impact-proof camera
An infrared-powered camera
A camera that transmits video over a network using Internet Protocol (Correct answer)

Correct answer: A camera that transmits video over a network using Internet Protocol

An IP camera digitizes and transmits video over a TCP/IP network, enabling remote access, flexible placement, and integration with VMS platforms without dedicated coaxial cabling.

Question 26: When conducting a hazard identification & assessment review in Certified Security Manager, which approach yields the BEST results?

Reviewing only incidents from the past month
Informal observation without documentation
Systematic analysis using established frameworks and checklists (Correct answer)
Focusing exclusively on equipment checks

Correct answer: Systematic analysis using established frameworks and checklists

Systematic analysis using established frameworks ensures comprehensive coverage of all potential risks and provides consistent, reliable results.

Question 27: What is the primary purpose of advance work in executive protection?

Training the principal's family
Negotiating hotel rates
Surveying venues and routes before the principal arrives (Correct answer)
Selecting the principal's wardrobe

Correct answer: Surveying venues and routes before the principal arrives

Advance work identifies hazards, routes, safe havens, and medical facilities before the principal arrives.

Question 28: When should incident investigation & analysis be conducted in Certified Security Manager?

Once during initial setup only
At regular intervals and whenever significant changes occur (Correct answer)
Only when problems are identified
Only when required by external auditors

Correct answer: At regular intervals and whenever significant changes occur

Regular assessments combined with trigger-based reviews ensure ongoing monitoring while capturing the impact of significant changes.

Question 29: Why is it important to continuously monitor and reassess security risks?

It reduces the need for security personnel.
It helps maintain compliance with regulatory standards.
It helps adapt to new threats and changing circumstances (Correct answer)
It ensures that no security breaches occur.

Correct answer: It helps adapt to new threats and changing circumstances

Continuously monitoring and reassessing security risks is vital because the threat landscape is constantly evolving. New vulnerabilities emerge, technologies change, and attackers develop sophisticated methods. Regular monitoring ensures that security measures remain effective and can adapt promptly to new threats and changing operational circumstances, maintaining robust protection.

Question 30: Which training & awareness programs strategy BEST supports knowledge retention in Certified Security Manager?

Intensive one-day workshops
Memorization of facts without context
Spaced repetition with practical application opportunities (Correct answer)
Reading assignments without discussion

Correct answer: Spaced repetition with practical application opportunities

Spaced repetition reinforces learning over time while practical application provides context that aids long-term retention.

Question 31: Which control most directly reduces the risk of a single insider stealing high-value inventory?

Signage warning of prosecution
Brighter warehouse lighting
Separation of duties (Correct answer)
Annual policy acknowledgment

Correct answer: Separation of duties

Separation of duties ensures no one person controls a transaction from start to finish, requiring collusion to steal.

Question 32: How does technology improve asset protection?

By reducing the need for security staff.
By focusing on physical security measures alone.
By providing advanced tools for monitoring and threat detection (Correct answer)
By limiting employee access to information.

Correct answer: By providing advanced tools for monitoring and threat detection

Technology significantly enhances asset protection by offering sophisticated capabilities that human observation alone cannot match. Tools like CCTV, intrusion detection systems, biometric scanners, and AI-powered analytics enable continuous monitoring, rapid threat detection, and automated responses. This leads to more efficient, comprehensive, and proactive security measures, improving overall protection for an organization's assets.

Question 33: Which legal standard determines whether a security officer's use of force was lawful during a detention?

The force used must be proportionate and reasonable under the circumstances (Correct answer)
Force is only lawful when authorized in writing by the client
Any force is permissible when a crime is suspected
Security officers may use the same force level as sworn police

Correct answer: The force used must be proportionate and reasonable under the circumstances

The 'reasonable and proportionate' standard requires that the level of force used matches the threat level and what a reasonable person would consider necessary in the same circumstances.

Question 34: What is the role of incident response in security management?

To respond immediately and mitigate the impact of incidents (Correct answer)
To avoid involving external agencies.
To delay action until the incident escalates.
To allow the organization to remain passive.

Correct answer: To respond immediately and mitigate the impact of incidents

Incident response is a critical function in security management, designed to address security breaches or events swiftly and effectively. Its primary goal is to contain the incident, minimize its impact, and restore normal operations as quickly as possible. Delaying action or remaining passive would only exacerbate the situation, leading to greater damage and potential losses for the organization.

Question 35: Which topic must PPE training cover under OSHA 1910.132(f)?

Only the brand names
Only how to order PPE
Only the cost of PPE
When PPE is necessary, what kind, how to wear it, its limitations, and its care (Correct answer)

Correct answer: When PPE is necessary, what kind, how to wear it, its limitations, and its care

Training must cover need, type, proper donning and doffing, limitations, and care, maintenance, and disposal.

Question 36: What is the role of a Security Operations Center (SOC) in an enterprise security program?

To serve as the centralized hub for monitoring alarms, cameras, and coordinating security responses (Correct answer)
To negotiate security vendor contracts
To conduct employee background checks
To manufacture security equipment

Correct answer: To serve as the centralized hub for monitoring alarms, cameras, and coordinating security responses

A SOC is the nerve center of a security program, providing 24/7 monitoring of alarms, surveillance feeds, and communications to coordinate real-time incident response.

Question 37: Which federal law primarily governs the privacy of employee medical records and restricts employer access to such information?

Family and Medical Leave Act (FMLA)
OSHA Act of 1970
Health Insurance Portability and Accountability Act (HIPAA) (Correct answer)
Americans with Disabilities Act (ADA)

Correct answer: Health Insurance Portability and Accountability Act (HIPAA)

HIPAA establishes national standards for protecting individuals' medical records and personal health information, limiting employer access to employee health data.

Question 38: What should be included in an emergency response plan?

Only contact information for emergency responders.
Financial plans for recovery.
A list of non-essential staff.
Procedures, roles, communication strategies, and resources (Correct answer)

Correct answer: Procedures, roles, communication strategies, and resources

A comprehensive emergency response plan should include detailed procedures for various scenarios, clearly defined roles and responsibilities for staff, robust communication strategies for internal and external stakeholders, and a list of available resources. These elements ensure a structured and effective response, minimizing chaos and maximizing efficiency during a crisis.

Question 39: What is the purpose of security risk assessments in security management?

To identify and mitigate potential security risks (Correct answer)
To ensure compliance with legal requirements.
To increase the number of security personnel.
To reduce operational costs.

Correct answer: To identify and mitigate potential security risks

Security risk assessments are fundamental in security management because they systematically identify potential vulnerabilities and threats within an organization's systems and operations. By understanding these risks, organizations can then develop and implement targeted strategies to mitigate them, thereby protecting assets and ensuring business continuity.

Question 40: Which type of motion detector uses microwave energy to detect movement within a protected area?

Microwave sensor (Correct answer)
Glass break detector
Vibration sensor
Passive infrared (PIR) sensor

Correct answer: Microwave sensor

Microwave sensors emit microwave pulses and detect movement by measuring changes in the reflected signal, and can penetrate non-metallic objects unlike PIR sensors.

Question 41: In Certified Security Manager, what is the MOST appropriate response when a potential compliance violation is discovered?

Discuss it informally without documentation
Address it only if a supervisor specifically asks about it
Wait to see if the violation causes harm before reporting
Report it immediately through established channels and document findings (Correct answer)

Correct answer: Report it immediately through established channels and document findings

Immediate reporting through established channels with proper documentation ensures timely resolution and maintains the integrity of the compliance program.

Question 42: Why is coordination with external agencies important in crisis management?

It limits the organization’s ability to act independently.
It reduces communication within the organization.
It is only necessary for large-scale events.
It ensures additional support and expertise (Correct answer)

Correct answer: It ensures additional support and expertise

Coordination with external agencies, such as emergency services, government bodies, and specialized experts, is vital in crisis management because it provides additional support, resources, and specialized expertise that an organization may lack internally. This collaboration ensures a more comprehensive and effective response, especially for large-scale or complex incidents, enhancing overall crisis resolution capabilities.

Question 43: How does physical security contribute to asset protection?

It focuses on digital security alone.
It limits the number of staff involved in security.
It helps prevent unauthorized access and protects assets (Correct answer)
It focuses on financial risks only.

Correct answer: It helps prevent unauthorized access and protects assets

Physical security encompasses measures like access controls, surveillance systems, and perimeter defenses designed to protect tangible assets and facilities. Its contribution is direct, as it physically restricts unauthorized individuals from gaining entry to secure areas or tampering with equipment and data. This layer of defense is fundamental in preventing theft, damage, espionage, and ensuring the safety of personnel and assets.

Question 44: In Certified Security Manager, how should incident investigation & analysis results be communicated to stakeholders?

Through clear, structured reports with actionable recommendations (Correct answer)
Only when specifically requested
Verbally without written documentation
Using technical jargon without explanation

Correct answer: Through clear, structured reports with actionable recommendations

Clear, structured reports with actionable recommendations ensure stakeholders understand findings and can take appropriate action.

Question 45: Which factor BEST indicates mastery of fire prevention & protection in Certified Security Manager?

Number of certifications held
The ability to adapt knowledge and skills to varying contexts while maintaining standards (Correct answer)
Speed of task completion
Years of experience in a single setting

Correct answer: The ability to adapt knowledge and skills to varying contexts while maintaining standards

True mastery is demonstrated by the ability to apply knowledge flexibly across different contexts while consistently maintaining quality standards.

Question 46: How does ongoing professional development support regulatory compliance & standards in Certified Security Manager?

It only benefits entry-level professionals
It replaces the need for formal compliance audits
It keeps professionals informed of evolving standards and best practices (Correct answer)
It is irrelevant to compliance outcomes

Correct answer: It keeps professionals informed of evolving standards and best practices

Ongoing professional development ensures that practitioners stay current with evolving regulations, standards, and best practices in their field.

Question 47: What is the significance of a security breach response plan?

To prevent all possible security breaches.
To restrict access to sensitive information.
To delay addressing security incidents until further analysis.
To ensure that the organization responds effectively to security breaches (Correct answer)

Correct answer: To ensure that the organization responds effectively to security breaches

A security breach response plan is significant because it provides a structured, predefined course of action for an organization to follow when a security incident occurs. This plan ensures a swift, coordinated, and effective response, minimizing damage, containing the breach, and facilitating recovery, which is critical for business continuity and reputation management.

Question 48: When adapting training & awareness programs for diverse learners in Certified Security Manager, what is MOST important?

Reducing content to the lowest common level
Using a single standardized approach for all learners
Offering multiple formats and accommodating different learning needs and styles (Correct answer)
Focusing only on advanced learners

Correct answer: Offering multiple formats and accommodating different learning needs and styles

Offering multiple formats and accommodating different needs ensures all learners can access and benefit from the educational content.

Question 49: Why is staff training important in security risk management?

It is unnecessary if the organization has enough security personnel.
It ensures employees are prepared to prevent and respond to security threats (Correct answer)
It focuses on reducing staff workload.
It allows staff to bypass security protocols.

Correct answer: It ensures employees are prepared to prevent and respond to security threats

Staff training is paramount in security risk management because employees are often the first line of defense and can also be the weakest link. Proper training ensures that all personnel understand security policies, recognize potential threats like phishing, and know how to prevent and respond to security incidents effectively, thereby strengthening the organization's overall security posture.

Question 50: Which constitutional amendment is most directly relevant when evaluating Fourth Amendment protections against searches conducted by private security personnel?

The Fifth Amendment governs all security searches
Private security searches are generally not subject to Fourth Amendment restrictions (Correct answer)
State law always overrides constitutional protections for private searches
The Fourth Amendment applies equally to private security and police

Correct answer: Private security searches are generally not subject to Fourth Amendment restrictions

The Fourth Amendment protects against unreasonable searches only by government actors (state action doctrine), so private security searches generally are not constitutionally restricted, though they may face civil or statutory liability.

Question 51: What is the main purpose of an assembly point during an evacuation?

Allow employees to resume normal work
Distribute media statements
Hold a debriefing on root cause
Account for all personnel and visitors (Correct answer)

Correct answer: Account for all personnel and visitors

Assembly points allow headcounts to identify who may still be inside and need rescue.

Question 52: In Certified Security Manager, how does fire prevention & protection contribute to professional credibility?

By demonstrating competence, maintaining standards, and delivering consistent results (Correct answer)
By avoiding challenging situations
Through the number of years in practice alone
By using impressive terminology

Correct answer: By demonstrating competence, maintaining standards, and delivering consistent results

Professional credibility is built through demonstrated competence, consistent adherence to standards, and reliable delivery of quality results.

Question 53: What is the recommended FIRST step when a safety concern is identified in a Certified Security Manager setting?

Address it only if required by regulation
Wait for the next scheduled inspection
Document the concern and notify the appropriate supervisor (Correct answer)
Ignore it if no one has been injured

Correct answer: Document the concern and notify the appropriate supervisor

Immediately documenting the concern and notifying the supervisor ensures timely action and creates an official record for tracking and resolution.

Question 54: Which communication path is considered MOST resilient for alarm signal transmission from a protected site to a monitoring center?

Traditional landline (POTS) only
Cellular-only transmission
Wi-Fi only
Dual-path communication using both cellular and IP/broadband simultaneously (Correct answer)

Correct answer: Dual-path communication using both cellular and IP/broadband simultaneously

Dual-path communication uses two independent transmission technologies simultaneously, so if one path is cut or jammed, the other still delivers the alarm signal.

Question 55: What is the role of leadership during a crisis?

To wait for others to take charge.
To avoid making decisions under pressure.
To delegate tasks without providing guidance.
To lead with direction and provide clear instructions (Correct answer)

Correct answer: To lead with direction and provide clear instructions

During a crisis, leadership's role is critical to provide clear direction and decisive instructions, guiding the organization through uncertainty. Effective leaders instill confidence, ensure coordinated efforts, and make timely decisions, which are essential for minimizing damage and navigating the complex challenges posed by an emergency situation.

Question 56: Which alarm system component is responsible for transmitting alarm signals from a protected site to a central monitoring station?

Siren/strobe
Motion sensor
Keypad
Control panel (alarm communicator) (Correct answer)

Correct answer: Control panel (alarm communicator)

The alarm control panel processes sensor inputs and uses a communicator (cellular, IP, or phone line) to transmit alarm signals to an off-site central monitoring station.

Question 57: Which CCTV camera type is BEST suited for monitoring a large open parking lot that requires wide-area coverage?

Pan-Tilt-Zoom (PTZ) camera (Correct answer)
Pinhole covert camera
Fixed dome camera
Infrared bullet camera

Correct answer: Pan-Tilt-Zoom (PTZ) camera

PTZ cameras can be remotely directed and zoomed to cover large areas and track moving subjects, making them ideal for expansive open spaces like parking lots.

Question 58: A security manager learns that an employee has been taken hostage at a remote site. What should be the manager's first priority?

Issue a company-wide email describing the situation
Notify law enforcement and activate the crisis management team (Correct answer)
Wait for further information before acting
Negotiate directly with the hostage taker

Correct answer: Notify law enforcement and activate the crisis management team

Law enforcement has trained negotiators, and the crisis team must be activated to coordinate organizational support.

Question 59: A ballistic vest is rated for bullets. Which statement about stab protection is accurate?

Stab threats are irrelevant for armor
All ballistic vests also stop knives
Stab protection is automatic at Level II
Ballistic vests give no stab protection unless separately certified for it (Correct answer)

Correct answer: Ballistic vests give no stab protection unless separately certified for it

Ballistic and stab/spike protection are tested to different standards, so a vest needs separate certification for edged-weapon threats.

Question 60: What is 'alarm fatigue' and why is it a concern for security managers?

Electrical wear on alarm hardware from frequent activation
Desensitization of security staff to alarms due to excessive false positives, leading to delayed or missed real incident responses (Correct answer)
Employee complaints about alarm noise levels
Physical exhaustion of alarm technicians from installing too many devices

Correct answer: Desensitization of security staff to alarms due to excessive false positives, leading to delayed or missed real incident responses

Alarm fatigue occurs when high false alarm rates cause staff to discount or delay responding to alarms, creating a dangerous gap where real threats may go unaddressed.

Question 61: A single loss event is estimated at $50,000 and is expected to occur once every five years. What is the annualized loss expectancy (ALE)?

$50,000
$10,000 (Correct answer)
$5,000
$250,000

Correct answer: $10,000

ARO is 0.2, so ALE = $50,000 × 0.2 = $10,000.

Question 62: Which incident investigation & analysis method provides the MOST reliable results in Certified Security Manager?

Single-point assessments without follow-up
Informal observation without documentation
Assessments based solely on self-reporting
Standardized protocols with validated measurement tools (Correct answer)

Correct answer: Standardized protocols with validated measurement tools

Standardized protocols and validated tools ensure consistency, reliability, and comparability of assessment results.

Question 63: Which physical security assessment technique involves an authorized person attempting to bypass access controls to identify vulnerabilities?

Vulnerability scan
Risk register update
Red team/penetration test (Correct answer)
Security audit

Correct answer: Red team/penetration test

A physical penetration test (red team exercise) simulates real attacker techniques to uncover weaknesses in physical controls before malicious actors exploit them.

Question 64: When positioning CCTV cameras to capture facial recognition-quality images at an entrance, which camera placement is MOST effective?

Eye-level or slightly above, angled toward approaching subjects with adequate lighting (Correct answer)
Wide-angle lens covering the entire lobby from a corner
Behind the subject as they pass through
High overhead angle looking straight down

Correct answer: Eye-level or slightly above, angled toward approaching subjects with adequate lighting

Cameras positioned at or slightly above eye level, facing approaching subjects with adequate frontal lighting, capture the facial detail needed for identification and forensic use.

Question 65: Under ANSI/ISEA 107, which high-visibility garment class is intended for workers with the highest risk, such as near traffic over 50 mph or in low visibility?

Class 2
Class E
Class 3 (Correct answer)
Class 1

Correct answer: Class 3

Class 3 garments provide the greatest visibility, with sleeves and pants coverage, for high-speed or low-visibility conditions.

Question 66: Which marking on safety eyewear indicates high-impact protection under ANSI Z87.1?

Z87
S
D3
Z87+ (Correct answer)

Correct answer: Z87+

The plus sign on Z87+ shows the eyewear passed the high-impact test.

Question 67: What is the purpose of 'tamper detection' features built into security sensors and control panels?

To measure temperature fluctuations near sensors
To detect unauthorized attempts to disable, remove, or modify the security device itself (Correct answer)
To log user keypad entries for auditing
To test battery backup systems

Correct answer: To detect unauthorized attempts to disable, remove, or modify the security device itself

Tamper detection triggers an alert when someone attempts to open, remove, or interfere with a security device, providing a meta-layer of protection for the security system itself.

Question 68: How can organizations prepare for future crises?

By ignoring minor issues until they escalate.
By reducing the size of their workforce.
By focusing solely on post-crisis evaluations.
By preparing with proactive plans, drills, and clear protocols (Correct answer)

Correct answer: By preparing with proactive plans, drills, and clear protocols

Organizations can prepare for future crises by adopting a proactive approach that includes developing comprehensive plans, conducting regular drills and exercises, and establishing clear protocols. This continuous preparation builds resilience, familiarizes staff with response procedures, and allows for the identification and correction of weaknesses before an actual event occurs.

Question 69: When conducting a environmental health & safety review in Certified Security Manager, which approach yields the BEST results?

Informal observation without documentation
Reviewing only incidents from the past month
Systematic analysis using established frameworks and checklists (Correct answer)
Focusing exclusively on equipment checks

Correct answer: Systematic analysis using established frameworks and checklists

Systematic analysis using established frameworks ensures comprehensive coverage of all potential risks and provides consistent, reliable results.

Question 70: Which CPTED principle is applied by placing office windows to overlook a parking lot?

Access control
Territorial reinforcement
Target hardening
Natural surveillance (Correct answer)

Correct answer: Natural surveillance

Natural surveillance increases the chance that legitimate users observe and deter unwanted activity.

Question 71: Which type of exercise places participants in a discussion of a scenario without deploying actual resources?

Live drill
Tabletop exercise (Correct answer)
Functional exercise
Full-scale exercise

Correct answer: Tabletop exercise

A tabletop exercise is a discussion-based walkthrough of a scenario with no equipment deployed.

Question 72: Which documentation is MOST critical when implementing hazard identification & assessment protocols in Certified Security Manager?

Vendor contact lists
Marketing materials
Employee vacation schedules
Incident response plans and emergency procedures (Correct answer)

Correct answer: Incident response plans and emergency procedures

Incident response plans and emergency procedures are the most critical documentation for safety protocols, as they guide action during emergencies.

Question 73: How does training help in emergency response and crisis management?

It reduces the need for external support.
It provides knowledge on how to manage finances during a crisis.
It prepares staff to respond quickly and follow procedures (Correct answer)
It allows staff to act without any direction.

Correct answer: It prepares staff to respond quickly and follow procedures

Training is essential in emergency response and crisis management because it equips staff with the necessary knowledge and skills to act quickly and correctly under pressure. By practicing procedures and understanding their roles, employees can respond effectively, follow established protocols, and contribute to minimizing the impact of an emergency, rather than reacting haphazardly.

Question 74: An intrusion detection system (IDS) generates a 'false positive.' This means:

A camera lost connectivity
An alarm was triggered when no actual intrusion occurred (Correct answer)
The system failed to power on
A real intrusion was not detected

Correct answer: An alarm was triggered when no actual intrusion occurred

A false positive occurs when the system triggers an alarm in the absence of an actual threat, wasting response resources and potentially causing alarm fatigue.

Question 75: A security manager is evaluating armor for officers facing rifle threats. Which armor type is generally required?

A stab-resistant vest
Level IIIA soft vest
Level II soft vest
Hard armor plates rated Level III or IV (Correct answer)

Correct answer: Hard armor plates rated Level III or IV

Rifle threats require rigid plates rated Level III or IV, since soft armor does not stop rifle rounds.

Question 76: Under the ASIS International standards, the 'defense in depth' principle in physical security refers to:

Burying security cables underground
Conducting background checks at multiple levels
Installing the deepest possible vault doors
Layering multiple security controls so that failure of one does not compromise the entire system (Correct answer)

Correct answer: Layering multiple security controls so that failure of one does not compromise the entire system

Defense in depth uses multiple overlapping security layers so that an attacker must defeat several controls, reducing the likelihood of a successful breach.

Question 77: Who is ultimately accountable for accepting residual risk in an organization?

Senior management or the designated risk owner (Correct answer)
The IT help desk
The security guard supervisor
The external auditor

Correct answer: Senior management or the designated risk owner

Risk acceptance is a business decision made by those with authority over the affected assets and budget.

Question 78: Why are emergency notification systems commonly designed to use multiple channels such as SMS, email, and PA announcements?

It prevents employees from sharing the message
Redundancy increases the likelihood that everyone receives the alert (Correct answer)
It eliminates the need for evacuation drills
It reduces the cost of each message

Correct answer: Redundancy increases the likelihood that everyone receives the alert

Multiple channels ensure alerts reach people even if one channel fails or is unavailable.

Question 79: Why is it important to review and update emergency response plans regularly?

It reduces the cost of response efforts.
It focuses only on external response.
It keeps the plan relevant and effective (Correct answer)
It ensures the plan does not need to be implemented.

Correct answer: It keeps the plan relevant and effective

Regularly reviewing and updating emergency response plans is critical because circumstances, resources, and potential threats can change over time. This ensures the plan remains relevant, accurate, and effective in addressing current risks and operational realities. An outdated plan can lead to confusion and ineffective responses during an actual emergency.

Question 80: Which element is ESSENTIAL for an effective regulatory compliance & standards program in Certified Security Manager?

Regular audits and continuous monitoring processes (Correct answer)
Compliance responsibility assigned to one individual only
Annual review without interim checks
Documentation stored without regular updates

Correct answer: Regular audits and continuous monitoring processes

Regular audits and continuous monitoring enable early detection of compliance gaps and ensure ongoing adherence to standards.

Question 81: According to ASIS standards, what is the recommended action when an employee's access card is reported lost or stolen?

Deactivate the card after 24 hours as a grace period
Transfer the card's access level to a temporary badge
Immediately deactivate the card and issue a replacement after identity verification (Correct answer)
Wait for the employee to request a new card

Correct answer: Immediately deactivate the card and issue a replacement after identity verification

Immediate deactivation eliminates the window of opportunity for unauthorized use, while re-issuance after verification ensures the legitimate user regains access quickly.

Question 82: When facing an unfamiliar challenge in fire prevention & protection within Certified Security Manager, what is the BEST approach?

Attempt to resolve it independently without consultation
Apply the most familiar technique regardless of suitability
Research established best practices, consult colleagues, and document the approach (Correct answer)
Avoid the challenge if possible

Correct answer: Research established best practices, consult colleagues, and document the approach

Researching best practices and consulting colleagues combines established knowledge with practical experience, while documentation supports future reference.

Question 83: A warehouse holds assets valued at $400,000. A fire would be expected to destroy 25% of them. What is the single loss expectancy?

$100,000 (Correct answer)
$25,000
$300,000
$160,000

Correct answer: $100,000

SLE = asset value × exposure factor = $400,000 × 0.25.

Question 84: When an employee is terminated for cause, when should their access be removed?

After the exit interview next week
At the end of the pay period
Once equipment is returned
At or before the time they are notified (Correct answer)

Correct answer: At or before the time they are notified

Access should be disabled at or before notification to prevent sabotage, theft, or data removal.

Question 85: Which document defines how an organization will continue critical operations at an alternate site after a facility is rendered unusable?

Access control matrix
Visitor management policy
Business continuity plan (Correct answer)
Security awareness program

Correct answer: Business continuity plan

A business continuity plan documents strategies and procedures to keep critical functions running during and after a disruption.

Question 86: Why is it important to regularly update security policies and procedures?

It is only necessary after a major security incident.
It is irrelevant as long as the organization is compliant.
It helps the organization stay prepared and mitigate evolving risks (Correct answer)
It only applies to large organizations.

Correct answer: It helps the organization stay prepared and mitigate evolving risks

Regularly updating security policies and procedures is crucial because the threat landscape, technology, and business operations are constantly evolving. Outdated policies can leave an organization vulnerable to new attack vectors or compliance gaps. Keeping them current ensures the organization remains prepared, adapts to emerging risks, and maintains an effective security posture.

Question 87: What is the MOST effective way to stay current with developments in fire prevention & protection for Certified Security Manager?

Reading only internal communications
Participating in professional development, industry events, and peer collaboration (Correct answer)
Following a single expert opinions
Relying on experience gained early in career

Correct answer: Participating in professional development, industry events, and peer collaboration

A multi-faceted approach including formal development, industry events, and peer collaboration provides the broadest perspective on current developments.

Question 88: During a building evacuation, what is the primary responsibility of a floor warden?

Confirm the floor is cleared and report status to the incident commander (Correct answer)
Shut down all servers on the floor
Interview employees about the cause of the incident
Fight the fire until the fire department arrives

Correct answer: Confirm the floor is cleared and report status to the incident commander

Floor wardens direct occupants out, sweep the area, and report evacuation status without placing themselves at risk.

Question 89: In Certified Security Manager, how does workplace ergonomics & health contribute to professional credibility?

By using impressive terminology
Through the number of years in practice alone
By demonstrating competence, maintaining standards, and delivering consistent results (Correct answer)
By avoiding challenging situations

Correct answer: By demonstrating competence, maintaining standards, and delivering consistent results

Professional credibility is built through demonstrated competence, consistent adherence to standards, and reliable delivery of quality results.

Question 90: What is the importance of post-crisis evaluation?

It helps prevent future planning mistakes.
It provides valuable lessons for future crisis management (Correct answer)
It focuses on financial compensation.
It ensures no crisis will occur again.

Correct answer: It provides valuable lessons for future crisis management

Post-crisis evaluation is crucial because it allows an organization to analyze its response, identify what worked well, and pinpoint areas for improvement. This reflective process provides invaluable lessons learned, which can then be incorporated into updated plans and training, strengthening future crisis management capabilities and enhancing organizational resilience.

Question 91: What is the first step in conducting a security risk assessment?

Assigning security personnel to the project.
Implementing security measures immediately.
Preparing a report of past security breaches.
Identifying and evaluating the organization's assets (Correct answer)

Correct answer: Identifying and evaluating the organization's assets

The first step in conducting a security risk assessment is identifying and evaluating the organization's assets because you cannot protect what you don't know you have. This involves understanding what is valuable (e.g., data, hardware, personnel, reputation) and where it resides, which then allows for a proper assessment of potential threats and vulnerabilities to those specific assets.

Question 92: Using OSHA's method for a dBA-based estimate, a hearing protector with an NRR of 29 gives roughly what attenuation?

15 dB
22 dB
29 dB
11 dB (Correct answer)

Correct answer: 11 dB

OSHA subtracts 7 dB from the NRR then halves it for dBA, so (29 - 7) / 2 = 11 dB.

Question 93: What should be included in a comprehensive security policy?

It includes guidelines for access control, data protection, and incident response (Correct answer)
It limits employee participation in policy creation.
It focuses only on physical security.
It only includes financial policies.

Correct answer: It includes guidelines for access control, data protection, and incident response

A comprehensive security policy should encompass various critical areas, including guidelines for access control to systems and data, robust data protection measures, and clear protocols for incident response. It provides a holistic framework that addresses different facets of security, ensuring all key areas are covered to protect organizational assets effectively.

Question 94: Why are security procedures important in an organization?

To reduce the organization's security measures.
To increase the complexity of the security system.
To guide employees in implementing security measures effectively (Correct answer)
To restrict staff participation in decision-making.

Correct answer: To guide employees in implementing security measures effectively

Security procedures are important because they translate the broad objectives of security policies into actionable, step-by-step instructions. They guide employees on how to effectively implement security measures, ensuring consistency, reducing errors, and making it clear what actions are required to protect organizational assets and comply with security standards.

Question 95: Why is having access control systems important in asset protection?

It only controls employee access to break rooms.
It limits access to the company’s financial records only.
It focuses solely on cyber threats.
It ensures that only authorized personnel can access secure areas (Correct answer)

Correct answer: It ensures that only authorized personnel can access secure areas

Access control systems are fundamental to asset protection by regulating who can enter specific physical or digital spaces within an organization. These systems, whether using keycards, biometrics, or passwords, verify identities and permissions before granting access. This prevents unauthorized individuals from reaching sensitive assets, thereby significantly reducing the risks of theft, damage, or data breaches.

Question 96: A security manager is sued after a guard injures a bystander while performing duties. Under the doctrine of respondeat superior, who bears primary legal liability?

The client organization only
The individual security officer
The local law enforcement agency
The security employer/company (Correct answer)

Correct answer: The security employer/company

Respondeat superior ('let the master answer') holds employers vicariously liable for torts committed by employees acting within the scope of their employment.

Question 97: When removing contaminated PPE, what is the key principle?

Remove the respirator first always
Remove quickly in any order
Remove in a sequence that avoids contact with contaminated surfaces, typically gloves first (Correct answer)
Leave it on until end of shift

Correct answer: Remove in a sequence that avoids contact with contaminated surfaces, typically gloves first

Doffing in the proper sequence prevents self-contamination, and gloves are usually the most contaminated item removed first.

Question 98: In a layered physical security model, which control serves as the OUTERMOST deterrent layer?

Perimeter fencing and lighting (Correct answer)
Interior motion detectors
Security operations center (SOC)
Server room locks

Correct answer: Perimeter fencing and lighting

Perimeter fencing and lighting form the outermost deterrent layer, establishing a clear boundary and discouraging unauthorized approach before inner controls are encountered.

Question 99: What is the FIRST step in conducting a thorough incident investigation & analysis in Certified Security Manager?

Reviewing previous assessments only
Collecting data without a plan
Defining clear assessment criteria and objectives (Correct answer)
Delegating the assessment to the least experienced team member

Correct answer: Defining clear assessment criteria and objectives

Defining clear criteria and objectives ensures the assessment is focused, consistent, and produces actionable results.

Question 100: A countermeasure costs $30,000 per year and reduces ALE from $80,000 to $40,000. What is the net annual benefit?

$50,000
$30,000
$40,000
$10,000 (Correct answer)

Correct answer: $10,000

Benefit = ($80,000 − $40,000) − $30,000 = $10,000.

Certified Security Manager (CSM) Exam

This certification validates the knowledge and skills of security professionals in managing security operations, risk, and personnel.

100

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

ismi.org.uk — Test delivery, eligibility, exam dates, registration deadline, registration, retake fee, retake policy, test dates, exam format, passing score · verified Nov 2026