ASIS CPP Certification Sample Questions

01. Two weeks after a violent incident at a facility, operations have resumed but absenteeism and resignations among the staff who were present are rising. Which resource does the recovery phase call for?
a) Refresher training for the operational staff on duty
b) A financial audit of the losses the incident caused
c) Employee assistance and counseling support for affected staff
d) Additional physical security measures at the affected facility

02. A fire is burning in a warehouse on a manufacturing site. The fire service's incident commander is directing crews at the scene, and the organization has activated its emergency operations center. What is the center's role while the incident is running?
a) To hold the organization's data backups so that operations can be restored when the scene is released.
b) To record the decisions taken at the scene so that the after-action review has an accurate account.
c) To direct the tactical assignments of the crews at the scene from one consolidated position off site.
d) To coordinate resources and information in support of the response at the scene.

03. An information security program holds a vulnerability scan of every system and has no basis for deciding which findings to fund first. The steering group asks how the threats to the organization's information holdings should be evaluated.
What has to be weighed?
a) The controls each system lacks against the published baseline, weighed against the cost of closing them.
b) The consequence of a holding being compromised, weighed against the likelihood a threat reaches it.
c) The severity score the scanning tool assigns each finding, weighed against the effort needed to remediate it.
d) The number of incidents the organization has recorded historically, weighed against the number its peers report.

04. A distribution center's continuity plan names a company-owned warehouse on the same industrial estate as the location operations will move to after a disruption. The security director is asked to endorse the arrangement before the plan goes to the board.
What most weakens it?
a) The proposed site is open to the same events as the one it would replace
b) The proposed site holds no equipment reserved for the operation
c) The proposed site has never been used for distribution work before
d) The proposed site is company-owned rather than leased from a provider

05. A utility's substation sits within several hundred acres of undeveloped land, and most of the boundary has neither power nor communications. The site owner wants periodic observation of the whole boundary rather than continuous coverage of a few points.
Which surveillance method best fits those conditions, subject to the aviation and privacy rules where the site operates?
a) A roving patrol driving the boundary on an irregular schedule
b) Buried sensors along the sections with the highest recorded intrusion
c) Scheduled unmanned aircraft flights over the full boundary
d) Fixed cameras at the points where infrastructure already reaches

06. An investigator is preparing to interview an employee who was present when stock went missing. The manager who reported the loss has already named that employee as responsible. What is the objective of the interview?
a) To obtain an objective account of what the employee observed
b) To identify the countermeasures that would prevent the next loss of stock
c) To record the chain of custody that the recovered property will follow
d) To confirm the account the manager gave about the employee he named

07. A physical security upgrade is being designed for a building whose occupants include a research group with restricted areas and a public-facing reception. The project manager wants to run the design without involving them.
Why should the occupants be engaged during design?
a) Because consultation now removes the design review the project would otherwise have to schedule later.
b) Because the design has to be aligned with how they actually work, or it will be defeated in daily use.
c) Because their agreement recorded during design limits the changes they are able to request once work starts.
d) Because their approval moves responsibility for the outcome of the upgrade to the departments affected.

08. An organization that has handled incidents case by case is writing its first investigation policy. What is the first step in developing it?
a) Training the workforce in the investigative techniques the unit must use
b) Contracting an external firm to handle investigations the unit cannot
c) Identifying the incident types the organization must investigate
d) Publishing the policy so that all employees are on notice of it

09. A hiring manager objects that background investigation is delaying recruitment for a role that handles cash and holds keys to the building. The security director has to state what the screening is for. What purpose should the director give?
a) To apply the deepest checks available to every candidate, so that the standard cannot be called selective.
b) To confirm the candidate meets the requirements this role and its governing regulations impose on the holder.
c) To assess the personality characteristics that predict how a candidate will behave under pressure in the role.
d) To reduce training cost by identifying the candidates who will need the least supervision once in post.

10. Ransomware is encrypting files on a production server. The organization intends both to resume operations and to preserve its ability to establish what happened. What should the response do first?
a) Open communication with the actor to establish what recovery would cost
b) Power the affected hosts down immediately in order to stop the encryption
c) Restore the server from backup so operations resume without delay
d) Isolate the affected hosts from the network while preserving their state