Free Certified Protection Professional (CPP®) exam Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Certified Protection Professional (CPP®) exam practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Under enterprise security risk management (ESRM), who makes the decision about managing risk to an organizational asset?

   1. A. The security professional advising on that asset
   2. B. The asset owner responsible for that asset
   3. C. The auditor reviewing the security program
   4. D. The vendor implementing the selected controls

   Answer: B

   Explanation: The article states, "ESRM places the responsibility for security risk management decision making with the asset owners." Security advises the decision, while the asset owner owns it.

   Reference: A Brief Guide to ESRM Implementation — How ESRM Works

2. 2When presenting a proposed security budget to leadership, what should determine how the request is framed?

   1. A. Only the list price of the requested equipment
   2. B. Organizational goals and quantified security risks
   3. C. The previous year's spending with no adjustment
   4. D. The security department's preferred vendor

   Answer: B

   Explanation: ASIS states, "The foundation of an effective security budget begins with understanding its scope and alignment with organizational goals and quantified risks." This gives leadership the business basis for the request.

   Reference: Speaking the C-Suite Language: A Strategic Approach to Security Budgeting — Step 1: Building a Strategic Framework

3. 3Which principle helps an organizational investigation avoid a predetermined finding?

   1. A. Impartial fact-based analysis
   2. B. Exclusive reliance on the complainant's view
   3. C. Delayed documentation until litigation
   4. D. Automatic preference for management's account

   Answer: A

   Explanation: ASIS identifies "impartiality, independence, fact-based analysis, timeliness, and confidentiality" as guiding principles. An impartial, fact-based inquiry does not begin with a predetermined conclusion.

   Reference: ASIS Investigations Standard — About the Standard

4. 4A security director is establishing a preemployment screening program. Which design element makes the program governable across positions?

   1. A. Clear objectives, policies, procedures, and processes
   2. B. A separate ad hoc check selected by each interviewer
   3. C. The same unreviewed source for every role and risk
   4. D. A hiring decision before any screening criteria exist

   Answer: A

   Explanation: ASIS states that organizations should develop a screening program "with clear objectives, policies, procedures and processes that comply with legal, regulatory and contractual obligations." Documented criteria make the program consistent and reviewable.

   Reference: Preemployment Background Screening and Vetting — About the Guideline

5. 5A facility survey is being commissioned before any new security design. What should the survey first establish?

   1. A. The current state of the site's systems and conditions
   2. B. The desired final design before observing existing systems
   3. C. The old design intent without checking installed conditions
   4. D. The vendor's installation template for a new system

   Answer: A

   Explanation: ASIS says site surveys can serve by "documenting and mapping a system’s current state". Establishing the actual baseline precedes decisions about changes.

   Reference: The Critical Role of the Site Survey — The Critical Role of the Site Survey

6. 6An information security survey needs a baseline and a desired posture. Which CSF mechanism describes both in terms of cybersecurity outcomes?

   1. A. Organizational Profiles
   2. B. An asset inventory lacking target outcomes
   3. C. An incident log of past events only
   4. D. A risk register without target CSF outcomes

   Answer: A

   Explanation: NIST defines "CSF Organizational Profiles" as "A mechanism for describing an organization’s current and/or target cybersecurity posture in terms of the CSF Core’s outcomes." Profiles provide the survey's baseline and target.

   Reference: NIST CSF 2.0: Resource & Overview Guide — What is the CSF 2.0?; CSF Organizational Profiles

7. 7An organization is beginning crisis threat assessment for continuity planning. Which combination starts the process described by ASIS?

   1. A. Risk assessment and business impact analysis
   2. B. Risk assessment without examining business disruption
   3. C. Business impact analysis without evaluating threats
   4. D. Selection of recovery options before either assessment

   Answer: A

   Explanation: ASIS states, "The process begins with a risk assessment and business impact analysis, keeping in mind the objectives of the organization." Both risk and business impact frame the planning work.

   Reference: Business Continuity Management Guideline — About the Guideline

8. 8What role does a security professional take when applying ESRM with asset owners?

   1. A. An independent approver of every asset decision
   2. B. An enforcer who unilaterally sets risk tolerance
   3. C. An advisor who guides security risk decisions
   4. D. An auditor who avoids operational discussions

   Answer: C

   Explanation: The source says the security professional "supports and guides asset owners through the security risk management decision-making process." This is an advisory role, not unilateral ownership of the risk decision.

   Reference: A Brief Guide to ESRM Implementation — How ESRM Works

9. 9In a security investment analysis, what does return on investment (ROI) compare?

   1. A. Training hours with staffing vacancies
   2. B. Annual incidents with total headcount
   3. C. Financial benefits realized with costs incurred
   4. D. Asset age with the procurement cycle

   Answer: C

   Explanation: The ASIS article states, "In the context of security, ROI refers to the financial benefits realized from investing in security measures compared to the costs incurred." The other pairs are possible operational metrics, not ROI.

   Reference: How to Measure Your Security and Resilience ROI — Focus on Metrics: Measuring and Communicating Effectiveness

10. 10When establishing an investigations program, which management action does the ASIS standard overview describe?

    1. A. Define investigation goals without program policies or monitoring
    2. B. Defining objectives and policies and monitoring the process
    3. C. Monitor case counts without setting investigation objectives
    4. D. Handle cases individually without a managed program

    Answer: B

    Explanation: ASIS describes program management as "from defining objectives and policies to monitoring and continuously improving investigative processes." A managed program needs both direction and review.

    Reference: ASIS Investigations Standard — About the Standard