Free Associate Protection Professional (APP®) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Associate Protection Professional (APP®) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A security coordinator is consolidating duplicate controls used by several business units. Which management approach best supports consistent implementation and efficient use of shared resources?

   1. A. Manage each control separately within every individual system.
   2. B. Manage selected controls centrally across the organization.
   3. C. Transfer each control's management to its equipment supplier.
   4. D. Assign control management independently to each system user.

   Answer: B

   Explanation: NIST explains that central management promotes "standardization of control implementations and management and the judicious use of organizational resources." Shared management addresses duplication across business units.

   Reference: Security and Privacy Controls for Information Systems and Organizations — PL-9, Central Management, page 200

2. 2A security services company's balance sheet shows assets of $360,000 and liabilities of $240,000. What is its equity?

   1. A. $600,000
   2. B. $360,000
   3. C. $120,000
   4. D. $240,000

   Answer: C

   Explanation: SBA states, "Assets = Liabilities + Equity." Equity is $360,000 − $240,000 = $120,000. Adding gives $600,000; the other values repeat assets or liabilities rather than calculating equity.

   Reference: Glossary of Business Financial Terms — Balance Sheet or Statement of Financial Position

3. 3A coordinator assesses the risk of an event that could disrupt a security operation. Which pair of factors generally controls the level of risk?

   1. A. Threat-source capability and intent
   2. B. Vulnerability severity and control effectiveness
   3. C. Event likelihood and severity of adverse impact
   4. D. Organizational risk tolerance and risk capacity

   Answer: C

   Explanation: NIST describes risk as a function of "the adverse impacts that would arise if the circumstance or event occurs" and "the likelihood of occurrence." Threat attributes and vulnerability/control characteristics inform risk analysis, while tolerance and capacity guide decisions about exposure; likelihood and consequence are the stated pair defining the risk level.

   Reference: Guide for Conducting Risk Assessments — Section 2.3, Key Risk Concepts, page 6

4. 4A security responder is receiving conflicting task directions from two incident supervisors. Which NIMS principle establishes that the responder should report to one person?

   1. A. Unified Command
   2. B. Unity of command
   3. C. Area Command
   4. D. Joint information management

   Answer: B

   Explanation: NIMS states, “Unity of command means that each individual only reports to one person.” It clarifies the responder's reporting relationship. Unified Command jointly establishes incident direction, Area Command oversees multiple incidents, and joint information management coordinates information rather than individual reporting lines.

   Reference: National Incident Management System — Chain of Command and Unity of Command, p. 23

5. 5While organizing a new security program, a coordinator needs a predefined set of controls to use as a starting point before adapting protection to business needs. What should the coordinator select?

   1. A. A compensating security control
   2. B. A common security control
   3. C. A security control enhancement
   4. D. A security control baseline

   Answer: D

   Explanation: NIST states, "Control baselines are predefined sets of controls specifically assembled to address the protection needs of a group, organization, or community of interest." A baseline is the starting set; common controls, compensating controls, and enhancements describe other control concepts.

   Reference: Security and Privacy Controls for Information Systems and Organizations — PL-10, Baseline Selection, page 201

6. 6A security services company signs a customer contract in January, completes the sale in February, issues the invoice in March, and receives payment in April. Under the accrual method described by SBA, when should the sale be recorded?

   1. A. January
   2. B. February
   3. C. March
   4. D. April

   Answer: B

   Explanation: SBA states, "The accrual method puts transactions on the books immediately upon completing the sale." Completion occurs in February. Contract signing, invoice issuance, and payment are real transaction milestones, but the specified accrual recognition event is completion, not those other dates.

   Reference: Manage Your Business—Manage Your Finances — Manage Your Finances—Pick a Method of Accounting

7. 7Before starting a risk assessment, a coordinator must document its purpose. Which statement best defines that purpose?

   1. A. The information the assessment must produce and the decisions it must support.
   2. B. The buildings and systems included within the assessment boundary.
   3. C. The budget and completion deadline assigned to the assessment team.
   4. D. The numerical scales used to describe the assessment's risk factors.

   Answer: A

   Explanation: NIST directs, "Identify the purpose of the risk assessment in terms of the information that the assessment is intended to produce and the decisions the assessment is intended to support." Boundaries, constraints, and scales are other preparation considerations.

   Reference: Guide for Conducting Risk Assessments — Task 1-1, Identify Purpose, page 24

8. 8An incident organization has not yet appointed a Logistics Section Chief. Who retains responsibility for that function until it is delegated?

   1. A. The Planning Section Chief
   2. B. The Operations Section Chief
   3. C. The Finance/Administration Section Chief
   4. D. The Incident Commander or Unified Command

   Answer: D

   Explanation: NIMS states, "These functions default to the Incident Commander or Unified Command until a section chief is assigned." The unassigned Logistics function therefore remains with command. The other three section chiefs are genuine General Staff positions, but their own assignments do not automatically give them the unassigned Logistics responsibility.

   Reference: National Incident Management System — General Staff section

9. 9A business has selected a security control baseline, but its operating environment and threats differ from the baseline assumptions. Which process customizes that baseline to the organization's circumstances?

   1. A. Baseline tailoring
   2. B. Control inheritance
   3. C. System authorization
   4. D. Incident containment

   Answer: A

   Explanation: NIST says, "The concept of tailoring allows organizations to specialize or customize a set of baseline controls by applying a defined set of tailoring actions." Tailoring addresses the differences described.

   Reference: Security and Privacy Controls for Information Systems and Organizations — PL-11, Baseline Tailoring, page 201

10. 10A proposed security improvement has first-year benefits of $90,000, an installation cost of $25,000, and first-year operating costs of $15,000. Ignoring discounting and other cash flows, what is the first-year net benefit?

    1. A. $65,000
    2. B. $90,000
    3. C. $40,000
    4. D. $50,000

    Answer: D

    Explanation: SBA describes CBA as "subtracting costs from benefits to determine success in terms of dollars." Net benefit is $90,000 − $25,000 − $15,000 = $50,000. $65,000 omits operating costs; $90,000 omits all costs; $40,000 reports costs rather than net benefit.

    Reference: Manage Your Business—Manage Your Finances — Manage Your Finances—Cost-benefit Analysis