ASIS-CPP Practice Questions

Zero-based budgeting (ZBB) is a method where all expenses must be justified for each new budget period, starting from a "zero base." This is fundamentally different from traditional incremental budgeting, which uses the previous period's budget as the baseline. The core process of ZBB requires managers to meticulously evaluate every function within their department, analyzing its needs and costs as if it were a new initiative. This rigorous justification process forces them to challenge existing practices, re-evaluate priorities, and actively seek more efficient or cost-effective alternatives to accomplish their objectives. This critical review and consideration of alternatives is a primary advantage of the ZBB approach.

B. This describes incremental budgeting, where existing programs are often funded by default with minor adjustments, which is the opposite of the ZBB philosophy.

C. This is a characteristic of incremental budgeting. In ZBB, managers must justify all budget items, both old and new, from scratch.

D. While ZBB can identify inefficient programs, their elimination is a management decision based on the review, not an automatic consequence of the process.

1. ASIS International. (2021). Protection of Assets (POA): Business Principles. Alexandria

VA: ASIS International. In the chapter on Financial Management

the section on Budgeting Methods explains that ZBB requires a complete justification of all programs and expenditures for each budget cycle

forcing a review of operations and alternatives.

2. Pyhrr

P. A. (1977). The Zero-Base Approach to Government Budgeting. Public Administration Review

37(1)

1–8. https://doi.org/10.2307/974503. On page 2

Pyhrr

the originator of the ZBB concept

states

"Zero-base budgeting requires each organization to evaluate and review all programs and activities systematically... [and] requires managers to identify and evaluate alternative methods of accomplishing objectives."

3. Dean

B. V.

& Cowen

S. S. (1979). The Use of Zero-Base Budgeting in Industry. The Journal of the Operational Research Society

30(11)

1021-1026. https://doi.org/10.2307/3009519. This paper highlights that a key benefit of ZBB is that it "forces an organization to examine alternative ways of providing services and performing activities" (p. 1023).

The process of rating risk in any security discipline, including executive protection, is fundamentally based on two factors: the likelihood of an adverse event and the potential impact (or consequence) of that event. "Threat likelihood" directly addresses the probability component. "Threat analysis" is the systematic evaluation of a threat's capabilities, intentions, and past activities to determine the potential severity and nature of an attack. This analysis directly informs the impact component of the risk equation. By combining the likelihood of a threat with a thorough analysis of its potential impact, a protection specialist can assign a rating (e.g., low, medium, high) to the risk.

A. Threat transfer and threat spreading are risk treatment strategies used to manage risk after it has been rated, not factors used to rate it.

B. Threat avoidance and threat mitigation are also methods of risk treatment or control, which are actions taken in response to a risk assessment.

D. Threat control is a risk management strategy, and "threat hazards" is a redundant term related to the identification phase, not the analysis or rating phase.

1. ASIS International. (2021). Protection of Assets (POA). Security Management volume

Chapter 2: Risk Management. This foundational text explains that risk analysis

a core part of risk assessment

involves developing an estimate of the likelihood and consequences of a risk event. This directly corresponds to analyzing threat likelihood and impact (derived from threat analysis).

2. ASIS International. (2019). ASIS/ANSI General Security Risk Assessment Guideline (GSRA). Section 5.3: Risk Analysis. The standard specifies that risk analysis involves considering the likelihood of a security incident and the severity of its consequences. "Threat analysis" is the method for determining the potential consequences of an intentional threat

while "threat likelihood" assesses the probability.

3. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. Chapter 4: The Role of Risk

Threat

and Vulnerability Assessments

pp. 78-80. This academic text defines risk as "the potential for loss resulting from a threat." It clarifies that measuring this risk requires assessing both the probability (likelihood) of the threat event and the severity of its impact (consequence)

which is determined through threat analysis.

A cost-benefit analysis (CBA) is a systematic process used to evaluate the financial feasibility of a project or expenditure. In the context of security, it directly compares the cost of implementing a risk control (countermeasure) against the financial benefit derived from the reduction in risk (e.g., averted losses). This analysis provides a quantitative justification for the control's effectiveness and its value, making it the essential tool for defending its inclusion and priority within the security budget. It answers the fundamental business question: "Is this security measure worth the investment?"

A. Probability analysis: This is a component of risk assessment that estimates the likelihood of an event but does not weigh it against the cost of controls.

C. Cyber risk assessment: This is too specific to the cyber domain and, while it identifies risks, it does not inherently include the financial justification for controls.

D. Vulnerability assessment: This process identifies weaknesses and flaws but does not evaluate the economic efficiency or budgetary justification of the controls designed to mitigate them.

1. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. In Chapter 11

"Security and the Business

" the text discusses the necessity of using business tools like cost-benefit analysis to justify security expenditures and demonstrate value to the organization.

2. ASIS International. (2021). Protection of Assets (POA)

Security Management. In Chapter 3

"Financial Management

" the text details the use of cost-benefit analysis as a primary method for evaluating and justifying security countermeasures. It explains that this analysis is crucial for making informed decisions and securing budget approval for security initiatives by demonstrating a positive return on investment.

3. Soo Hoo

K. J. (2000). How to Measure the ROI of Security. Stanford University

Center for International Security and Cooperation (CISAC). This paper outlines the methodology for applying economic analysis to security decisions

emphasizing that cost-benefit analysis is the foundational approach to justify security investments by comparing the reduction in loss expectancy to the cost of the control. (Available through Stanford's CISAC archives).

Establishing an in-house (proprietary) guard service requires the creation of a comprehensive human resources and operational framework. This foundation consists of three critical, interdependent components: a structured recruitment program to attract suitable applicants, rigorous personnel screening procedures to verify qualifications and trustworthiness, and standardized training programs to ensure officers are competent and prepared. These elements are essential for building a professional, reliable, and effective security force from the ground up, forming the core of the service's operational capability and legal defensibility.

A. A separate budget is a necessary financial resource to fund the establishment and operation, but it is not a component of the service itself.

B. A qualified manager is a crucial leadership position, but the establishment of the entire force requires the broader programmatic systems for recruitment, screening, and training.

D. Flexibility is a key advantage or characteristic of an in-house service, not a foundational requirement for its establishment.

1. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. In Chapter 11

"Security Personnel

" the text details the extensive administrative responsibilities of creating a proprietary force

explicitly covering the need to "recruit

select

train

and supervise" personnel (pp. 235-237).

2. ASIS International. (2021). Protection of Assets (POA): Security Management. In the section on "Proprietary Security Officers

" the text outlines the direct employer responsibilities

which inherently include establishing systems for recruitment

pre-employment screening

and providing initial and ongoing training as fundamental to the creation of the force. (Specific chapter/section may vary by edition

but this is a core concept in security management principles).

3. Sennewald

C. A.

& Baillie

C. (2020). Effective Security Management (7th ed.). Butterworth-Heinemann. Chapter 10

"Selecting the Security Staff

" is dedicated to the processes of recruitment

interviewing

and screening. Chapter 11

"Training and Development

" covers the necessity of establishing robust training programs. These chapters collectively affirm that these processes are requirements for establishing a security team.

Following an information loss, a structured incident response is critical. The first logical step is to conduct an investigation to determine the nature, scope, and cause of the loss. Concurrently, the organization must conduct a damage assessment to understand the impact on business operations, finances, reputation, and legal obligations. This assessment informs the prioritization of response efforts. Finally, based on the findings of the investigation and the damage assessment, the organization will implement the recovery plan to restore the lost information, remediate vulnerabilities, and return to normal business operations. This sequence represents a standard, logical progression in incident management.

A. Implementing a business continuity plan is generally for major operational disruptions, not the specific response to information loss. Updating procedures is a post-incident, "lessons learned" activity.

B. Contacting law enforcement is a discretionary step dependent on the nature of the loss and organizational policy; it is not a mandatory initial action in all cases.

D. An inventory of proprietary information should be a pre-existing component of an asset management program, not something conducted after a loss has already occurred.

1. ASIS International

Protection of Assets (POA)

Security Management volume

2021. Chapter 5

"Information Security

" outlines the incident response lifecycle which includes identification/analysis (investigation and assessment)

containment

eradication

and recovery. The sequence in option C directly aligns with this established framework. The process begins with understanding the incident (investigation)

evaluating its impact (damage assessment)

and then moving to restoration (recovery).

2. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. Chapter 14

"Information Security

" discusses the critical steps in responding to a computer security incident. It emphasizes that after detection

an assessment or analysis of the extent of the compromise (damage assessment) is required to formulate a proper response and recovery strategy

which supports the sequence of investigation

assessment

and recovery.

3. National Institute of Standards and Technology (NIST). (2012). Computer Security Incident Handling Guide (Special Publication 800-61 Rev. 2). Section 3.2

"Incident Response Life Cycle

" details the phases of Detection & Analysis

Containment

Eradication & Recovery. The "Detection & Analysis" phase encompasses both the investigation and the assessment of damage

which must precede the "Eradication & Recovery" phase

where a recovery plan is implemented. This foundational document validates the logical flow presented in option C. (DOI: https://doi.org/10.6028/NIST.SP.800-61r2)

The foundation of any effective drug-free workplace program is a formal, written policy. Even without drug testing, a policy that explicitly prohibits the presence of detectable illegal drugs in an employee's system while on duty establishes clear expectations and a legal basis for disciplinary action. This policy serves as the primary tool for managing substance abuse issues through other means, such as supervisory observation and for-cause actions, and communicates the organization's commitment to a safe and productive environment.

A. "Discouraging" use is a vague goal, not an enforceable action. A formal policy is the mechanism that officially discourages and prohibits the behavior.

C. Reporting mere suspicion of impairment to law enforcement is an extreme step, often inappropriate, and can expose the employer to significant legal liability.

D. An Employee Assistance Program (EAP) is a valuable supportive component, but it is not a substitute for a foundational policy that prohibits the conduct in the first place.

1. ASIS International

Protection of Assets (POA)

Security Management. Alexandria

VA: ASIS International

2021.

In the chapter on "Substance Abuse in the Workplace

" the text emphasizes that the first and most critical element of a substance abuse program is a clear

written policy. The policy must state what is prohibited

who is covered

and the consequences of violation. This principle holds true regardless of the testing methods employed.

2. Fischer

R. J.

Halibozek

E.

& Walters

D. C. Introduction to Security

10th Edition. Butterworth-Heinemann

2019.

Chapter 11

"An Introduction to Personnel Security

" discusses the importance of policies governing employee conduct. It states that a comprehensive substance abuse program begins with a formal policy statement that clearly prohibits the use

possession

or being under the influence of illegal drugs in the workplace. This policy is the cornerstone that enables all other program elements. (This text is widely used in university security management programs and aligns with ASIS principles).

3. U.S. Department of Labor

Substance Abuse and Mental Health Services Administration (SAMHSA). "Drug-Free Workplace Toolkit."

While a government source

its principles are universally adopted and taught within the CPP domain. Section 1

"The Basics of a Drug-Free Workplace Program

" states

"A written policy is the foundation of a drug-free workplace program." It is presented as the essential first step before implementing other components like employee education or assistance programs.

An Incident Management System (IMS), such as the Incident Command System (ICS), is a critical and foundational element of any modern emergency response plan. It provides a standardized, flexible, and scalable framework for command, control, and coordination among all responders. The primary purpose of an emergency response plan is to manage the immediate actions required to save lives, stabilize the incident, and protect property. An IMS establishes the necessary organizational structure, roles, responsibilities, and communication protocols to achieve these objectives effectively and efficiently, making it an indispensable component.

A. recovery operation procedures. These procedures are part of the subsequent recovery phase, which focuses on restoring business operations to normal, not the immediate emergency response itself.

C. designating a hot site. This is a specific tactic within a Business Continuity or Disaster Recovery Plan, primarily for IT systems, and is not a universal element of every emergency response plan.

D. shift relief procedure for response personnel. This is an important logistical detail, but it is a sub-component managed within the larger framework provided by the Incident Management System (IMS).

1. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. In Chapter 16

"Emergency Management and Business Continuity

" the text emphasizes the adoption of the National Incident Management System (NIMS) and the Incident Command System (ICS) as the standard for managing emergency response activities. It clearly separates the "Response" phase

which uses ICS

from the "Recovery" phase

which involves restoring operations.

2. ASIS International. (2012). Protection of Assets (POA)

Business Continuity. The POA manual distinguishes between the phases of emergency management. The "Response" section focuses on the implementation of plans to manage the immediate consequences of an incident

for which an incident management structure is paramount. The "Recovery" section is treated separately

detailing the process of restoring critical business functions. (Specific reference: ASIS POA

Business Continuity

Section 4.4

"Response" and Section 4.5

"Recovery").

3. U.S. Department of Homeland Security

Federal Emergency Management Agency (FEMA). (2017). National Incident Management System (NIMS)

Third Edition. This foundational document

widely adopted in the security and emergency management profession

states

"The Incident Command System (ICS) is a management system designed to enable effective and efficient domestic incident management by integrating a combination of facilities

equipment

personnel

procedures

and communications operating within a common organizational structure." (p. 23). This establishes ICS/IMS as the core management element of the response phase.

During an earthquake, the primary safety protocol is "Drop, Cover, and Hold On." While extinguishing open flames like candles is a prudent fire prevention measure, a general recommendation to extinguish all light sources is incorrect and hazardous. Doing so would eliminate visibility, impeding safe movement and the ability to identify dangers such as debris or structural damage after the shaking stops. Emergency guidance specifically advises using flashlights, not open flames, for illumination, underscoring the need for safe light sources.

A. Turning off natural gas sources is a critical post-earthquake step if a leak is smelled or suspected, to prevent fires or explosions.

C. Remaining clear of all electrical sources is essential, as downed power lines and damaged wiring pose a severe electrocution risk.

D. Seeking inside shelter immediately (if already indoors) by getting under a sturdy table or desk is the core "Drop, Cover, and Hold On" procedure.

1. ASIS International

Protection of Assets (POA)

Crisis Management volume

2021. The principles of emergency response planning for natural disasters emphasize life safety and hazard mitigation. Standard procedures include securing utilities (like gas) post-event if damage is suspected and avoiding known hazards (like electrical systems). The creation of a new hazard

such as total darkness

contradicts the core principle of life safety. (Specific guidance is found in sections covering Natural Disasters and Emergency Procedures).

2. Federal Emergency Management Agency (FEMA)

"Earthquake Safety

" Ready.gov. The official guidance for actions to take after an earthquake states: "When the shaking stops... check for and extinguish small fires. Fire is the most common hazard after an earthquake. ... If you smell gas

turn off the main gas valve... Use a flashlight to inspect for damage. Never use candles

matches or lighters during or after an earthquake." This directly contradicts extinguishing all light and supports the use of safe

non-flame light sources. (Source: ready.gov/earthquakes)

3. University of California

Berkeley

Office of Emergency Management

"Earthquake Safety." University emergency protocols

which align with national standards

instruct individuals to "Use a flashlight to inspect your surroundings. Do not use candles

matches or lighters

as there may be gas leaks." This reinforces that safe illumination is necessary and that extinguishing all light sources is not the recommended procedure.

The responsibility for establishing policy, providing resources, and demonstrating commitment to a Business Continuity Management System (BCMS) lies with top management. This is a fundamental principle of governance for any management system. Top management has the ultimate authority and accountability to set the organization's strategic direction, allocate necessary resources (financial, human, and technical), and ensure the BCMS is integrated into the organization's processes. Their visible commitment is critical for fostering a resilient organizational culture and ensuring the effectiveness of the BCMS.

B. Security manager: The security manager is a functional role responsible for implementing and managing aspects of the BCMS, but they lack the authority to establish enterprise-wide policy or allocate major resources.

C. Human resource manager: The HR manager's role is focused on the personnel aspects of business continuity, such as employee communication and welfare, not the overall strategic direction and resourcing of the BCMS.

D. Chief financial officer: While a key member of top management responsible for financial resources, the overall accountability for establishing policy and demonstrating commitment is a collective top management responsibility, not solely the CFO's.

1. ISO 22301:2019

Security and resilience — Business continuity management systems — Requirements.

Clause 5.1

Leadership and commitment: "Top management shall demonstrate leadership and commitment with respect to the business continuity management system by: a) ensuring that the business continuity policy and business continuity objectives are established... c) ensuring that the resources needed for the business continuity management system are available..."

Clause 5.2

Policy: "Top management shall establish a business continuity policy..."

2. ASIS International

Protection of Assets (POA)

Business Continuity Management volume

2021.

Chapter 2

Program Initiation and Management

Section: "Management Support": This section emphasizes that senior management support is the "single most important element of a successful BCM program." It details their responsibilities

which include approving the BCM policy

committing resources

and providing overall direction and authority.

3. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to security (10th ed.). Butterworth-Heinemann.

Chapter 15

Emergency Management and Business Continuity: The text states that a successful business continuity plan requires a "top-down approach" and that "senior management must be fully committed to the process

providing the necessary resources and support." (Paraphrased from discussions on BCP governance).

Applied ethics is the branch of ethics concerned with the analysis of specific, practical moral issues in private and public life. Business ethics is a principal subfield of applied ethics, focusing on the moral principles and problems that arise in a business environment. It involves applying ethical theories to real-world business dilemmas concerning corporate governance, social responsibility, insider trading, and discrimination. Therefore, it is the most directly relevant framework for guiding ethical decision-making and conduct within a business or security management context.

B. Descriptive: This field empirically investigates and describes people's moral beliefs and behaviors, rather than prescribing how they should act, making it observational, not guidance-oriented.

C. Analytical: Also known as meta-ethics, this branch is highly theoretical, focusing on the meaning of ethical terms and the nature of moral judgments, not on solving practical business problems.

D. Practical: While often used synonymously with "applied ethics," the term "Applied Ethics" is the more formal and widely accepted academic designation for the field that specifically encompasses business ethics.

1. Fischer

R. J.

Halibozek

E.

& Walters

D. C. (2019). Introduction to Security (10th ed.). Butterworth-Heinemann. In Chapter 4

"Professionalism and Ethics

" the text discusses ethics from the perspective of professional conduct and decision-making

which is the essence of applied ethics in the security field.

2. De George

R. T. (2010). Business Ethics (7th ed.). Pearson. In Chapter 1

"Ethics and Business

" the author explicitly defines business ethics as a form of applied ethics

stating it is "the application of our understanding of what is good and right to that assortment of institutions

technologies

transactions

activities

and pursuits that we call business" (p. 17).

3. ASIS International. (2012). Protection of Assets (POA). The entire domain of "Business Principles and Practices" within the POA manual set is predicated on the application of ethical principles to business operations and security management

aligning directly with the definition and scope of applied ethics.