CPP 2022 Domain 1 Security Principles and Practices

Question 1

What is Enterprise Security Risk Management (ESRM)?

Answer 1

ESRM is a strategic approach to security management that ties an organization’s security practice to its overall strategy using globally accepted and established risk management principles.
Source: POA, Security Management, 1.1.2, page 2

Question 2

What are the three primary components of ESRM?

Answer 2

The context,The foundation,The ESRM cycle.

Source: POA, Security Management, 1.2, page 6

Question 3

This component of ESRM includes organizational aspects that security professionals must understand to successfully adopt ESRM.

Answer 3

The context.

Source: POA, Security Management, 1.2, page 6

Question 4

This component of ESRM includes organizational concepts that support the ESRM approach and maximize its impact.

Answer 4

The foundation.

Source: POA, Security Management, 1.2, page 6

Question 5

This component of ESRM is the actual process of security risk management that emphasizes the importance of understanding assets.

Answer 5

The ESRM cycle.

Source: POA, Security Management, 1.2, page 6

Question 6

What organizational aspects are included in the context of ESRM?

Answer 6

Mission and vision, Core values, Operating Environment, Stakeholders.

Source: POA, Security Management, 1.2.1, pages 6-10

Question 7

What three things comprise the operating environment of an organization?

Answer 7

Physical, Non physical, Logical.

Source: POA, Security Management, 1.2.1, page 8

Question 8

This operating environment includes much of what influences traditional security factors, such as the type and location of buildings, industrial control systems, and products on hand.

Answer 8

Physical.

Source: POA, Security Management, 1.2.1, page 8

Question 9

These factors are sources of risk, and include things such as the geopolitical environment, intensity of competition, and speed required for decision making.

Answer 9

Non physical factors.

Source: POA, Security Management, 1.2.1, page 9

Question 10

These factors focus on information types such as servers, workstations, and network infrastructure.

Answer 10

Logical factors.

Source: POA, Security Management, 1.2.1, page 9

Question 11

What are the four processes in the ESRM cycle?

Answer 11

Identify and prioritize assets, Identify and prioritize risks, Mitigate prioritized risks, Continuous improvement.

Source: POA, Security Management, 1.2.2, page 12

Question 12

What is an asset owner?

Answer 12

The person most directly responsible for successful operation of the asset. In ESRM, the asset owner is assigned responsibility for the risk to an asset.

Source: POA, Security Management, 1.2.2, page 13

Question 13

What four concepts comprise the foundation of ESRM?

Answer 13

Holistic risk management, Partnership with stakeholders, Transparency, Governance.
Source: POA, Security Management, 1.2.3, page 14

Question 14

What are two types of assets?

Answer 14

Tangible, Intangible.

Source: POA, Security Management, 2.1.1, page 22

Question 15

What are four ways to manage risk?

Answer 15

Eliminate, Reduce, Transfer, Accept.

Source: POA, Security Management, 2.2.1, page 26

Question 16

This risk mitigation strategy involves removing the risk entirely.

Answer 16

Eliminate.

Source: POA, Security Management, 2.2.1, page 26

Question 17

This risk mitigation strategy attempts to minimize risk through protective measures.

Answer 17

Reduce.

Source: POA, Security Management, 2.2.1, page 26

Question 18

This risk mitigation strategy is typically achieved when another entity takes the risk on the organization’s behalf.

Answer 18

Transfer.

Source: POA, Security Management, 2.2.1, page 26

Question 19

This risk mitigation strategy allows risk if the costs of reducing, eliminating, or transferring the risk outweigh the potential losses associated with it.

Answer 19

Accept.

Source: POA, Security Management, 2.2.1, page 26

Question 20

What is a risk assessment?

Answer 20

Risk assessment is the identification, analysis, and evaluation of uncertainties to objectives and outcomes.  It provides a comparison between the desired/undesired outcomes and expected rewards/losses of organizational objectives. The risk assessment analyzes whether the uncertainty is within acceptable boundaries and within the organization’s capacity to manage risk.

Source: Risk Assessment Standard, 0.2, page xvi

Question 21

What do the results of a risk assessment inform?

Answer 21

The choices available to effectively manage risk to achieve the organization’s outcomes.

Source: Risk Assessment Standard, 0.2, page xvi

Question 22

What are the deciding factors between a qualitative or quantitative approach to a risk assessment?

Answer 22

The reliability and validity of the available data, The nature of the risk factors and if they are quantifiable, The target audience for the outputs.

Source: Risk Assessment Standard, 0.3, page xvii

Question 23

What is risk appetite?

Answer 23

The total exposed amount that an organization wishes to undertake on the basis of risk-return trade-offs for one of more desired and expected outcomes.

Source: Risk Assessment Standard, 3.41, page 5

Question 24

What tasks take place at the start of the risk assessment?

Answer 24

Setting objectives, Identification of stakeholders, Identification of internal context and variables, documenting assumptions, Defining scope and statement of work, Policy and management commitment, Commitment of resources.

Source: Risk Assessment Standard, 6.2, pages 40-45

Question 25

What is a gap analysis?

Answer 25

A technique to determine what steps might need to be taken to improve from a current state to a desired, future state.

Source: Risk Assessment Standard, 6.3.1, page 45

Question 26

A gap analysis consists of what three steps?

Answer 26

Noting currently available factors, listing success factors needed to achieve future, desired objectives, Highlighting the gaps that exist and what gaps may need to be filled to be successful.

Source: Risk Assessment Standard, 6.3.1, page 46

Question 27

What four components should be in any risk identification process, regardless of risk discipline?

Answer 27

Asset and service identification, valuation, and characterization, Threat and opportunity analysis, Vulnerability and capability analysis, Criticality and impact analysis.

Source: Risk Assessment Standard, 6.4.4.1, page 60

Question 28

What is risk tolerance?

Answer 28

The amount of uncertainty an organization is prepared to accept in total or more narrowly within a certain business unity, a particular risk category, or for a specific initiative.

Source: Risk Assessment Standard, 3.51, page 6

Question 29

What comprises assessor competence?

Answer 29

Personal traits and interpersonal skills, Assessment skills, Communication skills, Education, training, and knowledge, Work experience.

Source: Risk Assessment Standard, 7.1, page 82

Question 30

Documented criteria of an assessor’s knowledge and skills provide the basis for what three things?

Answer 30

Selection of assessment team members, ascertain competence enhancement required for continuous improvement, Determine performance indicators for assessors.

Source: Risk Assessment Standard, 7.2.2, page 83

Question 31

What are two types of interactions between a risk assessment team and an organization?

Answer 31

Human interaction, Minimal human interactions.

Source: Risk Assessment Standard, A.2, page 88

Question 32

This type of interaction includes activities such as conducting interviews, document reviews with stakeholders, exercises, and undercover investigations.

Answer 32

Human interaction.

Source: Risk Assessment Standard, A.2, page 88

Question 33

This type of interaction includes activities such as conducting a document review, physical examination, observation, and sampling.

Answer 33

Minimal human interaction.

Source: Risk Assessment Standard, A.2, pages 88-89

Question 34

What are two examples of assessment paths?

Answer 34

Tracing, Process method.

Source: Risk Assessment Standard, A.3, page 89

Question 35

This assessment path tracks a process or risk event chronologically, following a path forward or backward through a process or sequence.

Answer 35

Tracing.

Source: Risk Assessment Standard, A.3, page 89

Question 36

This assessment path tests a sequence of steps and evaluates process controls, interactions, effectiveness, and opportunities for improvement.

Answer 36

Process method.

Source: Risk Assessment Standard, A.3, page 89

Question 37

What are some examples of the process method?

Answer 37

Objectives method, Risk source method, Department method, Requirement method, Discovery method.

Source: Risk Assessment Standard, A.3, page 89

Question 38

What is sampling?

Answer 38

The process or technique of selecting a representative part of a population for the purpose.

Source: Risk Assessment Standard, A.4.1, page 89

Question 39

When is it beneficial to use a sampling method?

Answer 39

When it is not practical in time or cost terms to evaluate all available information.

Source: Risk Assessment Standard, A.4.1, page 89

Question 40

What are two types of sampling methods?

Answer 40

Non-statistical, Statistical.

Source: Risk Assessment Standard, A.4.2, page 91

Question 41

This sampling method includes judgmental sampling, convenience sampling, and haphazard sampling.

Answer 41

Non-statistical.

Source: Risk Assessment Standard, A.4.3, page 91

Question 42

This sampling method includes random sampling, systematic sampling, stratified sampling, and cluster/block sampling.

Answer 42

Statistical sampling.

Source: Risk Assessment Standard, A.4.2, pages 91-92

Question 43

What is terrorism?

Answer 43

An act of violence designed to achieve a political end.

Source: POA, Security Management, 12.3.1, page 195

Question 44

What is domestic terrorism?

Answer 44

Violent, criminal acts committed by individuals and/or groups to further ideological goals stemming from domestic influences, such as those of a political, religious, social, racial, or environmental nature.

Source: POA, Security Management, 12.3.1, page 196

Question 45

What is the primary attack vector of terrorism?

Answer 45

To target the public’s sense of security in the location that they reside or work.

Source: POA, Security Management, 12.3.2, page 196

Question 46

What is a cost-benefit analysis?

Answer 46

A method for evaluating and comparing the value and cost of risk treatment options.

Source: Risk Assessment Standard, 6.4.4.4, page 77

Question 47

A cost-benefit analysis should consider what two types of costs and benefits?

Answer 47

Direct, Indirect.

Source: Risk Assessment Standard, 6.4.4.4, page 77

Question 48

What are examples of direct and indirect benefits?

Answer 48

Direct benefits - arising from reduction in the likelihood or harmful consequences of the risk. Indirect benefits - arising from collateral effects of the treatment such as reduced insurance premiums, improved management and staff confidence, and enhanced reputation.

Source: Risk Assessment Standard, 6.4.4.4, page 77

Question 49

What are some examples of direct and indirect costs?

Answer 49

Direct costs - of implementing the proposed treatment and/or that could arise if the risk eventuates. Indirect costs - arising from the loss of productivity, business disruption, diversion of management attention, loss of reputation or brand value.

Source: Risk Assessment Standard, 6.4.4.4, page 77

Question 50

What are the goals of risk treatments?

Answer 50

Remove the risk source, where possible; Remove or reduce the likelihood of the risk event occurring; Remove or reduce the negative consequences; Share the risk with other parties; Accept risk through informed decision or to exploit an opportunity; Avoid activities that give rise to risk.

Source: Risk Assessment Standard, 6.4.4.5, pages 77-78

Question 51

What is the purpose of a prevention and mitigation procedure?

Answer 51

Define the measures to be taken by the organization to minimize the likelihood of a disruptive event or to minimize the potential for the severity of the consequence of the event.

Source: ORM Standard, C.2, page 92

Question 52

What are prevention procedures?

Answer 52

Prevention procedures describe how the organization will take proactive steps to protect its assets by establishing architectural, administrative, design, operational, and technological approaches to avoid, eliminate, or reduce the likelihood of risks materializing.

Source: ORM Standard, C.2, page 92

Question 53

What are mitigation procedures?

Answer 53

Mitigation procedures describe how the organization will take proactive steps to protect its assets by establishing immediate, interim, and long-term approaches to reduce the consequences of risks before they materialize.

Source: ORM Standard, C.2, page 92

Question 54

What four steps are included in the risk assessment process?

Answer 54

Asset identification, valuation, and characterization,Risk identification,Risk analysis, Risk evaluation.

Source: ORM Standard, 7.2.3, page 18

Question 55

What happens in the asset identification, valuation and characterization step of the risk assessment process?

Answer 55

Identify people, assets and services that provide tangible and intangible value giving consideration to financial, operational, temporal, and reputational characteristics of assets, activities, functions and services.

Source: ORM Standard, 7.2.3, page 18

Question 56

What happens in the risk identification step of the risk assessment process?

Answer 56

Identify sources of strategic, operational, tactical, and reputational risk to assess threats and opportunities; vulnerabilities and capabilities; and consequence and criticalities that have a potential for direct or indirect consequences on the organization’s activities, assets, operations, functions and impacted stakeholders.

Source: ORM Standard, 7.2.3, page 18

Question 57

What happens in the risk analysis step of the risk assessment process?

Answer 57

Systematically analyze risk to determine those risks that have significant impact on activities, functions, services, products, supply chain, subcontractors, stakeholder relationships, local populations and the environment.

Source: ORM Standard, 7.2.3, page 18

Question 58

What happens in the risk evaluation step of the risk assessment process?

Answer 58

Systematically evaluate and prioritize risk controls and treatments, and their related costs to determine how to bring risk within an acceptable level consistent with risk criteria.

Source: ORM Standard, 7.2.3, page 18

Question 59

What are some outputs of a risk assessment?

Answer 59

A prioritized risk register identifying treatments to manage risk,Justification for risk acceptance,Identification of critical control points, Requirements for supplier, distributor, outsourcing and subcontractor controls.

Source: ORM Standard, 7.2.3, page 19

Question 60

What six things should be considered when assessing consequences?

Answer 60

Human cost,Financial cost,Image cost, Human rights impacts, Indirect impacts, Environmental impacts.

Source: ORM Standard, A.7.3, page 52

Question 61

What changes may prompt an update to a risk assessment?

Answer 61

Changes in: Risk landscape,Leadership and partnerships, Contractual and industry trends, Regulatory requirements, Political environment, Conditions due to an event, Performance based test/exercise results.

Source: ORM Standard, A.7.3, pages 53-54

Question 62

What are five benefits of liaison?

Answer 62

Leverage the resources of others,Share best practices and lessons learned,Collaborate on specific cases or incidents, More effectively address common issues, Share information, equipment, and facilities.

Source: POA, Security Management, 9.8.1, page 152

Question 63

What is cost-effectiveness?

Answer 63

Producing good results for the money spent.

Source: POA, Security Management, 4.2, page 49

Question 64

What three things maximize cost-effectiveness?

Answer 64

Ensure that the operations are conducted in the least expensive but cost effective way,Maintain the lowest costs consistent with required operational results,Ensure that the amount of money spent generates the highest return.

Source: POA, Security Management, 4.2, pages 49-50

Question 65

What is security awareness?

Answer 65

Consciousness of an existing security program, its relevance, and the effect of one’s behavior on reducing security risks.

Source: POA, Security Management, 10.7, page 174

Question 66

What is the purpose of a security awareness program?

Answer 66

To communicate to all individuals, including those working on behalf of the organization, risks within the organization’s unique internal and external environments, and the technical and administrative controls implemented to effectively manage those risks.

Source: Security Awareness Standard, 4.0, page 3

Question 67

When is an effective security culture established?

Answer 67

When people’s behaviors align with the defined risk management processes and where the security technologies and methods deployed are policy based and well communicated through security awareness and training activities.

Source: Security Awareness Standard, 4.0, pages 3-4

Question 68

What is the goal of a security awareness program?

Answer 68

To promote compliance with security policies and procedures, as well as provide timely communications and training to guide individual and organizational attitudes and behaviors.

Source: Security Awareness Standard, 4.1, page 4

Question 69

What should every awareness program be structured to reflect?

Answer 69

The organization’s unique culture, risk environment, lifecycle management, and change control process.

Source: Security Awareness Standard, 4.1, page 4

Question 70

How does clear top management support for security awareness set the tone?

Answer 70

By actively supporting awareness communication, training, and associated activities. Top management should also be involved in strengthening the culture that ensures individuals understand their security roles and take ownership of their personal safety and security.

Source: Security Awareness Standard, 4.2, page 5

Question 71

What three program principles should be established for security awareness programs?

Answer 71

Encourage enterprisewide ownership,Develop a unified approach for security awareness communication and training,Leverage existing programs/infrastructure.

Source: Security Awareness Standard, 4.3, page 5

Question 72

What can be done to encourage enterprisewide ownership of security awareness programs?

Answer 72

Establishing an oversight, advisory, or steering group comprised of security stakeholders to influence/generate program content and to help communicate risk appetite, strategy, and content relevance.Establishing security champions or influencers to solicit and provide input to program content.

Source: Security Awareness Standard, 4.3.1, page 6

Question 73

What is a benefit of a unified, holistic approach to security awareness program content?

Answer 73

Using ‘one voice’ simplifies the message and increases the impact to stakeholders and the organization.

Source: Security Awareness Standard, 4.3.2, page 6

Question 74

What types of benefits may be realized by leveraging existing organizational programs for security awareness?

Answer 74

Timing, Resource,Budget, Logistical.

Source: Security Awareness Standard, 4.3.3, page 6

Question 75

What six factors are planning considerations when designing an effective security awareness program?

Answer 75

Security policies and procedures,Internal and external considerations,Security risks, Resources, Roles, responsibility, and authorities, Human resources context.

Source: Security Awareness Standard, 5.2, pages 6-9

Question 76

Effective security policies contain what important characteristics?

Answer 76

Protecting individuals and organizational assets from security risks;Organizational relevance and maintaining compliance with legal, regulatory, and contractual obligations are clearly explained;Measurements for continual improvement metrics; Content is written to help build an engaged and alert security community; Instructions should help individuals reflect on the policy, consider how to respond in a situation, and take risk-based, informed, and appropriate action; Policy cross-references.

Source: Security Awareness Standard, 5.2.1, page 7

Question 77

Which department plays a pivotal role as collaborator with security personnel in an organization’s security awareness program?

Answer 77

Human resources.

Source: Security Awareness Standard, 5.2.6, page 9

Question 78

Security awareness program content should align with what three things?

Answer 78

Program goals and objectives,Security policies and procedures,Key performance indicators..

Source: Security Awareness Standard, 6.2, pages 10-11

Question 79

What factors should be considered when determining how security awareness program content should be delivered?

Answer 79

Location-specific needs and requirements,Existing training culture and processes to be leveraged,Training topics needed, Types of training formats available and relevant, Levels of training required based on security access or employment status.

Source: Security Awareness Standard, 6.4, page 12

Question 80

What should be included in a security awareness program evaluation?

Answer 80

Appropriateness of program goals and objectives,Consistency with the organization’s security policies and procedures,Volume and frequency of security awareness and training content, Effectiveness of content and delivery methods, Level of resources allocated to the program.

Source: Security Awareness Standard, 8, page 14

Question 81

What should security awareness program improvements be based on?

Answer 81

Individual feedback,Program evaluations,Evolving threat landscapes, Changes in the organization’s culture, Audit findings, New or changes to legal, regulatory, or contractual obligations, Top management input and direction.

Source: Security Awareness Standard, 9, page 14

Question 82

What are some benefits of using a security consultant?

Answer 82

They do not promote or sell a specific product,Objectivity,Out-of-the-box thinking, Can be less expensive than hiring additional staff.

Source: POA, Personnel, 4.1, pages 143-144

Question 83

What are three categories of security consultants?

Answer 83

Security management consultants,Technical security consultants,Security forensic consultants.

Source: POA, Personnel, 4.2, page 144

Question 84

This type of security consultant usually specializes in a certain discipline, which comprises the foundation of their expertise.

Answer 84

Security management consultants.

Source: POA, Personnel, 4.2.1, page 144

Question 85

This type of security consultant has specialized subject matter expertise and specializes in translating security concepts and functionality into blueprints and equipment specifications.

Answer 85

Technical security consultant.

Source: POA, Personnel, 4.2.2, pages 145-146

Question 86

This type of security consultant deals with investigation, identification and collection of evidence, identification of vulnerabilities, mitigation strategies, and litigation.

Answer 86

Forensic security consultants.

Source: POA, Personnel, 4.2.3, page 146

Question 87

In what situation are technical security consultants likely to be used?

Answer 87

New construction or renovation projects.

Source: POA, Personnel, 4.2.2, page 146

Question 88

What are three ways technical security consultants can support construction and renovation projects?

Answer 88

Work with the architects and design engineers to ensure the needed security systems are integrated into the initial designs,Uncover security concerns in the plans before they are finalized,Recommend security hardware and software that is compatible with other building systems.

Source: POA, Personnel, 4.2.2, page 146

Question 89

What is a security advisory committee?

Answer 89

An internal resources formed to assist corporate executives and chief security officers in their efforts to ensure that current security measures are adequate.

Source: POA, Personnel, 4.2.4, page 147

Question 90

Who should serve on a security advisory committee?

Answer 90

Representatives of key corporate functions with stature and credibility within the organization and sufficient information about the company’s operation to enable them to offer useful opinions about actions that should be taken.

Source: POA, Personnel, 4.2.4, page 147

Question 91

What typically drives the decision to use a security consultant?

Answer 91

A specific problem, need, challenge, or goal.,

Source:POA Personnel, 4.3, page 148

Question 92

What are five steps to use when selecting a security consultant?

Answer 92

Identify candidates,Invite candidates to submit an application,Evaluate the application, Interview the top two or three candidates, Negotiate an agreement and finalize the selection.

Source: POA, Personnel, 4.5, page 150

Question 93

How can consultant candidates be identified?

Answer 93

Suggestions from colleagues and peers,Industry associations,Online.

Source: POA, Personnel, 4.5, page 150

Question 94

What three things should be submitted by prospective security consultants looking to be hired for a project?

Answer 94

Custom application,Resume,Proof of license, in jurisdictions with this requirement.

Source: POA, Personnel, 4.5, page 150

Question 95

How can consultant applications be evaluated?

Answer 95

Compare the quality of documents and candidates’ credentials,References from prior clients,Background investigations of top candidates.

Source: POA, Personnel, 4.5, pages 150-151

Question 96

What types of questions should be asked during a consultant interview?

Answer 96

Questions that probe the candidate’s security philosophy.

Source: POA, Personnel, 4.5, page 151

Question 97

What subjects should be negotiated with a security consultant prior to hiring?

Answer 97

Scope of work,Product to be delivered,Methodology, Timing, Related expenses.

Source: POA, Personnel, 4.5, page 151

Question 98

What are five types of fee structures for consultants?

Answer 98

Hourly fees,Daily fees,Fixed fees, Not-to-exceed fees, Retainers.

Source: POA, Personnel, 4.6, page 152

Question 99

When is paying a consultant an hourly fee applicable?

Answer 99

When the assignment is expected to last less than a day, but the exact amount of time needed is unclear.

Source: POA, Personnel, 4.6.1, page 153

Question 100

When are fixed fee structures used with consultants?

Answer 100

When the number of days required to accomplish the work can be estimated accurately and controlled by the consultant.

Source: POA, Personnel, 4.6.3, page 153

Question 101

What is a not-to-exceed fee?

Answer 101

The consultant’s guarantee that the total cost or time will be limited to the parameters agreed to in the contract.

Source: POA, Personnel, 4.6.4, page 154

Question 102

What is a consultant retainer agreement?

Answer 102

The consultant agrees to work a specified number of days each year for the client, and the client is guaranteed access to the consultant when needed.

Source: POA, Personnel, 4.6.5, page 154

Question 103

What should be covered during a consultant’s organizational orientation?

Answer 103

Backgrounds and responsibilities of key personnel,Organizational chart,Operating environment, Key assets and functions, Internal and external relationships relevant to the project, Specific legislative or regulatory controls, History of the enterprise, Philosophy of top management, Competitive position.

Source: POA, Personnel, 4.7.2, page 157

Question 104

What should be outlined in a consultant’s work plan?

Answer 104

Scope,Tasks and priorities,Assignments, Completion schedules.

Source: POA, Personnel, 4.7.5, page 159

Question 105

What should be included in a consultant’s final report?

Answer 105

Executive summary,Results achieved,Recommendations.

Source: POA, Personnel, 4.7.7, page 160

Question 106

How should the recommendations section of the consultant’s final report be structured?

Answer 106

The recommendations should be numbered for future reference and should define any additional work that needs to be done, together with suggestions on how to accomplish it.

Source: POA, Personnel, 4.7.7, page 160

Question 107

What is a chief security officer?

Answer 107

A senior executive level function responsible for providing comprehensive integrated risk strategies to help protect an organization from a wide spectrum of threats.

Source: CSO Standard, Annex B, page 13

Question 108

What seven categories of skills is required by a chief security officer?

Answer 108

Relationship leader,Executive management and leadership,Subject matter expertise, Governance team member, Risk executive, Strategist, Creative problem solver.

Source: CSO Standard, Table 2, page 5

Question 109

Why is it recommended that the chief security officer report to a key senior-level executive?

Answer 109

To ensure a strong liaison with designated leadership bodies.

Source: SO Standard, 4, page 2

Question 110

A chief security officer is expected to have what level of education?

Answer 110

Advanced education and degrees should be highly valued.

Source: CSO Standard, 8, page 9