I85PREP
⌘ K
ASIS PCI study materials
ASIS PCI study resources

ASIS PCI practice questions

One question at a time. Build your ASIS PCI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Case Management

In case management, what is the primary purpose of conducting an initial intake assessment?

  1. To schedule the annual audit
  2. To close the case file
  3. To gather facts needed to plan and prioritize the investigation Correct answer.
  4. To determine the final disciplinary outcome

Explanation

Intake assessment establishes the facts, scope, and severity that drive decisions about whether and how to investigate. It informs planning and prioritization rather than determining outcomes or closing matters.

Question 2Case Management

What does the term 'case management' most accurately describe in an investigations program?

  1. The annual budgeting for security staff
  2. The marketing of loss-prevention services
  3. The systematic tracking of a matter from intake through resolution Correct answer.
  4. The physical storage of evidence

Explanation

Case management is the discipline of tracking a matter through its lifecycle, from initial report through investigation, disposition, and closure. It encompasses documentation, accountability, and reporting.

Question 3Case Management

A case management system assigns each matter a unique identifier. What is the main benefit of this practice?

  1. It eliminates the need for investigative notes
  2. It automatically determines case priority
  3. It provides a reliable reference for tracking and linking records Correct answer.
  4. It guarantees the case will be prosecuted

Explanation

Unique identifiers allow consistent referencing, retrieval, and linkage of all records and evidence tied to a matter. They support integrity and auditability of the case file.

Question 4Case Management

Which document typically records the chronological sequence of actions taken during an investigation?

  1. The case activity log Correct answer.
  2. The training roster
  3. The organizational chart
  4. The vendor contract

Explanation

An activity log captures dated entries of investigative steps, preserving a chronological record. This supports accountability and later review of how the matter was handled.

Question 5Case Management

What is the recommended practice when a case file must be retained for a defined period?

  1. Discard files whenever storage becomes inconvenient
  2. Keep files indefinitely without any schedule
  3. Transfer all files to personal devices
  4. Follow a documented retention schedule aligned with legal and policy requirements Correct answer.

Explanation

Retention should follow a documented schedule that reflects legal, regulatory, and organizational requirements. This ensures consistency and defensibility of records management.

Question 6Case Management

Which of the following best describes the principle of confidentiality in case management?

  1. Access to case information is limited to those with a legitimate need Correct answer.
  2. All case details are published for transparency
  3. Only the subject of the investigation may view the file
  4. Case files are shared freely with any employee

Explanation

Confidentiality means limiting access to information on a need-to-know basis to protect the investigation and the parties involved. It is not the same as secrecy from oversight or open publication.

Question 7Case Management

What is the purpose of a case disposition entry?

  1. To record the time of the next staff meeting
  2. To list the names of all employees in the department
  3. To record the final outcome and rationale for closing or referring a matter Correct answer.
  4. To document the annual security budget

Explanation

A disposition records how the matter concluded, such as substantiated, unsubstantiated, referred, or closed, along with the reasoning. It provides the formal endpoint for the case file.

Question 8Case Management

Which of the following is a key element of a well-structured case file?

  1. A collection of unrelated news articles
  2. Organized documentation of evidence, actions, and decisions Correct answer.
  3. Personal opinions recorded without attribution
  4. A single undated summary written at the end

Explanation

A well-structured file organizes evidence, documentation of actions, and decisions in a coherent manner. This supports review, audit, and continuity if the matter changes hands.

Question 9Case Management

An investigator receives a complaint that involves potential financial fraud. Which initial action best reflects sound case management?

  1. Assess severity and jurisdiction, then route the matter to the appropriate function Correct answer.
  2. Discard the complaint as unverified
  3. Post the complaint details on a shared drive for all staff
  4. Immediately confront the subject in a public area

Explanation

Initial assessment determines whether the matter is within scope and how urgent or serious it is, guiding routing and planning. Premature confrontation or disclosure can compromise the investigation.

Question 10Case Management

A case has been open for several months with no documented activity. What does this most likely indicate about the case management process?

  1. A mandatory closure under policy
  2. A gap in tracking and oversight that should be reviewed Correct answer.
  3. Successful completion of the investigation
  4. That the case should be deleted from records

Explanation

Prolonged inactivity without documentation suggests a lapse in monitoring or follow-up. Effective case management includes periodic review to ensure matters progress or are appropriately closed.

Question 11Case Management

When two related incidents appear to involve the same subject, what is the best case management practice?

  1. Merge them into one file and delete the original records
  2. Ignore the connection to save time
  3. Link the records while maintaining separate documentation for each incident Correct answer.
  4. Assign each to a different system with no cross-reference

Explanation

Linking records preserves the integrity of each incident while allowing investigators to see patterns and shared facts. Merging and deleting destroys original documentation.

Question 12Case Management

A manager asks for updates on an open investigation involving a colleague. What is the most appropriate response?

  1. Provide a full verbal briefing of all evidence
  2. Decline to share details beyond what the manager is authorized to know Correct answer.
  3. Discuss the subject's personal history openly
  4. Share the case file via email with the manager

Explanation

Information sharing must respect need-to-know and authorization. A manager without a legitimate role in the matter should not receive investigative details.

Question 13Case Management

Which metric would best help an organization evaluate the timeliness of its case handling?

  1. Total square footage of the security office
  2. Number of training sessions offered per year
  3. Average elapsed time from intake to disposition Correct answer.
  4. Number of employees in the security department

Explanation

Cycle time from intake to disposition directly measures how promptly matters are handled. It is a meaningful performance indicator for case management efficiency.

Question 14Case Management

An investigator must hand off a case to a colleague due to reassignment. What best ensures continuity?

  1. A brief verbal mention of the case in passing
  2. A request that the colleague start over from scratch
  3. A complete, organized file with a current status summary and outstanding actions Correct answer.
  4. A note that the case exists but lacks detail

Explanation

Continuity depends on a complete file and a clear summary of status and next steps. This prevents duplication, loss of evidence, and gaps in accountability.

Question 15Case Management

Which practice best supports the integrity of evidence referenced in a case file?

  1. Recording evidence details only after the case closes
  2. Allowing unrestricted access to evidence storage
  3. Relying on memory to recall where items were stored
  4. Maintaining a documented chain of custody for each item Correct answer.

Explanation

A documented chain of custody records who handled evidence, when, and for what purpose, supporting integrity and admissibility. It should be maintained from collection onward.

Question 16Case Management

A case management policy should address which of the following to protect sensitive information?

  1. The color scheme of the office
  2. The number of parking spaces
  3. Access controls and role-based permissions Correct answer.
  4. The cafeteria menu

Explanation

Access controls and role-based permissions limit case data to authorized users, protecting confidentiality. These are core components of a sound case management policy.

Question 17Case Management

An organization wants to ensure consistency in how similar cases are handled. What is the most effective approach?

  1. Let each investigator use personal judgment without guidance
  2. Establish documented criteria and procedures for case handling Correct answer.
  3. Discourage documentation to save time
  4. Rotate cases randomly without any standards

Explanation

Documented criteria and procedures promote consistent, defensible decisions across investigators and matters. They reduce variability and support fair treatment.

Question 18Case Management

What is the primary reason for periodically reviewing open cases?

  1. To satisfy curiosity about colleagues
  2. To confirm progress, reassess priority, and identify needed actions Correct answer.
  3. To increase the number of open files
  4. To avoid documenting decisions

Explanation

Periodic review confirms that matters are progressing, priorities remain appropriate, and necessary actions are taken. It is a control that prevents cases from stalling.

Question 19Case Management

Which of the following best describes the relationship between case management and reporting?

  1. Case management data supports accurate reporting on volume, trends, and outcomes Correct answer.
  2. Reporting requires deleting case records
  3. Reporting is unrelated to case management
  4. Case management replaces the need for reporting

Explanation

Case management generates the data that underpins reporting on caseloads, trends, and outcomes. Accurate records enable meaningful analysis and informed decisions.

Question 20Case Management

A case file contains a statement from a witness who later recants. What is the best case management action?

  1. Document the recantation and retain the original statement Correct answer.
  2. Remove the original statement from the file
  3. Discard the entire case file
  4. Replace the original statement without noting the change

Explanation

Records should reflect the full history, including changes such as recantations, while preserving the original statement. Altering or removing records undermines integrity and auditability.

Question 21Case Management

An investigator is asked to close a case quickly despite unresolved leads. What is the most defensible course of action?

  1. Document the unresolved leads and the rationale before any closure decision Correct answer.
  2. Delete the leads to justify closure
  3. Close the case and reassign blame to the subject
  4. Close the case silently and omit the leads

Explanation

Defensible closure requires documenting unresolved items and the reasoning behind the decision. This preserves transparency and allows later review or reopening.

Question 22Case Management

Two departments claim ownership of a case that crosses functional boundaries. What case management approach best resolves this?

  1. Allow both to work independently without communication
  2. Assign the case to whichever department is busiest
  3. Define a lead function with documented coordination responsibilities Correct answer.
  4. Suspend the case indefinitely

Explanation

Cross-functional matters require a designated lead and documented coordination to avoid duplication and gaps. Clear ownership preserves accountability.

Question 23Case Management

A case management system shows a spike in open cases with no corresponding rise in closures. What is the most useful analytical interpretation?

  1. Intake or handling capacity may be misaligned, warranting review of workflow Correct answer.
  2. Closures are unnecessary
  3. The system must be deleted
  4. The organization has eliminated all risk

Explanation

A growing backlog suggests that intake volume or processing capacity is out of balance. Reviewing workflow helps identify bottlenecks and resource needs.

Question 24Case Management

Why is it important to distinguish between an allegation and a substantiated finding in case records?

  1. It guarantees a conviction
  2. It allows investigators to skip documentation
  3. It preserves objectivity and reflects the actual evidentiary status of the matter Correct answer.
  4. It removes the need for confidentiality

Explanation

Recording the evidentiary status accurately protects fairness and objectivity, avoiding the implication that an allegation is proven. This distinction is central to defensible case records.

Question 25Case Management

An organization must respond to a legal hold on records related to an open case. What is the most appropriate case management action?

  1. Transfer records to personal storage
  2. Proceed with scheduled disposal as usual
  3. Delete only the most sensitive records
  4. Suspend routine destruction and preserve all relevant records Correct answer.

Explanation

A legal hold requires preservation of potentially relevant records and suspension of routine destruction. Failing to preserve can result in sanctions and loss of critical evidence.

Question 26Case Management

Which activity marks the formal beginning of a case in a case management system?

  1. Assigning a unique case number and opening a case file Correct answer.
  2. Drafting the final investigative report
  3. Notifying the subject of the allegations
  4. Conducting the first witness interview

Explanation

A case formally begins when it is logged into the case management system with a unique identifier and a file is created. This establishes accountability and a record for all subsequent actions. Interviews, notifications, and reports occur after the case has been opened.

Question 27Case Management

What is the primary purpose of a case management system's audit trail?

  1. To provide a chronological record of who accessed or modified case information Correct answer.
  2. To automatically assign cases to investigators based on workload
  3. To encrypt sensitive case documents at rest
  4. To generate performance dashboards for senior management

Explanation

An audit trail logs user actions, including access and changes, creating accountability and supporting investigations of data misuse. It does not assign cases, create dashboards, or encrypt files. Those functions belong to other system features.

Question 28Case Management

Which document typically authorizes an investigator to access an organization's internal records during a case?

  1. A subpoena
  2. An internal authorization or consent form Correct answer.
  3. A chain-of-custody form
  4. A memorandum of understanding

Explanation

Access to internal records is generally granted through an internal authorization or consent form signed by the appropriate authority. A memorandum of understanding governs relationships between organizations, a subpoena is a court order for external parties, and a chain-of-custody form tracks evidence. None of these directly authorize internal access.

Question 29Case Management

Which of the following is a key principle of proper evidence documentation in a case file?

  1. Waiting until the case is closed to finalize evidence descriptions
  2. Recording only evidence that supports the primary hypothesis
  3. Documenting evidence as soon as practicable after it is obtained Correct answer.
  4. Storing evidence descriptions only in the investigator's personal notes

Explanation

Evidence should be documented promptly to preserve accuracy and integrity. Recording only supportive evidence introduces bias, delaying documentation risks loss of detail, and keeping descriptions only in personal notes removes them from the official record. Timely, comprehensive documentation is a core principle.

Question 30Case Management

An investigator is assigned a case but has a conflict of interest because the subject is a close relative. What is the most appropriate action?

  1. Disclose the conflict to a supervisor and request reassignment Correct answer.
  2. Continue without disclosure to avoid delays in the investigation
  3. Delegate all interviews to a colleague while retaining control of the case
  4. Proceed with the investigation but disclose the relationship in the case file

Explanation

A conflict of interest compromises impartiality and should be disclosed promptly to a supervisor so the case can be reassigned. Proceeding with disclosure alone does not remove the bias risk, delegating interviews while retaining control does not resolve the conflict, and concealing the relationship is unethical. Reassignment is the standard remedy.

Question 31Case Management

What is the best way to manage a case that involves multiple related incidents occurring over several months?

  1. Wait until all incidents are resolved before opening any case
  2. Open a separate case for each incident to keep files manageable
  3. Create a single master case with linked incident reports Correct answer.
  4. Merge all incidents into the first incident's case file without linking

Explanation

A master case with linked incidents allows investigators to see patterns and manage the overall investigation while preserving details of each incident. Separate cases fragment information, merging without links loses structure, and delaying case creation risks loss of evidence. Linking is the recommended practice.

Question 32Case Management

During a case, an investigator discovers that a key document was altered after being collected. What is the most appropriate case management response?

  1. Restore the document to its original condition and continue
  2. Interview the document's author and take no further action
  3. Document the alteration, preserve the altered document as evidence, and investigate the tampering Correct answer.
  4. Exclude the document from the case file to avoid confusion

Explanation

Alteration of evidence is a serious incident that must be documented and investigated, and the altered document itself becomes evidence of tampering. Restoring the document destroys evidence, excluding it hides a potential crime, and merely interviewing the author without further action is insufficient. Preservation and investigation are required.

Question 33Case Management

A case management system allows investigators to set reminders for follow-up actions. What is the primary benefit of using this feature?

  1. It ensures that all investigative steps are completed on schedule Correct answer.
  2. It replaces the need for supervisory review
  3. It automatically closes cases when reminders are ignored
  4. It encrypts case notes for security

Explanation

Reminders help investigators stay on track with planned actions and deadlines, supporting timely case progression. They do not automatically close cases, replace supervision, or provide encryption. Their purpose is to prompt action, not to enforce or secure.

Question 34Case Management

An investigator is preparing a case file for potential legal proceedings. Which practice best ensures the file's admissibility?

  1. Keeping original documents in the investigator's desk for safekeeping
  2. Maintaining a complete and unaltered record of all evidence and actions Correct answer.
  3. Relying on memory to testify about evidence details
  4. Including only summaries of evidence to save space

Explanation

Admissibility depends on a complete, unaltered record that demonstrates continuity and integrity. Summaries may omit critical details, retaining originals personally breaks the chain of custody, and memory is unreliable. A full and unaltered record is essential.

Question 35Case Management

What is the most appropriate way to handle a case file that contains information subject to a privacy regulation?

  1. Share the file freely with all departments to ensure transparency
  2. Apply access controls and redact information not essential to the investigation Correct answer.
  3. Store the file on a shared drive without restrictions
  4. Remove all privacy-sensitive information from the file permanently

Explanation

Privacy regulations require limiting access to sensitive information and redacting what is not necessary for the investigation. Unrestricted sharing or storage violates privacy principles, and permanent removal may destroy evidence needed for the case. Access controls and redaction balance investigative needs with privacy.

Question 36Case Management

An investigator needs to interview a witness who speaks a different language. What is the best case management practice?

  1. Postpone the interview indefinitely until the investigator learns the language
  2. Use a qualified interpreter and document the interpreter's identity and qualifications Correct answer.
  3. Conduct the interview using written questions only
  4. Ask a bilingual colleague to interpret informally without documentation

Explanation

Using a qualified interpreter ensures accurate communication and the interpreter's details should be documented for the record. Informal interpretation lacks accountability, written questions may be insufficient, and indefinite postponement harms the investigation. Proper interpretation and documentation are essential.

Question 37Case Management

A case management report shows that a high proportion of cases are closed with a disposition of 'insufficient evidence.' What does this most likely indicate?

  1. Investigators are closing cases too quickly without proper investigation
  2. The case management system is malfunctioning
  3. The organization has an unusually low rate of incidents
  4. The organization's evidence collection or case-building processes may need improvement Correct answer.

Explanation

A high rate of insufficient-evidence closures suggests that cases are not being built with adequate evidence, pointing to weaknesses in collection or analysis. It does not necessarily mean cases are closed too quickly, that the system is malfunctioning, or that incidents are low. Process improvement is the likely remedy.

Question 38Case Management

An investigator receives an anonymous tip about a serious allegation. What is the most appropriate initial case management step?

  1. Open a case and conduct a preliminary assessment to determine if the tip has merit Correct answer.
  2. Immediately confront the alleged subject with the tip
  3. Forward the tip to the media for public awareness
  4. Discard the tip because it is anonymous

Explanation

Anonymous tips should be assessed for credibility before a full investigation is launched. Discarding them may miss valid information, immediate confrontation can compromise the investigation, and forwarding to the media is inappropriate. A preliminary assessment is the proper first step.

Question 39Case Management

In a case management system, what is the most effective way to ensure that investigative steps are performed consistently across similar cases?

  1. Require all investigators to attend annual training only
  2. Increase the number of supervisors reviewing each case
  3. Rely on each investigator's experience and judgment
  4. Implement standardized checklists and workflows for case types Correct answer.

Explanation

Standardized checklists and workflows embed best practices into daily work, ensuring consistent steps regardless of individual experience. Relying on judgment leads to variability, training alone does not guarantee application, and more supervisors may improve oversight but not standardize the process itself. Workflow standardization is the most direct method.

Question 40Case Management

A case file contains a mix of factual observations and the investigator's opinions. Why should these be clearly distinguished?

  1. To comply with formatting requirements of the case management system
  2. To make the file more readable for the investigator
  3. To ensure that opinions are not mistaken for established facts in later proceedings Correct answer.
  4. To reduce the overall length of the case file

Explanation

Distinguishing fact from opinion is critical because opinions may be challenged and should not be treated as evidence of facts. Readability, length reduction, and formatting are secondary concerns. The primary reason is to preserve the integrity and clarity of the evidentiary record.

Question 41Evidence Collection

Which principle requires that evidence be collected in a manner that preserves its original state for later examination?

  1. Forensic soundness Correct answer.
  2. Chain of custody
  3. Least privilege
  4. Order of volatility

Explanation

Forensic soundness means evidence is acquired and handled so that its integrity and original state are preserved and defensible in later proceedings. Chain of custody documents who handled evidence but does not itself define preservation of state.

Question 42Evidence Collection

When collecting digital evidence, which action best supports later admissibility by demonstrating that the evidence was not altered?

  1. Compressing the image to save storage space
  2. Copying the image to a shared network drive for team access
  3. Renaming files to match the incident ticket number
  4. Computing and recording a cryptographic hash of the acquired image Correct answer.

Explanation

A cryptographic hash computed at acquisition and re-verified later provides a verifiable means to show the image has not changed. Renaming, compressing, or broadly sharing can complicate or compromise integrity claims.

Question 43Evidence Collection

A responder arrives at a running workstation suspected of malware. According to the order of volatility, which data should be captured first?

  1. Printed logbooks in the server room
  2. Contents of RAM and network connections Correct answer.
  3. Backup tapes stored offsite
  4. Files on the hard disk drive

Explanation

The order of volatility prioritizes data most likely to be lost, such as memory contents and active network connections, before persistent storage. Disk, backups, and paper records persist longer and are collected later.

Question 44Evidence Collection

What is the primary purpose of a chain-of-custody form?

  1. To document every transfer and handling of evidence from collection onward Correct answer.
  2. To authorize investigators to access a suspect's accounts
  3. To record the technical steps used to image a disk
  4. To summarize the final forensic findings for court

Explanation

A chain-of-custody form creates an auditable record of who collected, transferred, and handled evidence and when. It supports authentication by showing an unbroken, accountable sequence of custody.

Question 45Evidence Collection

Which type of evidence collection is preferred when a device can be powered down safely and imaged in a controlled lab?

  1. Static or dead-box acquisition Correct answer.
  2. Live acquisition
  3. Memory-only capture
  4. Remote logical export

Explanation

Static (dead-box) acquisition images the device in a controlled state, reducing changes to data caused by running processes. Live acquisition is used when volatile data must be captured or shutdown is not feasible.

Question 46Evidence Collection

Which item is the best example of volatile data that should be documented during live response?

  1. The current list of running processes Correct answer.
  2. A PDF in the downloads folder
  3. A system restore point
  4. A spreadsheet saved to the desktop

Explanation

Running processes exist only in memory and change or disappear rapidly, making them volatile. Saved files and restore points persist on storage and are collected later.

Question 47Evidence Collection

Which practice best ensures that collected evidence remains admissible in legal proceedings?

  1. Following a documented, repeatable methodology and recording each step Correct answer.
  2. Collecting evidence without documenting the process to save time
  3. Storing evidence on personal devices for convenience
  4. Allowing any team member to modify evidence as needed

Explanation

Admissibility is supported by a documented, repeatable process that records each action and preserves integrity. Undocumented or uncontrolled handling undermines authenticity and reliability.

Question 48Evidence Collection

Which document typically records the date, time, collector, location, and description of each item seized?

  1. Incident response policy
  2. Risk register
  3. Evidence collection log Correct answer.
  4. Service level agreement

Explanation

An evidence collection log captures the identifying details of each item seized, supporting later authentication. Policies, risk registers, and SLAs do not record individual item seizure details.

Question 49Evidence Collection

During a live response, an analyst runs a command that writes output to the suspect disk. Why is this a concern for evidence integrity?

  1. It requires administrator approval
  2. It increases network bandwidth usage
  3. It reduces the hash value length
  4. It alters the state of the system being examined Correct answer.

Explanation

Writing to the suspect system changes its state and can overwrite or modify evidence, weakening integrity claims. Output should be directed to external, write-controlled media where feasible.

Question 50Evidence Collection

An investigator images a laptop and later re-computes the hash of the working copy. The values differ from the acquisition record. What is the most appropriate interpretation?

  1. The working copy may have been altered and integrity is in question Correct answer.
  2. The original drive must have failed
  3. The hash algorithm was misapplied at acquisition
  4. The evidence is still valid because hashes always differ

Explanation

A mismatch between the acquisition hash and a later hash indicates the copy may have changed, calling integrity into question. The discrepancy must be investigated and documented before relying on the copy.