I85PREP
⌘ K
CPP study materials
CPP study resources

CPP (PayrollOrg Certifications) practice questions

One question at a time. Build your CPP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security principles and practices

In a security risk assessment, risk is best expressed as a function of which combination of factors?

  1. Policy, procedure, and training
  2. Budget, staffing, and technology
  3. Probability, cost, and schedule
  4. Threat, vulnerability, and consequence Correct answer.

Explanation

Risk reflects the likelihood that a threat agent will exploit a weakness and the resulting harm. Threat, vulnerability, and consequence are the three components that drive that likelihood and impact. Budget, policy, and schedule are management inputs rather than elements of risk itself.

Question 2Security principles and practices

Which CPTED principle is being applied when a lobby is designed with clear sight lines so that reception staff can observe everyone approaching the desk?

  1. Target hardening
  2. Territorial reinforcement
  3. Natural access control
  4. Natural surveillance Correct answer.

Explanation

Natural surveillance uses layout, lighting, and sight lines so that legitimate users can see and be seen, increasing the chance that inappropriate behavior is noticed. Territorial reinforcement concerns ownership cues such as signage and landscaping, while target hardening uses physical barriers.

Question 3Security principles and practices

Defense in depth in a physical security program means:

  1. Using multiple overlapping layers of controls Correct answer.
  2. Relying entirely on the single most effective countermeasure that budget allows
  3. Assigning all security duties to a single specialized response team
  4. Concentrating all protective resources at the outermost perimeter fence line

Explanation

Defense in depth stacks independent controls so that the failure or defeat of any one layer does not compromise the asset. Layers typically include the perimeter, building exterior, interior zones, and the asset itself.

Question 4Security principles and practices

Which security objective is achieved when visible guards, lighting, and signage cause a potential offender to abandon an attempt?

  1. Delay
  2. Detection
  3. Deterrence Correct answer.
  4. Response

Explanation

Deterrence persuades an adversary not to act by making the attempt appear risky or likely to fail. Detection identifies an act in progress, delay slows the adversary, and response is the reaction of security or law enforcement.

Question 5Security principles and practices

A facility has a single-loss expectancy of $50,000 for a given event, and the event is expected to occur once every five years. What is the annualized loss expectancy?

  1. $50,000
  2. $10,000 Correct answer.
  3. $250,000
  4. $5,000

Explanation

Annualized loss expectancy equals single-loss expectancy multiplied by the annualized rate of occurrence. An event expected once in five years has an annualized rate of occurrence of 0.2, so $50,000 times 0.2 equals $10,000.

Question 6Security principles and practices

An organization purchases a property insurance policy covering fire losses. Which risk treatment strategy does this represent?

  1. Risk avoidance
  2. Risk acceptance
  3. Risk mitigation
  4. Risk transfer Correct answer.

Explanation

Risk transfer shifts the financial consequence of a risk to a third party, commonly through insurance or contractual indemnification. The physical risk remains, but the financial burden is borne by the insurer.

Question 7Security principles and practices

The primary purpose of a security survey is to:

  1. Identify vulnerabilities and recommend countermeasures Correct answer.
  2. Prosecute employees who violate security policy
  3. Replace the organization's emergency action plan
  4. Measure guard response times during an actual alarm

Explanation

A security survey is a systematic examination of a facility or operation to find weaknesses and propose corrective measures. It is an analytical and advisory product rather than an enforcement or operational response tool.

Question 8Security principles and practices

How does a security audit differ from a security survey?

  1. A survey is restricted to reviewing the organization's financial accounting records
  2. An audit may only be performed by an external regulatory agency or its designee
  3. An audit is purely advisory while a survey results in a formal audit opinion letter
  4. An audit measures compliance with a standard Correct answer.

Explanation

An audit tests whether the organization conforms to a defined standard, regulation, or policy and produces a compliance finding. A survey is broader and more diagnostic, focusing on identifying risk and recommending improvements.

Question 9Security principles and practices

When reliable historical loss data are unavailable, which approach is most appropriate for ranking risks?

  1. Actuarial loss trending
  2. Annualized loss expectancy modeling
  3. Qualitative assessment Correct answer.
  4. Monte Carlo simulation

Explanation

Qualitative assessment relies on structured judgment, scenarios, and expert consensus to rank risks when numeric data are sparse. The quantitative techniques listed all require a reliable data history or credible probability distributions to produce meaningful results.

Question 10Security principles and practices

The principle of least privilege requires that:

  1. Users receive only the access needed for their duties Correct answer.
  2. Access rights are granted permanently to avoid repeated approvals
  3. Privileged accounts are shared among the operations team to reduce cost
  4. All employees receive the same baseline access for simplicity

Explanation

Least privilege limits each user or process to the minimum rights required to perform assigned tasks, which shrinks the damage possible from error or misuse. Access should be reviewed and removed when no longer required.

Question 11Security principles and practices

Need-to-know access control is best described as:

  1. Granting access based on an employee's job title alone
  2. Granting access to anyone who has signed a nondisclosure agreement
  3. Granting access only where there is a job-related requirement Correct answer.
  4. Granting access after a background investigation has been completed

Explanation

Need-to-know ties access to a specific, documented requirement to use the information for an assigned task, independent of rank or clearance. A clearance establishes eligibility, but need-to-know determines actual access.

Question 12Security principles and practices

An organization fails to verify a job applicant's prior criminal convictions, and the employee later assaults a coworker. The organization is most exposed to:

  1. Breach of warranty claims
  2. Negligent hiring liability Correct answer.
  3. Strict product liability
  4. Antitrust liability

Explanation

Negligent hiring arises when an employer fails to exercise reasonable care in screening an applicant and that failure leads to harm. Pre-employment screening and documented suitability criteria are the standard defenses.

Question 13Security principles and practices

Which plan primarily addresses restoring critical business functions after a disruption?

  1. Crisis communications plan
  2. Business continuity plan Correct answer.
  3. Workplace violence plan
  4. Emergency response plan

Explanation

A business continuity plan sets out how essential functions will be maintained or restored after a disruption, including alternate sites, resources, and recovery priorities. Emergency response plans address immediate life safety actions during the event itself.

Question 14Security principles and practices

All card readers at a site authenticate against a single on-premises server with no backup. Which characteristic of this design is the primary concern?

  1. A single point of failure Correct answer.
  2. Insufficient audit logging
  3. Excessive redundancy
  4. Overly granular zoning

Explanation

A single point of failure is a component whose loss disables the entire system. Without a backup authentication path, failure of that one server would halt access control across the site, so redundancy or fail-safe local decision-making is needed.

Question 15Security principles and practices

Within a layered physical security design, which characteristic should apply as one moves from the property line toward a critical asset?

  1. Controls become progressively more restrictive Correct answer.
  2. The same control level is maintained throughout
  3. Screening requirements are reduced to speed access
  4. Controls become progressively more permissive

Explanation

Layered design applies increasingly stringent controls as proximity to the protected asset increases, so each successive zone admits fewer people with fewer items. This graduated approach concentrates cost and inconvenience where the consequence of loss is greatest.

Question 16Security principles and practices

Compartmentalization of information limits the damage of a security breach by:

  1. Requiring all staff to complete annual security awareness training modules
  2. Publishing complete access logs to every employee for peer review
  3. Restricting each person to one defined segment Correct answer.
  4. Encrypting every database with one organization-wide shared encryption key

Explanation

Compartmentalization divides information into segments and grants each individual access to only those segments required, so a single compromised account exposes a limited portion of the total. It is an application of least privilege and need-to-know at the data level.

Question 17Security principles and practices

The most appropriate primary objective of an ongoing security awareness program is to:

  1. Transfer all security responsibility from the security department to employees
  2. Replace technical controls where budgets are constrained
  3. Satisfy insurers by documenting a single annual briefing
  4. Reinforce desired behaviors and reporting habits Correct answer.

Explanation

Awareness programs succeed when they change day-to-day behavior and increase timely reporting of suspicious activity, incidents, and policy violations. They complement, but do not replace, physical and technical controls.

Question 18Security principles and practices

During a major incident, the crisis management team's primary role is to:

  1. Conduct the tactical evacuation of the affected building
  2. Set strategic direction and prioritize resources Correct answer.
  3. Negotiate directly with the attackers
  4. Perform the forensic analysis of the cause

Explanation

The crisis management team operates at the strategic level, making decisions on priorities, resource allocation, business impact, and external communications. Tactical execution is handled by the incident commander and on-scene responders.

Question 19Security principles and practices

After all planned countermeasures are implemented, a risk assessment shows that some exposure remains. This remaining exposure is known as:

  1. Residual risk Correct answer.
  2. Inherent risk
  3. Control risk
  4. Risk appetite

Explanation

Residual risk is the exposure that remains after controls have been applied, and it must be explicitly accepted or further treated by management. Inherent risk is the exposure before any controls are in place.

Question 20Security principles and practices

Repairing broken windows, removing graffiti promptly, and maintaining landscaping are most closely associated with which CPTED concept?

  1. Activity support that draws legitimate users into an area
  2. Maintenance and territorial reinforcement Correct answer.
  3. Target hardening through the use of physical barriers and locks
  4. Natural access control achieved through wayfinding and signage

Explanation

Prompt maintenance signals that a space is cared for and actively owned, which reinforces territoriality and discourages further disorder and crime. This is the practical application of the broken windows concept within CPTED.

Question 21Security principles and practices

An asset criticality assessment is used primarily to:

  1. Establish the resale price of surplus equipment before disposal
  2. Determine the depreciated book value of each asset for the finance department
  3. Rank assets for protection priority Correct answer.
  4. Assign each asset to a specific individual for annual inventory counts

Explanation

Asset criticality assessment evaluates the importance of each asset to the organization's mission and operations so that protective resources can be allocated where loss would hurt most. It is a security prioritization tool rather than an accounting exercise.

Question 22Security principles and practices

A proposed countermeasure costs $80,000 per year and is expected to reduce annualized loss by $60,000. From a pure risk-economics standpoint, the analyst should:

  1. Reject it as currently scoped and seek a lower-cost option Correct answer.
  2. Implement it immediately because insurance will cover the difference in cost
  3. Implement it because any reduction in loss is automatically justified
  4. Reject it because security countermeasures cannot be cost-justified

Explanation

The countermeasure costs more per year than the annualized loss it prevents, producing a negative expected return. The analyst should explore lower-cost alternatives, risk transfer, or acceptance rather than fund an inefficient option as scoped.

Question 23Security principles and practices

Benchmarking a security program involves:

  1. Adopting every control listed in a published standard without modification
  2. Setting staffing levels strictly from the prior year's overtime hours
  3. Comparing practices and performance against peers or standards Correct answer.
  4. Measuring only the number of alarms received each month

Explanation

Benchmarking compares the organization's practices, resourcing, and results with those of comparable organizations or recognized standards to identify gaps and improvement opportunities. It informs decisions but does not require blind adoption of external controls.

Question 24Security principles and practices

Which pattern of behavior most strongly suggests a potential insider threat warranting further review?

  1. Routine access to systems and files that fall within the employee's own job scope
  2. Making voluntary use of the employee assistance program and taking leave
  3. Working occasional overtime and asking to swap scheduled shifts with a coworker
  4. Access attempts outside role and working hours Correct answer.

Explanation

Insider threat indicators center on access and behavior that deviate from an individual's legitimate role, such as attempts on systems or facilities outside assigned duties and normal hours. Indicators are prompts for inquiry, not proof of wrongdoing.

Question 25Security principles and practices

A security manager must justify the program in business terms to executive leadership. Which approach best aligns security with organizational objectives?

  1. Presenting the total security budget only as a percentage of annual revenue
  2. Reporting the number of security officers assigned to each shift and post
  3. Tying security initiatives to critical business processes Correct answer.
  4. Documenting every incident reported to the department over the past five years

Explanation

Executives fund protection that safeguards the processes and outcomes the business depends on, so framing security in terms of the critical business functions and risks it protects creates alignment. Activity counts and raw budget ratios do not convey business value.

Question 26Security principles and practices

A facility installs bright perimeter lighting, visible cameras, and warning signs. Which risk treatment strategy do these measures primarily represent?

  1. Avoidance
  2. Acceptance
  3. Transfer
  4. Deterrence Correct answer.

Explanation

Deterrence aims to dissuade an adversary from attempting an action by making the attempt appear risky or likely to be detected. Lighting, cameras, and signs influence the attacker's decision before an incident occurs. The other strategies eliminate the activity, shift financial consequences, or retain the risk.

Question 27Security principles and practices

In risk analysis, which term describes a condition or weakness that a threat could exploit?

  1. Probability
  2. Consequence
  3. Threat
  4. Vulnerability Correct answer.

Explanation

A vulnerability is an internal weakness or condition that a threat can exploit to cause harm. Threat refers to the actor or event with potential to cause harm, while probability and consequence describe likelihood and impact.

Question 28Security principles and practices

A vault requires two authorized employees to independently enter their own codes at the same time before it opens. Which control does this illustrate?

  1. Separation of duties
  2. Need-to-know
  3. Dual control Correct answer.
  4. Least privilege

Explanation

Dual control requires two or more people to jointly perform a single sensitive action, so no one person can complete it alone. Separation of duties divides different tasks among different people, which is related but distinct. Need-to-know and least privilege limit access based on job requirements rather than requiring joint action.

Question 29Security principles and practices

An organization continuously verifies that its documented security controls remain appropriate and effective over time. Which concept does this best illustrate?

  1. Risk transference
  2. Due diligence Correct answer.
  3. Compliance
  4. Due care

Explanation

Due diligence is the ongoing process of verifying, reviewing, and improving controls to confirm they remain suitable and effective. Due care refers to the standard of reasonable care itself, while compliance is adherence to specific requirements. Ongoing verification is the defining feature of due diligence.

Question 30Security principles and practices

Which statement best distinguishes risk appetite from risk tolerance?

  1. It applies only to financial risk, while tolerance applies to all risk categories.
  2. It is set only by regulators, while tolerance is set only by the board of directors.
  3. It is the largest loss an organization can survive, while tolerance is the control baseline.
  4. It is the risk an organization seeks to take; tolerance is acceptable variation from it. Correct answer.

Explanation

Risk appetite is the amount and type of risk an organization is willing to pursue to achieve its objectives. Risk tolerance is the acceptable level of variation around that appetite before action is required. Appetite is broader and forward-looking, while tolerance defines boundaries for acceptable deviation.

Question 31Business principles and practices

Under the Fair Labor Standards Act, covered employers must preserve basic payroll records, such as wage rate tables and records of wages paid, for at least how long?

  1. Five years
  2. Ten years
  3. One year
  4. Three years Correct answer.

Explanation

FLSA regulations require employers to keep basic payroll records for three years, while supplementary records such as time cards must be kept for two years. The clock runs from the date of the last entry in the record.

Question 32Business principles and practices

Which factor most strongly supports classifying a worker as an employee rather than an independent contractor?

  1. The worker offers services to the general public
  2. The worker supplies their own tools and bears profit-and-loss risk
  3. The company controls how, when, and where the work is done Correct answer.
  4. The worker sets their own hours

Explanation

Worker classification turns on the degree of behavioral and financial control the business exercises. A company that directs how, when, and where work is performed looks like an employer under the common-law test.

Question 33Business principles and practices

A nonexempt employee paid $15.00 per hour works 46 hours in a workweek and receives no other compensation. What is the employee's total gross pay for the week?

  1. $735.00 Correct answer.
  2. $765.00
  3. $690.00
  4. $720.00

Explanation

Straight-time pay covers all 46 hours at $15.00, which equals $690.00, and the 6 hours beyond 40 are also owed a half-time premium of $7.50 per hour, or $45.00. Total gross pay is therefore $735.00.

Question 34Business principles and practices

Which arrangement is the clearest example of segregation of duties in a payroll function?

  1. Employees approve their own time records
  2. The payroll manager also reconciles the payroll bank account
  3. Payroll preparation and review are split between staff Correct answer.
  4. A single clerk prepares, approves, and releases all payroll changes

Explanation

Segregation of duties separates authorization, processing, and review so no single person can both create and conceal an error or fraud. Splitting preparation from review achieves that separation.

Question 35Business principles and practices

Which term describes an employee's total earnings before any deductions are subtracted?

  1. Take-home pay
  2. Gross pay Correct answer.
  3. Disposable pay
  4. Net pay

Explanation

Gross pay is the total compensation earned in a pay period before taxes, benefits, and other deductions are withheld. Net pay, by contrast, is what remains after deductions.

Question 36Business principles and practices

What is the federal minimum hourly wage that the FLSA sets for covered nonexempt employees?

  1. $12.00
  2. $10.10
  3. $7.25 Correct answer.
  4. $5.15

Explanation

The federal minimum wage under the FLSA has been $7.25 per hour since 2009. A state or local minimum wage may be higher, in which case the higher rate applies to those employees.

Question 37Business principles and practices

A payroll specialist is asked by a department manager for a coworker's salary. What is the most appropriate response?

  1. Decline and refer the manager to the authorized-access process Correct answer.
  2. Provide it if the manager promises to keep it confidential
  3. Post it on the shared drive so everyone has access
  4. Provide it because the manager has promised confidentiality and has a business reason

Explanation

Payroll data should be shared only on a legitimate need-to-know basis and through established authorization channels. A verbal promise of confidentiality does not substitute for proper authorization.

Question 38Business principles and practices

Which set of elements is typically included in an employee total rewards package?

  1. Base salary alone
  2. Legally required benefits alone
  3. Cash compensation only
  4. Pay, benefits, and paid time off Correct answer.

Explanation

Total rewards encompasses all forms of value an employer provides, including base and variable pay, health and retirement benefits, and paid time off. It is broader than cash compensation or statutory benefits alone.

Question 39Business principles and practices

For how long must an employer generally keep employment tax records after the tax is due or paid, whichever is later?

  1. Indefinitely
  2. Two years
  3. Four years Correct answer.
  4. Seven years

Explanation

The IRS requires employment tax records to be retained for at least four years after the tax is due or paid, whichever is later. This is a separate rule from the FLSA's three-year payroll record retention requirement.

Question 40Business principles and practices

A payroll department reports a cost per paycheck of $4.80, while industry surveys show a median of $3.10. What is this type of comparison called?

  1. A cost-benefit analysis
  2. A return on investment calculation
  3. A benchmarking comparison Correct answer.
  4. A variance analysis

Explanation

Benchmarking compares an organization's performance metrics against external standards such as industry surveys or peer data. Variance analysis, by contrast, compares actual results to the organization's own budget or plan.

Question 41Business principles and practices

A payroll budget includes $40,000 for overtime, but actual overtime costs total $52,000. How is the $12,000 difference best described?

  1. An unfavorable budget variance Correct answer.
  2. A favorable volume variance
  3. An encumbrance
  4. A capital expenditure

Explanation

Actual cost exceeding the budgeted amount by $12,000 is an unfavorable variance because more was spent than planned. Management would then investigate the drivers, such as unplanned volume or scheduling problems.

Question 42Business principles and practices

Which practice best protects payroll operations from a prolonged outage at the primary data center?

  1. Maintaining tested offsite backups and a documented recovery plan Correct answer.
  2. Testing the recovery plan only after an outage occurs
  3. Relying on staff to remember recovery procedures
  4. Storing backup tapes in the same locked room as the production servers

Explanation

A disaster recovery capability depends on data stored away from the primary site and a plan that has been exercised in advance. Untested or co-located backups fail precisely when a site-wide event occurs.

Question 43Business principles and practices

An organization is deciding whether to outsource its payroll processing. Which consideration is most central to that decision?

  1. Whether outsourcing eliminates all payroll tax liability
  2. Whether payroll is a core competency of the business Correct answer.
  3. Whether the vendor uses the same software as the company
  4. Whether the vendor's office is in the same city

Explanation

Outsourcing decisions typically weigh strategic focus, cost, and risk, and functions that are not core competencies are stronger candidates for outsourcing. The employer remains legally responsible for payroll taxes regardless of the arrangement.

Question 44Business principles and practices

Under the Sarbanes-Oxley Act, what is management of a public company primarily responsible for regarding payroll controls?

  1. To publish individual employee salaries
  2. To delegate all payroll control decisions to the external audit firm and rely on its testing
  3. To eliminate all manual payroll processes
  4. To document and assess internal controls over financial reporting Correct answer.

Explanation

Sarbanes-Oxley requires management to establish, document, assess, and report on internal control over financial reporting, which includes payroll processes that feed the financial statements. The external auditor provides independent assurance but does not assume management's responsibility.

Question 45Business principles and practices

What is the primary purpose of a Section 125 cafeteria plan?

  1. To allow employees to defer all income tax indefinitely
  2. To let employees pay certain benefits with pre-tax dollars Correct answer.
  3. To replace employer-paid payroll taxes
  4. To reduce the federal minimum wage obligation

Explanation

A Section 125 plan allows employees to fund qualified benefits such as health premiums and dependent care through pre-tax salary reduction. This lowers taxable wages for both income tax and, for most benefits, Social Security and Medicare.

Question 46Business principles and practices

In addition to meeting the salary level, what must be true for an employee to be exempt under the FLSA white-collar exemptions?

  1. The employee's primary duties must meet the duties test Correct answer.
  2. The employee must work at least 50 hours per week
  3. The employee must have signed an arbitration agreement
  4. The employee must be paid in cash rather than by check

Explanation

Exemption generally requires a salary basis, payment at or above the salary level, and primary duties that satisfy the executive, administrative, professional, or other recognized duties test. All parts of the test must be met.

Question 47Business principles and practices

A payroll team needs five days to close each cycle, and process mapping shows most of the delay comes from waiting for paper timecards. What is the best first improvement step?

  1. Hire temporary staff to sort paper cards faster
  2. Shorten the payroll calendar by one day without other changes
  3. Add a second approval layer to the paper process
  4. Replace paper timecards with an electronic timekeeping system Correct answer.

Explanation

Process improvement targets the largest root cause of delay first, and here that cause is the paper-based handoff. Removing the bottleneck typically shortens cycle time more than adding capacity or controls to a flawed process.

Question 48Business principles and practices

Under accrual accounting, wages earned by employees in the final week of December but paid in January should be:

  1. Recorded as a prepaid asset in December
  2. Ignored until paid in January
  3. Charged directly to retained earnings
  4. Accrued as an expense and liability in December Correct answer.

Explanation

The matching principle requires expenses to be recognized in the period the related services are performed. Wages earned in December are therefore accrued as an expense with a corresponding liability until paid.

Question 49Business principles and practices

Which metric most directly measures the accuracy of payroll processing?

  1. Average employee tenure
  2. Number of paychecks issued per pay period
  3. Total gross payroll dollars
  4. Share of paychecks that require correction Correct answer.

Explanation

Accuracy metrics focus on the rate of errors, such as the proportion of payments needing correction or off-cycle adjustments. Volume and dollar totals describe size, not quality, of the payroll output.

Question 50Business principles and practices

Wages owed to a former employee who cannot be located must generally be:

  1. Kept indefinitely in the payroll bank account
  2. Remitted to the state under unclaimed property law Correct answer.
  3. Paid to the remaining employees
  4. Written off as a reduction of payroll expense in the year the employee left

Explanation

Unclaimed wages are unclaimed property and are subject to state escheat laws after the required dormancy period. Employers must follow the applicable state's reporting and remittance procedures rather than retaining the funds.