SPIPC 2026/2027 Certification Examination CDSE SPeD Program Aligned
SECURITY PROGRAM INTEGRATION PROFESSIONAL
CERTIFICATION (SPIPC) 2026/2027
Comprehensive Certification Examination — 150 Questions
Aligned with CDSE SPēD Certification Program Standards, SPIPC Exam Content Outline, and DoD
Security Program Management Competencies (2026/2027 Edition)
Total Questions: 150 (multiple choice, single best answer)
Sections: (1) Risk Assessment [30] | (2) Risk Management [30] | (3) Program & Mission Assurance [25] | (4)
Planning, Programming, Budgeting & Execution (PPB&E) [25] | (5) Security Program Integration & Evaluation [20]
| (6) Comprehensive Case Studies & Scenarios [20]
Cognitive Distribution: 20% Recall | 50% Application | 30% Analysis
Question Style: 70% Scenario-based | 30% Direct Knowledge
Special Inclusions: 20 comprehensive case studies; 15 PPB&E / resource allocation items; 10 program effectiveness
& compliance items
Prerequisites (per CDSE SPēD): Active SFPC certification; >2 years of security experience; NCCA-accredited;
biennial renewal required
Reference Frameworks: DoD Manual 5200.02 series; DoD Risk Management Guide; CJCS Continuity Directive;
DoD PPB&E process guidance; CDSE SPēD SPIPC Exam Content Outline
Section 1: Risk Assessment
Q1: Per the DoD risk management process assessed by the SPIPC exam, what is the FIRST step a
security practitioner must complete?
A. Threat assessment
B. Asset assessment [CORRECT]
C. Vulnerability assessment
D. Countermeasure implementation
Correct Answer: B
Rationale: Per the DoD Risk Management Guide and the SPIPC Exam Content Outline, the risk management process
begins with Asset Assessment - identifying assets requiring protection and undesirable events with their expected impacts.
Threat and vulnerability assessment logically follow asset identification, since one cannot assess threats or vulnerabilities
without first knowing what is being protected. Countermeasure determination is the final analytical step.
Q2: A security manager at a DoD facility is conducting a risk assessment of a newly fielded
command-and-control system. After identifying the system as a critical asset, what should the
manager do NEXT per the risk management process?
A. Identify potential countermeasures and conduct cost/benefit analysis
B. Determine threats to the identified asset and assess their intent and capability [CORRECT]
C. Identify existing countermeasures and assess their effectiveness
D. Prioritize assets based on consequences of loss
Correct Answer: B
For Certification Preparation Use Page 1
,SPIPC 2026/2027 Certification Examination CDSE SPeD Program Aligned
Rationale: Once the asset is identified (Asset Assessment step), the next sequential step in the DoD risk management process
is Threat Assessment - determining threats to the identified asset and assessing the intent and capability of those threats.
Countermeasure determination (A) comes after threat, vulnerability, and risk are assessed. Vulnerability assessment (C)
follows threat assessment. Asset prioritization (D) is part of the asset assessment step that should already be complete.
Q3: During an asset assessment, a security professional identifies three assets: (1) classified
cryptographic keying material, (2) unclassified administrative laptops, and (3) a SCIF facility. Using
the consequences-of-loss prioritization method, which ranking is most defensible?
A. Laptops > SCIF > Keying material
B. SCIF > Keying material > Laptops
C. Keying material > SCIF > Laptops [CORRECT]
D. Keying material > Laptops > SCIF
Correct Answer: C
Rationale: Per DoD Manual 5200.02 and the SPIPC content outline, asset prioritization is driven by consequences of loss
to national security. Classified cryptographic keying material has the highest consequence because compromise can
cryptographically expose multiple systems and operations. The SCIF, while critical, is recoverable and its loss is bounded
by physical reconstruction. Unclassified laptops present the lowest national-security consequence unless they contain
spillage of classified data.
Q4: In threat assessment per the SPIPC framework, "capability" refers to:
A. The adversary's stated motivation to harm the asset
B. The adversary's ability to obtain and use knowledge, skills, and resources to exploit a vulnerability
[CORRECT]
C. The historical frequency of attacks against similar assets
D. The DoD threat level assigned by the Defense Intelligence Agency
Correct Answer: B
Rationale: Per the DoD Risk Management Guide and SPIPC exam outline, capability is one of two threat dimensions (along
with intent) and denotes an adversary's ability - knowledge, skills, resources, access - to exploit a vulnerability. Intent (A) is
the separate dimension of motivation. Historical frequency (C) informs likelihood but is not capability. The DIA threat level
(D) is a derivative indicator, not the definition.
Q5: A cleared defense contractor's risk assessment identifies foreign intelligence service (FIS)
interest in a sensitive program. The FIS has clearly stated intent but lacks demonstrated technical
capability to exploit the program's cloud-hosted architecture. What is the current threat level?
A. High - intent alone establishes a high threat level
B. Medium - intent without capability reduces but does not eliminate threat [CORRECT]
C. Low - without capability, the FIS cannot harm the asset
D. Cannot be determined without vulnerability data
Correct Answer: B
Rationale: Threat level per the SPIPC framework is the combined assessment of intent and capability. High intent with low
capability produces a moderate threat level, because the adversary is motivated but constrained. Option A overweights
intent. Option C incorrectly equates threat with risk (capability without a vulnerability still yields a threat). Vulnerability
data (D) is required for risk determination, not for threat level.
Q6: A vulnerability assessment reveals that an existing intrusion detection system (IDS) covers
only 40% of the network's egress paths and produces a high false-positive rate. Which statement
best characterizes this countermeasure per the SPIPC framework?
A. The countermeasure is fully effective because it covers the most critical egress paths
For Certification Preparation Use Page 2
,SPIPC 2026/2027 Certification Examination CDSE SPeD Program Aligned
B. The countermeasure is partially effective; residual vulnerability remains and must be reflected in the risk
assessment [CORRECT]
C. The countermeasure is ineffective and should be removed
D. The countermeasure's effectiveness cannot be judged without threat data
Correct Answer: B
Rationale: Per the SPIPC vulnerability assessment step, the security practitioner identifies existing countermeasures and
assesses their level of effectiveness in reducing vulnerabilities. An IDS with partial coverage and high false positives is
partially effective, and the residual vulnerability must be carried forward to the risk assessment. Option A overstates
effectiveness. Option C is incorrect - partial effectiveness still provides value. Effectiveness (D) is judged independent of
threat; threat is required only for the risk calculation.
Q7: The Risk Assessment step of the DoD risk management process integrates which two pieces
of information per the SPIPC content outline?
A. Threat level and countermeasure cost
B. Impact of undesirable events and likelihood of undesirable events [CORRECT]
C. Vulnerability score and asset replacement value
D. Threat capability and countermeasure benefit
Correct Answer: B
Rationale: The SPIPC content outline defines the Risk Assessment step as integrating the impact of undesirable events
(collected during asset assessment) with the likelihood of undesirable events (derived from threat and vulnerability
assessment) to determine risks to identified assets. The other options mix inputs from different steps but do not constitute the
integration performed in this step.
Q8: A program manager has calculated that an undesirable event has a "High" impact and a
"Medium" likelihood. Using a standard 3x3 risk matrix, the resulting risk level is most likely:
A. Low
B. Medium
C. High [CORRECT]
D. Critical
Correct Answer: C
Rationale: In a standard 3x3 risk matrix, High impact x Medium likelihood yields a High risk rating. Medium x Medium
would be Medium; Low x anything would generally be Low. "Critical" is not a standard rating in the 3x3 matrix (it appears
in some 5x5 matrices). This application-level question tests the candidate's ability to apply the risk integration formula.
Q9: A security professional is preparing a countermeasure recommendation for a decision maker.
The candidate countermeasure costs $500K annually and reduces risk by 60%. An alternative
costs $100K annually and reduces risk by 40%. Which recommendation best demonstrates
cost/benefit analysis per the SPIPC framework?
A. Recommend the $500K option because it provides the greatest absolute risk reduction
B. Recommend the $100K option because it has a higher risk-reduction-per-dollar ratio [CORRECT]
C. Recommend both options sequentially because defense-in-depth is always preferred
D. Recommend neither option without first obtaining a DIA threat assessment
Correct Answer: B
Rationale: The SPIPC countermeasure determination step requires identifying countermeasure benefits (risk reduction),
costs, and conducting cost/benefit analysis to prioritize options for the decision maker. The $100K option yields 0.4% risk
reduction per $1K (40/100), while the $500K option yields 0.12% per $1K (60/500), making the lower-cost option a
superior value. Option A confuses absolute reduction with cost-effectiveness. Option C violates fiscal discipline. Option D is
unnecessary - threat assessment is already complete by this stage.
For Certification Preparation Use Page 3
, SPIPC 2026/2027 Certification Examination CDSE SPeD Program Aligned
Q10: Which of the following is NOT a typical undesirable event category considered during asset
assessment per the SPIPC framework?
A. Unauthorized disclosure
B. Theft or loss
C. Budget overrun [CORRECT]
D. Unauthorized modification
Correct Answer: C
Rationale: Per DoD Manual 5200.02 and the SPIPC asset assessment step, undesirable events include unauthorized
disclosure, theft/loss, unauthorized modification, destruction, denial of service, and unauthorized use. Budget overrun is a
program management concern, not a security undesirable event considered in asset assessment.
Q11: During a vulnerability assessment of a SCIF, the assessor notes that the facility uses a
2018-vintage alarm system whose manufacturer has issued three security patches the facility has
not applied. Which vulnerability is most directly identified per the SPIPC framework?
A. A threat from external adversaries
B. A residual vulnerability due to outdated countermeasure effectiveness [CORRECT]
C. An asset consequence-of-loss issue
D. A risk likelihood issue independent of vulnerability
Correct Answer: B
Rationale: An outdated, unpatched alarm system is an existing countermeasure with reduced effectiveness, which creates a
residual vulnerability. Per the SPIPC framework, this is identified during the Vulnerability Assessment step. Option A
conflates threat with vulnerability. Option C is an asset assessment concern. Option D misstates the relationship -
likelihood is a function of threat and vulnerability together.
Q12: A risk assessment yields a risk level of "High" for an asset, but the program manager argues
the risk is acceptable because "no incidents have occurred in five years." Which response best
reflects proper risk management practice per the SPIPC framework?
A. The manager is correct; absence of incidents proves the risk is overstated
B. The manager is confusing historical occurrence with assessed risk; likelihood is threat- and
vulnerability-driven, not event-driven [CORRECT]
C. The manager should re-run the asset assessment only
D. The risk should automatically be downgraded to Low
Correct Answer: B
Rationale: Per the DoD Risk Management Guide, likelihood in the risk assessment step is derived from threat and
vulnerability data - not from historical incident frequency alone. A five-year incident-free period does not reduce threat
capability or vulnerability, and therefore does not justify downgrading assessed risk. Option A is a common but flawed
heuristic. Option C addresses the wrong step. Option D has no methodological basis.
Q13: The prioritization of assets during asset assessment is based primarily on:
A. Asset replacement cost
B. Asset age and lifecycle stage
C. Consequences of loss [CORRECT]
D. Number of users with access
Correct Answer: C
Rationale: The SPIPC content outline explicitly states that asset prioritization is based on the consequences of loss. While
replacement cost, age, and user count may inform asset valuation, they are not the prioritization criterion.
Consequence-of-loss captures the operational, intelligence, and national-security impact that drives protection decisions.
For Certification Preparation Use Page 4
SECURITY PROGRAM INTEGRATION PROFESSIONAL
CERTIFICATION (SPIPC) 2026/2027
Comprehensive Certification Examination — 150 Questions
Aligned with CDSE SPēD Certification Program Standards, SPIPC Exam Content Outline, and DoD
Security Program Management Competencies (2026/2027 Edition)
Total Questions: 150 (multiple choice, single best answer)
Sections: (1) Risk Assessment [30] | (2) Risk Management [30] | (3) Program & Mission Assurance [25] | (4)
Planning, Programming, Budgeting & Execution (PPB&E) [25] | (5) Security Program Integration & Evaluation [20]
| (6) Comprehensive Case Studies & Scenarios [20]
Cognitive Distribution: 20% Recall | 50% Application | 30% Analysis
Question Style: 70% Scenario-based | 30% Direct Knowledge
Special Inclusions: 20 comprehensive case studies; 15 PPB&E / resource allocation items; 10 program effectiveness
& compliance items
Prerequisites (per CDSE SPēD): Active SFPC certification; >2 years of security experience; NCCA-accredited;
biennial renewal required
Reference Frameworks: DoD Manual 5200.02 series; DoD Risk Management Guide; CJCS Continuity Directive;
DoD PPB&E process guidance; CDSE SPēD SPIPC Exam Content Outline
Section 1: Risk Assessment
Q1: Per the DoD risk management process assessed by the SPIPC exam, what is the FIRST step a
security practitioner must complete?
A. Threat assessment
B. Asset assessment [CORRECT]
C. Vulnerability assessment
D. Countermeasure implementation
Correct Answer: B
Rationale: Per the DoD Risk Management Guide and the SPIPC Exam Content Outline, the risk management process
begins with Asset Assessment - identifying assets requiring protection and undesirable events with their expected impacts.
Threat and vulnerability assessment logically follow asset identification, since one cannot assess threats or vulnerabilities
without first knowing what is being protected. Countermeasure determination is the final analytical step.
Q2: A security manager at a DoD facility is conducting a risk assessment of a newly fielded
command-and-control system. After identifying the system as a critical asset, what should the
manager do NEXT per the risk management process?
A. Identify potential countermeasures and conduct cost/benefit analysis
B. Determine threats to the identified asset and assess their intent and capability [CORRECT]
C. Identify existing countermeasures and assess their effectiveness
D. Prioritize assets based on consequences of loss
Correct Answer: B
For Certification Preparation Use Page 1
,SPIPC 2026/2027 Certification Examination CDSE SPeD Program Aligned
Rationale: Once the asset is identified (Asset Assessment step), the next sequential step in the DoD risk management process
is Threat Assessment - determining threats to the identified asset and assessing the intent and capability of those threats.
Countermeasure determination (A) comes after threat, vulnerability, and risk are assessed. Vulnerability assessment (C)
follows threat assessment. Asset prioritization (D) is part of the asset assessment step that should already be complete.
Q3: During an asset assessment, a security professional identifies three assets: (1) classified
cryptographic keying material, (2) unclassified administrative laptops, and (3) a SCIF facility. Using
the consequences-of-loss prioritization method, which ranking is most defensible?
A. Laptops > SCIF > Keying material
B. SCIF > Keying material > Laptops
C. Keying material > SCIF > Laptops [CORRECT]
D. Keying material > Laptops > SCIF
Correct Answer: C
Rationale: Per DoD Manual 5200.02 and the SPIPC content outline, asset prioritization is driven by consequences of loss
to national security. Classified cryptographic keying material has the highest consequence because compromise can
cryptographically expose multiple systems and operations. The SCIF, while critical, is recoverable and its loss is bounded
by physical reconstruction. Unclassified laptops present the lowest national-security consequence unless they contain
spillage of classified data.
Q4: In threat assessment per the SPIPC framework, "capability" refers to:
A. The adversary's stated motivation to harm the asset
B. The adversary's ability to obtain and use knowledge, skills, and resources to exploit a vulnerability
[CORRECT]
C. The historical frequency of attacks against similar assets
D. The DoD threat level assigned by the Defense Intelligence Agency
Correct Answer: B
Rationale: Per the DoD Risk Management Guide and SPIPC exam outline, capability is one of two threat dimensions (along
with intent) and denotes an adversary's ability - knowledge, skills, resources, access - to exploit a vulnerability. Intent (A) is
the separate dimension of motivation. Historical frequency (C) informs likelihood but is not capability. The DIA threat level
(D) is a derivative indicator, not the definition.
Q5: A cleared defense contractor's risk assessment identifies foreign intelligence service (FIS)
interest in a sensitive program. The FIS has clearly stated intent but lacks demonstrated technical
capability to exploit the program's cloud-hosted architecture. What is the current threat level?
A. High - intent alone establishes a high threat level
B. Medium - intent without capability reduces but does not eliminate threat [CORRECT]
C. Low - without capability, the FIS cannot harm the asset
D. Cannot be determined without vulnerability data
Correct Answer: B
Rationale: Threat level per the SPIPC framework is the combined assessment of intent and capability. High intent with low
capability produces a moderate threat level, because the adversary is motivated but constrained. Option A overweights
intent. Option C incorrectly equates threat with risk (capability without a vulnerability still yields a threat). Vulnerability
data (D) is required for risk determination, not for threat level.
Q6: A vulnerability assessment reveals that an existing intrusion detection system (IDS) covers
only 40% of the network's egress paths and produces a high false-positive rate. Which statement
best characterizes this countermeasure per the SPIPC framework?
A. The countermeasure is fully effective because it covers the most critical egress paths
For Certification Preparation Use Page 2
,SPIPC 2026/2027 Certification Examination CDSE SPeD Program Aligned
B. The countermeasure is partially effective; residual vulnerability remains and must be reflected in the risk
assessment [CORRECT]
C. The countermeasure is ineffective and should be removed
D. The countermeasure's effectiveness cannot be judged without threat data
Correct Answer: B
Rationale: Per the SPIPC vulnerability assessment step, the security practitioner identifies existing countermeasures and
assesses their level of effectiveness in reducing vulnerabilities. An IDS with partial coverage and high false positives is
partially effective, and the residual vulnerability must be carried forward to the risk assessment. Option A overstates
effectiveness. Option C is incorrect - partial effectiveness still provides value. Effectiveness (D) is judged independent of
threat; threat is required only for the risk calculation.
Q7: The Risk Assessment step of the DoD risk management process integrates which two pieces
of information per the SPIPC content outline?
A. Threat level and countermeasure cost
B. Impact of undesirable events and likelihood of undesirable events [CORRECT]
C. Vulnerability score and asset replacement value
D. Threat capability and countermeasure benefit
Correct Answer: B
Rationale: The SPIPC content outline defines the Risk Assessment step as integrating the impact of undesirable events
(collected during asset assessment) with the likelihood of undesirable events (derived from threat and vulnerability
assessment) to determine risks to identified assets. The other options mix inputs from different steps but do not constitute the
integration performed in this step.
Q8: A program manager has calculated that an undesirable event has a "High" impact and a
"Medium" likelihood. Using a standard 3x3 risk matrix, the resulting risk level is most likely:
A. Low
B. Medium
C. High [CORRECT]
D. Critical
Correct Answer: C
Rationale: In a standard 3x3 risk matrix, High impact x Medium likelihood yields a High risk rating. Medium x Medium
would be Medium; Low x anything would generally be Low. "Critical" is not a standard rating in the 3x3 matrix (it appears
in some 5x5 matrices). This application-level question tests the candidate's ability to apply the risk integration formula.
Q9: A security professional is preparing a countermeasure recommendation for a decision maker.
The candidate countermeasure costs $500K annually and reduces risk by 60%. An alternative
costs $100K annually and reduces risk by 40%. Which recommendation best demonstrates
cost/benefit analysis per the SPIPC framework?
A. Recommend the $500K option because it provides the greatest absolute risk reduction
B. Recommend the $100K option because it has a higher risk-reduction-per-dollar ratio [CORRECT]
C. Recommend both options sequentially because defense-in-depth is always preferred
D. Recommend neither option without first obtaining a DIA threat assessment
Correct Answer: B
Rationale: The SPIPC countermeasure determination step requires identifying countermeasure benefits (risk reduction),
costs, and conducting cost/benefit analysis to prioritize options for the decision maker. The $100K option yields 0.4% risk
reduction per $1K (40/100), while the $500K option yields 0.12% per $1K (60/500), making the lower-cost option a
superior value. Option A confuses absolute reduction with cost-effectiveness. Option C violates fiscal discipline. Option D is
unnecessary - threat assessment is already complete by this stage.
For Certification Preparation Use Page 3
, SPIPC 2026/2027 Certification Examination CDSE SPeD Program Aligned
Q10: Which of the following is NOT a typical undesirable event category considered during asset
assessment per the SPIPC framework?
A. Unauthorized disclosure
B. Theft or loss
C. Budget overrun [CORRECT]
D. Unauthorized modification
Correct Answer: C
Rationale: Per DoD Manual 5200.02 and the SPIPC asset assessment step, undesirable events include unauthorized
disclosure, theft/loss, unauthorized modification, destruction, denial of service, and unauthorized use. Budget overrun is a
program management concern, not a security undesirable event considered in asset assessment.
Q11: During a vulnerability assessment of a SCIF, the assessor notes that the facility uses a
2018-vintage alarm system whose manufacturer has issued three security patches the facility has
not applied. Which vulnerability is most directly identified per the SPIPC framework?
A. A threat from external adversaries
B. A residual vulnerability due to outdated countermeasure effectiveness [CORRECT]
C. An asset consequence-of-loss issue
D. A risk likelihood issue independent of vulnerability
Correct Answer: B
Rationale: An outdated, unpatched alarm system is an existing countermeasure with reduced effectiveness, which creates a
residual vulnerability. Per the SPIPC framework, this is identified during the Vulnerability Assessment step. Option A
conflates threat with vulnerability. Option C is an asset assessment concern. Option D misstates the relationship -
likelihood is a function of threat and vulnerability together.
Q12: A risk assessment yields a risk level of "High" for an asset, but the program manager argues
the risk is acceptable because "no incidents have occurred in five years." Which response best
reflects proper risk management practice per the SPIPC framework?
A. The manager is correct; absence of incidents proves the risk is overstated
B. The manager is confusing historical occurrence with assessed risk; likelihood is threat- and
vulnerability-driven, not event-driven [CORRECT]
C. The manager should re-run the asset assessment only
D. The risk should automatically be downgraded to Low
Correct Answer: B
Rationale: Per the DoD Risk Management Guide, likelihood in the risk assessment step is derived from threat and
vulnerability data - not from historical incident frequency alone. A five-year incident-free period does not reduce threat
capability or vulnerability, and therefore does not justify downgrading assessed risk. Option A is a common but flawed
heuristic. Option C addresses the wrong step. Option D has no methodological basis.
Q13: The prioritization of assets during asset assessment is based primarily on:
A. Asset replacement cost
B. Asset age and lifecycle stage
C. Consequences of loss [CORRECT]
D. Number of users with access
Correct Answer: C
Rationale: The SPIPC content outline explicitly states that asset prioritization is based on the consequences of loss. While
replacement cost, age, and user count may inform asset valuation, they are not the prioritization criterion.
Consequence-of-loss captures the operational, intelligence, and national-security impact that drives protection decisions.
For Certification Preparation Use Page 4
