CSP Cheat Sheet 2026

The 30 highest-yield CSP facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. A surveillance analyst receives a subpoena for all documentation related to a closed case. The FIRST step should be to: → Notify legal counsel and place a litigation hold on all related records
2. How does casino & gaming surveillance contribute to professional excellence in CSP certification? → It enhances competency, improves outcomes, and supports continuous professional growth
3. The term 'eye in the sky' historically referred to: → Overhead catwalks with one-way mirrors used by surveillance personnel
4. Which video analytics technique is most effective for detecting loitering in a defined zone? → Dwell-time analysis
5. What is the primary purpose of covert surveillance in a security investigation? → To gather information or evidence without the subject's knowledge
6. Which hash algorithm is currently recommended for forensic evidence integrity verification due to its resistance to collision attacks? → SHA-256
7. During slot surveillance, a technician is observed accessing a machine outside normal maintenance windows without a work order. Surveillance should: → Document the activity, note the time and employee ID, and notify the supervisor
8. How does video analytics & ai monitoring contribute to professional excellence in CSP certification? → It enhances competency, improves outcomes, and supports continuous professional growth
9. Under the Federal Rules of Evidence, electronically stored information (ESI) must meet what standard to be admissible? → It must be authentic, relevant, and its integrity must be verifiable
10. When documenting a subject's behavior for use in an interrogation strategy, which detail is LEAST relevant to include? → Brand of the subject's clothing
11. A perimeter intrusion detection system (PIDS) generates an alert every time a cat walks near the fence. This is an example of: → A nuisance alarm (false positive)
12. A suspect exits a building and immediately takes a circuitous route through alleys before entering a vehicle. This behavior MOST likely indicates: → Counter-surveillance measures
13. For a surveillance report to be admissible in civil litigation, it must generally demonstrate: → Authenticity, relevance, and that it was prepared without spoliation
14. Which of the following actions would MOST likely break the chain of custody for a USB drive containing surveillance footage? → Leaving the drive unattended and unsecured in an unlocked office overnight
15. Which practice BEST prevents unauthorized access to sensitive surveillance documentation? → Role-based access controls limiting document access to authorized personnel
16. In AI surveillance, 'transfer learning' refers to which practice? → Adapting a pre-trained model to a new surveillance task with minimal new data
17. In loss prevention, 'shrinkage visibility' refers to: → The ability of management to measure and track inventory losses accurately
18. When using night vision equipment classified as Generation 3, the primary image intensification technology employed is: → Gallium arsenide photocathode with microchannel plate amplification
19. When implementing evidence preservation & chain of custody practices, what should CSP professionals prioritize? → Alignment with professional standards, stakeholder needs, and organizational goals
20. A surveillance operator notices AI analytics flagging shadows as intruders frequently. What is the BEST corrective action? → Retrain the model with shadow examples labeled as non-threats
21. What type of surveillance involves following a subject on foot or by vehicle? → Mobile surveillance
22. When implementing video analytics & ai monitoring practices, what should CSP professionals prioritize? → Alignment with professional standards, stakeholder needs, and organizational goals
23. An analyst writes 'the subject appeared nervous' in a surveillance report. This statement is problematic because it is: → A subjective interpretation rather than an objective observation
24. Which type of communication is most appropriate for coordinating a mobile surveillance team to avoid compromising the operation? → Encrypted radio or secure push-to-talk applications
25. When conducting a civil demand program after apprehending a shoplifter, what must the loss prevention agent ensure? → A lawful detention and recovery of merchandise occurred before issuing the demand
26. Which practice helps protect a surveillance network against 'credential stuffing' attacks? → Implementing unique passwords per device combined with account lockout policies
27. A surveillance system administrator wants to ensure that only authorized applications run on the surveillance server. Which security control best achieves this? → Application whitelisting
28. When scheduling surveillance personnel, which factor is MOST critical to maintaining effective monitoring coverage? → Ensuring adequate staffing during peak risk hours and shift overlaps for continuity
29. Social engineering attacks targeting employees with legitimate system access are most effectively countered at which risk mitigation level? → Personnel security and awareness training
30. How does continuing education support retail theft & shoplifting prevention competency? → It ensures practitioners remain current with evolving methodologies and standards