Osg Cissp
63 community-sourced questions and answers. Free — no login.
False Without control over the physical environment, no amount of administrative or technical/logical access controls can provide adequate security.
True or False: There can be security, even if there is no physical security.
True Malicious actors can perform just about any physical or logical damage or destruction.
True or False: If a malicious person can gain physical access to your facility or equipment, they can do just about anything they want, from destruction to disclosure and alteration.
1) Deterrence, 2) Denial, 3) Detection, 4) Delay It's important to remember this order when deploying physical security controls: first deterrence, then denial, then detection, then delay.
Functional order of controls.
Deterred
Security controls should be deployed so that initial attempts to access physical assets are [blank] (boundary restrictions accomplish this).
Denied
If deterrence fails, then direct access to physical assets should be [blank] (for example, locked vault doors).
Detect / Delayed
If denial fails, your system needs to [blank] intrusion (for example, using motion sensors), and the intruder should be [blank] sufficiently in their access attempts to enable authorities to respond (for example, a cable lock on the asset).
The key elements in making a site selection
Visibility, composition of the surrounding area, area accessibility, and the effects of natural disasters.
A key element in designing a facility for construction
Understanding the level of security needed by your organization and planning for it before construction begins.
False There should NOT be equal access to all locations within a facility.
True or False: There should be equal access to all locations within a facility.
Restricted access
Areas that contain assets of higher value or importance should have what?
In the heart or center of protection provided by a facility
Valuable and confidential assets should be located where?
False In fact, the more human incompatible a server room is, the more protection it will offer against casual and determined attacks.
True or False: Centralized server or computer rooms need to be human compatible.
Wiring closet
Where the networking cables for a whole building or just a floor are connected to other essential equipment, such as patch panels, switches, routers, LAN extenders, and backbone channels.
Physical unauthorized access If an unauthorized intruder gains access to the wiring closet, they may be able to steal equipment, pull or cut cables, or even plant a listening device.
Most of the security for a wiring closet focuses on preventing what?
A mechanism to handle visitors Often an escort is assigned to visitors, and their access and activities are monitored closely.
If a facility employs restricted areas to control physical security, then what's required?
True The untracked action of outsiders can lead to disaster
True or False: Failing to track the actions of outsiders when they are granted access to a protected area can result in malicious activity against the most protected assets.
Administrative, technical, and physical. Understand when and how to use each, and be able to list examples of each kind.
The security controls implemented to manage physical security can be divided into what three groups?
Examples of ADMINISTRATIVE PHYSICAL security controls
Facility construction and selection, site management, personnel controls, awareness training, and emergency response and procedures.
Examples of TECHNICAL PHYSICAL security controls
Access controls; intrusion detection; alarms; closed-circuit television (CCTV); monitoring; heating, ventilation, and air conditioning (HVAC) power supplies; and fire detection and suppression.
Physical security controls
Fencing, lighting, locks, construction materials, mantraps, dogs, and guards.
True The concerns include theft, corruption, and data remnant recovery.
True or False: Media storage facilities should be designed to securely store blank media, reusable media, and installation media.
Media storage facility protections
Locked cabinets or safes, using a librarian/custodian, implementing a check-in/check-out process, and using media sanitization.
Evidence storage
What's used to retain logs, drive images, virtual machine snapshots, and other datasets for recovery, internal investigations, and forensic investigations?
Protections of evidence storage
Dedicated/isolated storage facilities, offline storage, activity tracking, hash management, access restrictions, and encryption.
A security guard or other monitoring system
No matter what, what form of physical access control must be deployed to prevent abuse, masquerading, and piggybacking?
Abuses of physical access control
Propping open secured doors and bypassing locks or access controls.
Masquerading
Using someone else's security ID to gain entry to a facility.
Piggybacking
Following someone through a secured gate or doorway without being identified or authorized personally.
Audit trails and access logs
Useful records as tools for physical access control.
Manually by security guards.
How may audit trails and access logs need to be created?
Automatically, if sufficiently automated access control mechanisms are in place (in other words, smartcards and certain proximity readers).
If not created manually by security guards, how else may audit trails and access logs be generated?
CCTV Through CCTV, you can compare the audit trails and access logs with a visually recorded history of the events. Such information is critical to reconstructing the events of an intrusion, breach, or attack.
You should also consider monitoring entry points with what?
False Most electronic equipment demands clean power in order to function properly.
True or False: Power supplied by electric companies is always consistent and clean.
True Many organizations opt to manage their own power through several means.
True or False: Equipment damage because of power fluctuations is a common occurrence.
Uninterruptible Power Supply (UPS)
This is a type of self-charging battery that can be used to supply consistent clean power to sensitive equipment.
False UPSs also provide continuous power even after the primary power source fails.
True or False: UPSs cannot provide continuous power even after the primary power source fails.
False A UPS can continue to supply power for MINUTES or HOURS depending on its capacity and the draw by equipment.
True or False: A UPS can continue to supply power for days or weeks depending on its capacity and the draw by equipment.
Fault
A momentary loss of power
Blackout
A complete loss of power
Sag
Momentary low voltage
Brownout
Prolonged low voltage
Spike
Momentary high voltage
Surge
Prolonged high voltage
Inrush
An initial surge of power usually associated with connecting to a power source, whether primary or alternate/secondary
Noise
A steady interfering power disturbance or fluctuation
Transient
A short duration of line noise disturbance
Clean
Nonfluctuating pure power
Ground
The wire in an electrical circuit that is grounded
Control over the HVAC mechanisms
In addition to power considerations, maintaining the environment involves what?
60 to 75 degrees Fahrenheit (15 to 23 degrees Celsius)
Rooms containing primarily computers should be kept between what temperatures?
40% and 60%
Between what percentages of humidity should a computer room be maintained?
Corrosion / Static electricity.
Too much humidity can cause this, and too little humidity can cause that.
True Even minimal levels of static discharge can destroy electronic equipment.
True or False: Even on nonstatic carpeting, if the environment has low humidity it is still possible to generate 20,000-volt static discharges.
False Environmental safety policy and procedures should address water leakage and flooding.
True or False: Water leakage and flooding should not be addressed in your environmental safety policy and procedures.
True Plumbing leaks are not an everyday occurrence, but when they occur, they often cause significant damage. Water and electricity don't mix. If your computer systems come in contact with water, especially while they are operating, damage is sure to occur.
True or False: Whenever possible, locate server rooms and critical computer equipment away from any water source or transport pipes.
True Keep in mind of fire detection and suppression for your facilities storing and protecting IT.
True or False: Fire detection and suppression must not be overlooked.
Protecting personnel from harm Preventing harm to people is the most important goal for all security solutions.
In all circumstances and under all conditions, what should always be the most important goal/aspect of any security or protection system?
Yes Fire detection and suppression is designed to keep damage caused by fire, smoke, heat, and suppression materials to a minimum.
Yes or No: In addition to protecting people, is fire detection and suppression designed to keep damage caused by fire, smoke, heat, and suppression materials to a minimum, especially in regard to the IT infrastructure?
No The destructive elements of a fire include smoke and heat but ALSO the suppression medium, such as water or soda acid.
Yes or No: The destructive elements of a fire include smoke and heat but not the suppression medium, such as water or soda acid.
Yes Smoke is damaging to most storage devices.
Yes or No: Smoke is damaging to most storage devices.
False Heat CAN damage any electronic or computer component.
True or False: Heat cannot damage any electronic or computer component.
True Suppression systems can help but also cause problems, or damage/destroy equipment.
True or False: Suppression mediums can cause short circuits, initiate corrosion, or otherwise render equipment useless.
False ALL issues caused by a fire and suppression must be addressed when designing a fire response system.
True or False: Not all issues caused by a fire and suppression issues must be addressed when designing a fire response system
Looking for a different version?
CBTs get updated every year. Search for the exact version you're taking (e.g. "cyber awareness 2025").
Search all study materials