Physical & Cyber Security Integration Flashcards

A facility uses badge readers that log entry times to a central SIEM. An attacker tailgates an employee through a door without badging in. Which converged security control would BEST detect this anomaly?

Answer: Comparing badge-in counts to video-based people counters at the same door

Correlating physical badge logs with video-based occupancy counts in the SIEM reveals tailgating when the headcount exceeds badge events.

Which framework specifically addresses the convergence of physical and logical access control within critical infrastructure sectors?

Answer: NIST SP 800-116

NIST SP 800-116 provides guidance on the use of PIV credentials in physical and logical access control systems for federal facilities.

A power outage causes electronic locks to fail open on a server room door. What is the correct term for this default behavior, and is it typical for high-security environments?

Answer: Fail-safe; it is common in life-safety paths but should be fail-secure for server rooms

Fail-safe (unlocked on power loss) protects occupant egress but is inappropriate for server rooms, which should use fail-secure (locked on power loss) locks.

During a penetration test, a tester plugs a rogue Raspberry Pi into an unsecured Ethernet port in a lobby kiosk. Which integrated control would MOST effectively have prevented this?

Answer: 802.1X port-based network access control combined with physical port lockout covers on unused jacks

802.1X authenticates devices before granting network access, and physical port covers prevent unauthorized cable insertion in public spaces.

A security team is designing a mantrap (airlock vestibule) for a data center. Which cyber security control should be integrated into the mantrap to strengthen identity assurance?

Answer: Multi-factor authentication combining biometric scan and smart card before the inner door opens

Integrating biometrics and smart card MFA into the mantrap enforces two-factor physical identity verification before granting data center access.

Which type of attack exploits the physical proximity of a wireless card to clone RFID badge credentials without the victim's knowledge?

Answer: Skimming attack using a long-range RFID reader

RFID skimming uses a concealed reader to capture low-frequency or high-frequency badge data from cards within reading range.

An organization's CISO wants to ensure that a terminated employee's physical badge and network account are both revoked within one hour. What process best achieves this?

Answer: Automated provisioning workflow that triggers simultaneous deactivation in the PACS and IAM system upon HR termination record update

An automated, integrated workflow driven by the HR system ensures both physical and logical access are revoked simultaneously and within the required timeframe.