Physical & Cyber Security Integration Flashcards
7 cards from real ATP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Physical & Cyber Security Integration flashcards as text
A red team is tasked with testing both physical and cyber defenses simultaneously. Which methodology BEST describes this type of engagement?
Answer: Physical penetration test combined with network exploitation in a purple team or full-spectrum red team exercise
A full-spectrum red team exercise tests the interplay between physical security and cyber defenses by attempting real-world, combined attack scenarios.
Which lighting standard is commonly referenced when designing secure perimeter lighting to deter physical intrusion and support camera effectiveness?
Answer: IESNA RP-33 (Lighting for Exterior Environments) providing minimum foot-candle levels for security zones
IESNA RP-33 provides recommended illuminance levels for exterior security zones, ensuring cameras can capture usable footage and deterring intruders.
A hospital's electronic health record (EHR) terminals are in semi-public corridors. Which combination of physical and cyber controls is MOST appropriate?
Answer: Privacy screens, automatic screen lock after 60 seconds of inactivity, and proximity-card login
Privacy screens limit visual eavesdropping, auto-lock prevents unauthorized access when a clinician steps away, and proximity cards enable fast, audited re-authentication.
What is 'defense-in-depth' when applied to a converged physical-cyber security architecture?
Answer: Layering multiple independent physical and cyber controls so that defeating one layer does not compromise the entire system
Defense-in-depth uses multiple, independent layers of physical barriers and cyber controls so an attacker must breach every layer to succeed.
A cybercriminal sends a technician a fake work order to gain escorted access to a data center to plant a hardware keylogger. This attack is BEST classified as:
Answer: Physical social engineering (pretexting) combined with a hardware-based cyber implant
Pretexting uses a fabricated scenario to manipulate people into granting physical access, which is then exploited to install a cyber-enabling hardware device.
In a Zero Trust Architecture (ZTA), how does physical location factor into access decisions?
Answer: Physical location (GPS, IP geolocation, network segment) is treated as one contextual signal among many and is never implicitly trusted
ZTA evaluates physical location as one risk signal but requires continuous verification of identity, device health, and behavior regardless of location.
Which protocol is used by most modern Physical Access Control Systems (PACS) to communicate between controllers and readers, and what is a known vulnerability of its older versions?
Answer: Wiegand protocol; it transmits credentials in cleartext with no encryption or mutual authentication
The Wiegand protocol, used in most legacy PACS, sends card data in unencrypted, unauthenticated serial pulses that can be intercepted and replayed.