ATP Physical & Cyber Security Integration 2 — Questions and Answers
Question 1: A facility uses badge readers that log entry times to a central SIEM. An attacker tailgates an employee through a door without badging in. Which converged security control would BEST detect this anomaly?
- Comparing badge-in counts to video-based people counters at the same door (Correct answer)
- Increasing badge reader sensitivity thresholds
- Deploying additional perimeter fencing around the building
- Requiring employees to change badge PINs monthly
Correct answer: Comparing badge-in counts to video-based people counters at the same door
Correlating physical badge logs with video-based occupancy counts in the SIEM reveals tailgating when the headcount exceeds badge events.
Question 2: Which framework specifically addresses the convergence of physical and logical access control within critical infrastructure sectors?
- NIST SP 800-116 (Correct answer)
- ISO 9001
- PCI DSS v4.0
- COBIT 2019
Correct answer: NIST SP 800-116
NIST SP 800-116 provides guidance on the use of PIV credentials in physical and logical access control systems for federal facilities.
Question 3: A power outage causes electronic locks to fail open on a server room door. What is the correct term for this default behavior, and is it typical for high-security environments?
- Fail-safe; it is common in life-safety paths but should be fail-secure for server rooms (Correct answer)
- Fail-secure; it is the required default for all access control doors
- Fail-soft; it is recommended for all IT areas to maintain availability
- Fail-over; it is mandatory under NFPA 101 for data centers
Correct answer: Fail-safe; it is common in life-safety paths but should be fail-secure for server rooms
Fail-safe (unlocked on power loss) protects occupant egress but is inappropriate for server rooms, which should use fail-secure (locked on power loss) locks.
Question 4: During a penetration test, a tester plugs a rogue Raspberry Pi into an unsecured Ethernet port in a lobby kiosk. Which integrated control would MOST effectively have prevented this?
- 802.1X port-based network access control combined with physical port lockout covers on unused jacks (Correct answer)
- Only a firewall rule blocking unknown MAC addresses
- Disabling DHCP on the lobby VLAN
- Placing the kiosk in a locked cage
Correct answer: 802.1X port-based network access control combined with physical port lockout covers on unused jacks
802.1X authenticates devices before granting network access, and physical port covers prevent unauthorized cable insertion in public spaces.
Question 5: A security team is designing a mantrap (airlock vestibule) for a data center. Which cyber security control should be integrated into the mantrap to strengthen identity assurance?
- Multi-factor authentication combining biometric scan and smart card before the inner door opens (Correct answer)
- A firewall appliance mounted inside the mantrap enclosure
- A web application proxy for remote desktop sessions
- An intrusion detection sensor monitoring outbound traffic
Correct answer: Multi-factor authentication combining biometric scan and smart card before the inner door opens
Integrating biometrics and smart card MFA into the mantrap enforces two-factor physical identity verification before granting data center access.
Question 6: Which type of attack exploits the physical proximity of a wireless card to clone RFID badge credentials without the victim's knowledge?
- Skimming attack using a long-range RFID reader (Correct answer)
- Shoulder surfing attack
- Bluesnarfing attack
- Evil twin Wi-Fi attack
Correct answer: Skimming attack using a long-range RFID reader
RFID skimming uses a concealed reader to capture low-frequency or high-frequency badge data from cards within reading range.
Question 7: An organization's CISO wants to ensure that a terminated employee's physical badge and network account are both revoked within one hour. What process best achieves this?
- Automated provisioning workflow that triggers simultaneous deactivation in the PACS and IAM system upon HR termination record update (Correct answer)
- Manual helpdesk tickets submitted separately to physical security and IT
- Weekly batch job that syncs terminated employee lists between HR and IT
- Requiring the employee to surrender the badge at the exit interview before IT is notified
Correct answer: Automated provisioning workflow that triggers simultaneous deactivation in the PACS and IAM system upon HR termination record update
An automated, integrated workflow driven by the HR system ensures both physical and logical access are revoked simultaneously and within the required timeframe.
ATP Physical & Cyber Security Integration 2
A facility uses badge readers that log entry times to a central SIEM.
An attacker tailgates an employee through a door without badging in.
Which converged security control would BEST detect this anomaly?