CISSP Physical Security 5 — Questions and Answers
Question 1: An organization is selecting a backup site for disaster recovery. Which site type offers the FASTEST recovery time but at the HIGHEST cost?
- Cold site
- Warm site
- Hot site (Correct answer)
- Mobile site
Correct answer: Hot site
A hot site is a fully operational duplicate facility with live data replication, enabling near-immediate failover at the highest cost.
Question 2: What physical security risk does 'shoulder surfing' represent?
- Unauthorized physical access through a secured door
- Observing sensitive information displayed on a screen or entered on a keypad (Correct answer)
- Installing a covert listening device in a secure area
- Cloning an employee's access badge using a skimmer
Correct answer: Observing sensitive information displayed on a screen or entered on a keypad
Shoulder surfing involves directly observing a target entering PINs, passwords, or viewing confidential data on a screen.
Question 3: Which standard provides the framework for physical and environmental security controls referenced in CISSP domain knowledge?
- NIST SP 800-53
- PCI DSS
- ISO/IEC 27001 (Correct answer)
- SOC 2 Type II
Correct answer: ISO/IEC 27001
ISO/IEC 27001 Annex A.11 specifically addresses physical and environmental security controls and is a globally recognized standard.
Question 4: A security professional is assessing the risk of TEMPEST attacks against a government facility. What is the PRIMARY concern?
- Physical theft of computing hardware
- Interception of electromagnetic emanations from electronic equipment (Correct answer)
- Unauthorized access via social engineering
- Denial of service against facility control systems
Correct answer: Interception of electromagnetic emanations from electronic equipment
TEMPEST attacks exploit unintentional electromagnetic emissions from equipment to reconstruct data without physical access.
Question 5: What is the BEST practice for securing a wiring closet in a commercial office building?
- Label all cables clearly for easy identification
- Lock the closet and restrict access to authorized IT personnel only (Correct answer)
- Install a UPS inside the closet
- Use color-coded cable management trays
Correct answer: Lock the closet and restrict access to authorized IT personnel only
Wiring closets contain network and telephony infrastructure; physical access must be restricted to prevent tampering or wiretapping.
Question 6: During a fire evacuation, which principle should override the normal physical security access controls?
- Least privilege
- Life safety takes precedence over asset protection (Correct answer)
- Defense in depth
- Mandatory access control
Correct answer: Life safety takes precedence over asset protection
Life safety is the highest priority; security controls must not impede safe evacuation even if they temporarily reduce physical security.
Question 7: Which physical security control is MOST effective against dumpster diving attacks?
- Security cameras pointed at trash areas
- Cross-cut shredding of all sensitive documents before disposal (Correct answer)
- Locked dumpsters with restricted access
- Security guard patrols near waste areas
Correct answer: Cross-cut shredding of all sensitive documents before disposal
Cross-cut shredding renders discarded documents unreadable, eliminating the information value of anything recovered from trash.
CISSP Physical Security 5
An organization is selecting a backup site for disaster recovery.
Which site type offers the FASTEST recovery time but at the HIGHEST cost?