CPI Physical Security & Access Control Flashcards

What is the purpose of a security 'vulnerability assessment' as distinct from a security inspection?

Answer: A vulnerability assessment identifies weaknesses and potential attack vectors; an inspection verifies compliance with standards

A vulnerability assessment proactively identifies exploitable weaknesses, while a security inspection verifies that security measures meet defined standards.

A CPI inspects a server room and finds the door uses a standard push-button combination lock with an unchanged factory code. What is the primary recommendation?

Answer: Immediately change the code to a strong, non-default combination and establish a rotation policy

Default or factory codes are publicly known and must be changed immediately; a rotation policy ensures codes remain secure over time.

During an inspection, a CPI finds that a key control log shows 12 keys issued but only 10 returned. What should be the inspector's recommendation?

Answer: Re-key or replace affected locks and conduct an investigation to locate the missing keys

Missing keys represent an uncontrolled access risk; affected locks must be re-keyed and a full investigation conducted to prevent unauthorized access.

What is the recommended approach for securing windows on the ground floor of a high-security facility?

Answer: Laminated security glazing, window bars or grilles, and contact/break sensors

Laminated glazing resists breaking, physical bars prevent forced entry, and sensors detect attempts, providing layered window security.

A facility's parking lot has no lighting, no barriers, and vehicles park within 10 feet of the building. What threat does this primarily create?

Answer: Vehicle-borne improvised explosive device (VBIED) threat and perimeter intrusion risk

Vehicles parked close to a building create a VBIED blast risk; standoff distance and vehicle barriers are critical physical security controls.

Which document provides federal guidelines for physical security of critical infrastructure facilities in the United States?

Answer: DHS/CISA Physical Security Performance Goals and Baseline Standards

CISA (Cybersecurity and Infrastructure Security Agency) publishes Physical Security Performance Goals that guide critical infrastructure protection.