CSC Access Control & Perimeter Security 3 — Questions and Answers
Question 1: Which principle states that an access control system should default to denying access unless explicit permission has been granted?
- Least privilege
- Need to know
- Default deny (fail-secure) (Correct answer)
- Separation of duties
Correct answer: Default deny (fail-secure)
The default deny or fail-secure principle ensures that access is blocked unless it has been explicitly authorized, minimizing unintended access.
Question 2: A security consultant is evaluating electronic access control readers. Which technology is MOST vulnerable to cloning attacks without additional protections?
- Smart card with PKI certificates
- 125 kHz proximity (Prox) cards (Correct answer)
- 13.56 MHz MIFARE DESFire EV2
- FIDO2 hardware tokens
Correct answer: 125 kHz proximity (Prox) cards
125 kHz proximity cards transmit their card number in cleartext and are easily cloned using inexpensive readers available online.
Question 3: What is the purpose of a 'crash-rated' vehicle barrier rating system such as ASTM F2656?
- Rating the aesthetics of security barriers in urban environments
- Certifying barriers based on their ability to stop a defined vehicle at a specific speed (Correct answer)
- Classifying barriers by material composition for fire resistance
- Grading pedestrian flow capacity of entry control points
Correct answer: Certifying barriers based on their ability to stop a defined vehicle at a specific speed
ASTM F2656 (and its predecessor K-ratings) certifies vehicle barriers by the vehicle class and speed they can stop, and how far the vehicle penetrates.
Question 4: In access control terminology, what is 'dual control' (also called two-person integrity)?
- Using two authentication factors for a single user
- Requiring two authorized individuals to be present for high-risk actions (Correct answer)
- Maintaining two separate access logs for audit purposes
- Installing redundant locks on high-security doors
Correct answer: Requiring two authorized individuals to be present for high-risk actions
Dual control requires two authorized individuals to jointly perform a sensitive action, preventing any single person from acting alone on critical tasks.
Question 5: A perimeter intrusion detection system (PIDS) uses fiber-optic sensing cables buried along a fence line. What type of intrusion detection technology is this?
- Microwave volumetric detection
- Ported coaxial cable detection
- Distributed acoustic sensing (DAS) (Correct answer)
- Passive infrared (PIR) detection
Correct answer: Distributed acoustic sensing (DAS)
Distributed acoustic sensing (DAS) uses fiber-optic cables to detect vibrations caused by digging, cutting, or climbing along a perimeter.
Question 6: Which access control concept ensures that an employee who transfers to a new role does NOT retain permissions from their previous role?
- Least privilege
- Privilege creep prevention / access revocation (Correct answer)
- Separation of duties
- Role explosion mitigation
Correct answer: Privilege creep prevention / access revocation
Preventing privilege creep requires revoking old permissions when a user changes roles so they only hold permissions relevant to their current duties.
Question 7: What is the primary advantage of using an 'anti-passback' feature in an electronic access control system?
- Preventing the same credential from being used to enter and exit in the wrong sequence (Correct answer)
- Blocking unauthorized visitors from leaving without an escort
- Encrypting credential data during transmission between readers
- Alerting security when a door is held open too long
Correct answer: Preventing the same credential from being used to enter and exit in the wrong sequence
Anti-passback prevents a credential from being used to re-enter an area before it has been used to exit, stopping card sharing and tailgating.
CSC Access Control & Perimeter Security 3
Which principle states that an access control system should default to denying access unless explicit permission has been granted?