CSM Physical Security & Access Control Flashcards
6 cards from real CSM practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 CSM Physical Security & Access Control flashcards as text
Which physical security assessment technique involves an authorized person attempting to bypass access controls to identify vulnerabilities?
Answer: Red team/penetration test
A physical penetration test (red team exercise) simulates real attacker techniques to uncover weaknesses in physical controls before malicious actors exploit them.
An organization uses biometric fingerprint readers at its data center entrance. The MAIN advantage of biometrics over PIN-based access is:
Answer: Biometrics verify something you are, which cannot be shared or forgotten
Biometrics authenticate using inherent physical characteristics that cannot be lent, stolen like a card, or forgotten like a PIN, providing stronger identity assurance.
In a layered physical security model, which control serves as the OUTERMOST deterrent layer?
Answer: Perimeter fencing and lighting
Perimeter fencing and lighting form the outermost deterrent layer, establishing a clear boundary and discouraging unauthorized approach before inner controls are encountered.
The principle of 'least privilege' in access control means:
Answer: Users should be granted only the access rights necessary to perform their specific job functions
Least privilege limits each user's access to only what is necessary for their job, minimizing the damage potential from insider threats, compromised credentials, or errors.
A security manager discovers that a terminated employee's access credentials were never revoked. This is an example of a failure in which process?
Answer: Off-boarding/termination procedures
Timely credential revocation is a mandatory step in off-boarding procedures; failure to revoke access creates an insider threat risk from former employees.
What is the purpose of a 'visitor management system' in a secure facility?
Answer: To log, verify, and escort non-employees while limiting their access to authorized areas
Visitor management systems authenticate visitor identity, record entry/exit times, issue temporary credentials, and ensure visitors are escorted to prevent unauthorized access.