CSP Access Control & Perimeter Security 3 — Questions and Answers
Question 1: A security manager must choose between single-factor and multi-factor authentication for a high-security server room. What defines multi-factor authentication (MFA)?
- Using two different passwords entered sequentially
- Combining two or more of: something you know, something you have, something you are (Correct answer)
- Requiring two guards to verify identity simultaneously
- Using a card reader at both entry and exit points
Correct answer: Combining two or more of: something you know, something you have, something you are
MFA requires verification through at least two distinct factor categories — knowledge, possession, and inherence (biometrics) — providing stronger assurance than any single factor alone.
Question 2: Which biometric modality is considered most accurate for large-scale one-to-many identification (1:N) in high-security environments?
- Hand geometry
- Voice recognition
- Iris recognition (Correct answer)
- Fingerprint with optical sensor
Correct answer: Iris recognition
Iris recognition has one of the highest uniqueness and accuracy rates among biometrics, making it well-suited for 1:N identification in high-security applications.
Question 3: A perimeter intrusion detection system (PIDS) generates an alert every time a cat walks near the fence. This is an example of:
- A nuisance alarm (false positive) (Correct answer)
- A missed detection (false negative)
- A confirmed intrusion alert
- A system fault alarm
Correct answer: A nuisance alarm (false positive)
A nuisance alarm (false positive) occurs when the system triggers an alert for a non-threatening stimulus, such as small animals, degrading operator confidence.
Question 4: Under NFPA 101 Life Safety Code, which requirement takes precedence when a door serves both access control and fire egress functions?
- Security must always override egress to prevent unauthorized exit
- The door must unlock automatically upon fire alarm activation to allow free egress (Correct answer)
- A guard must manually unlock the door within 60 seconds of a fire alarm
- Electronic locks may remain energized as long as a key override exists
Correct answer: The door must unlock automatically upon fire alarm activation to allow free egress
NFPA 101 requires that electrically locked egress doors release automatically upon fire alarm activation, since life safety always supersedes access control security.
Question 5: What is 'tailgating' in the context of physical access control, and what technology directly addresses it?
- Copying an access card signal; addressed by Faraday cage shielding
- Following an authorized person through a secured door without independent authentication; addressed by mantraps or optical turnstiles (Correct answer)
- Bypassing a PIN by watching over someone's shoulder; addressed by privacy screens
- Propping open a fire door; addressed by door position sensors alone
Correct answer: Following an authorized person through a secured door without independent authentication; addressed by mantraps or optical turnstiles
Tailgating occurs when an unauthorized individual follows an authorized user through a controlled door; mantraps and optical turnstiles physically enforce one-person-at-a-time passage.
Question 6: Which fence height is generally considered the minimum deterrent standard for a medium-security perimeter in US government guidelines?
- 4 feet
- 6 feet
- 8 feet (Correct answer)
- 12 feet
Correct answer: 8 feet
US government and industry guidelines typically specify a minimum of 8 feet of chain-link fencing, often topped with barbed wire, as the baseline for medium-security perimeters.
Question 7: A CSP is designing an access control system using 'role-based access control' (RBAC). What is the core principle of RBAC?
- Access rights are granted based on individual user identity verified by biometrics
- Permissions are assigned to roles, and users are granted access by being assigned to roles (Correct answer)
- Each user negotiates their own access level with the security administrator
- Access is determined dynamically by time-of-day and location attributes
Correct answer: Permissions are assigned to roles, and users are granted access by being assigned to roles
RBAC assigns permissions to defined roles (e.g., 'guard,' 'manager,' 'IT admin'), and access is granted by assigning users to appropriate roles, simplifying large-scale administration.
CSP Access Control & Perimeter Security 3
A security manager must choose between single-factor and multi-factor authentication for a high-security server room.
What defines multi-factor authentication (MFA)?