CSM CSM Physical Security & Access Control 1 — Questions and Answers
Question 1: Which access control model grants permissions based on an individual's job role within an organization?
- Discretionary Access Control (DAC)
- Mandatory Access Control (MAC)
- Role-Based Access Control (RBAC) (Correct answer)
- Attribute-Based Access Control (ABAC)
Correct answer: Role-Based Access Control (RBAC)
RBAC assigns permissions based on predefined job roles, simplifying administration by grouping users with similar access needs.
Question 2: A security manager is designing a facility entry system requiring two independent authentication factors. This is an example of:
- Tailgating prevention
- Multi-factor authentication (MFA) (Correct answer)
- Biometric override
- Mantrap deployment
Correct answer: Multi-factor authentication (MFA)
MFA requires two or more independent authentication factors (something you know, have, or are) to verify identity before granting access.
Question 3: What physical security control is specifically designed to prevent one individual from following another through a secured entry point without authenticating?
- Turnstile
- Mantrap (airlock) (Correct answer)
- Guard booth
- CCTV coverage
Correct answer: Mantrap (airlock)
A mantrap (airlock) is a controlled entry vestibule that allows only one person through at a time, preventing tailgating by requiring individual authentication.
Question 4: Under the ASIS International standards, the 'defense in depth' principle in physical security refers to:
- Installing the deepest possible vault doors
- Layering multiple security controls so that failure of one does not compromise the entire system (Correct answer)
- Burying security cables underground
- Conducting background checks at multiple levels
Correct answer: Layering multiple security controls so that failure of one does not compromise the entire system
Defense in depth uses multiple overlapping security layers so that an attacker must defeat several controls, reducing the likelihood of a successful breach.
Question 5: Which document typically defines the authority levels, zones, and time-based access rules for a facility's access control system?
- Security incident report
- Access control matrix (Correct answer)
- Business continuity plan
- Vulnerability assessment
Correct answer: Access control matrix
An access control matrix maps users or roles to specific resources, defining what access is permitted, at what times, and in which security zones.
Question 6: A security manager notices that employees are propping open secured doors for convenience. The BEST long-term corrective action is to:
- Issue disciplinary warnings to offenders
- Redesign workflows and entry points to eliminate the inconvenience driving the behavior (Correct answer)
- Add more cameras near the doors
- Increase security patrols
Correct answer: Redesign workflows and entry points to eliminate the inconvenience driving the behavior
Addressing root-cause inconvenience through redesign is more sustainable than punitive measures, as security controls that hinder workflow are routinely defeated by staff.
CSM CSM Physical Security & Access Control 1
Which access control model grants permissions based on an individual's job role within an organization?