Physical Access Controls — CC Study Guide

Unlock the complete study guide + 1,040 practice questions across 16 full exams.

Bundled into the existing Certified in Cybersecurity premium course — no separate purchase.

Included in this chapter:

The deter, deny, detect, delay, respond chain
Entry devices: locks, gates, badges, and credential strength
Authorized vs unauthorized: tailgating, piggybacking, and the mantrap
Monitoring, environmental design, and exam patterns

Building credentials and entry devices, weakest to strongest assurance

Device	Key or combination lock	Proximity (prox) card	Smart card	Biometric reader
How it authenticates	Something you have (key) or know (combination)	Static RFID identifier read wirelessly	Embedded chip performing cryptographic check	Something you are (fingerprint, iris, face)
Resistance to cloning	Keys can be copied; combinations can be shared	Low, broadcasts a copyable identifier	High, chip keys cannot be skimmed and copied	High, but can be spoofed without liveness checks
Logs the individual	No, a key does not identify who used it	Yes, the card ID is recorded at the reader	Yes, the card ID is recorded at the reader	Yes, the person is identified directly
On loss or compromise	Re-key the lock or change the combination	Revoke the card ID in the system	Revoke the card ID in the system	Cannot be reissued, pair with a second factor
Stops tailgating	No, authenticates the credential, not the count	No, same gap	No, same gap	No, same gap

Decision tree

Cheat sheet

Physical access controls protect the facility, hardware, and people that every other control assumes are safe
Layer physical controls along the deter, deny, detect, delay, respond chain
A control's function tells you which link in the chain it fills, so match the verb in the question
A door enforces the credential, not the headcount, so no reader stops tailgating
Tailgating is without the insider's knowledge; piggybacking is with their consent
An access-control vestibule (mantrap) admits one person at a time to stop tailgating
A full-height turnstile prevents tailgating; an optical turnstile only detects it
Visitor escort, sign-in logs, and awareness training back up the anti-tailgating hardware
PE-3 names the physical access devices: keys, locks, combinations, biometric readers, card readers
Re-key or revoke when a key is lost or an employee leaves
A proximity card broadcasts a static ID and is easily cloned; a smart card authenticates cryptographically
A biometric identifies the person directly but cannot be reissued, so pair it with a second factor
Cards and biometrics log the individual; a shared physical key logs nothing
CCTV is a detective control: it records and observes but does not stop an intruder
PE-6 monitors physical access with guards, video surveillance, and sensor devices
CPTED reduces crime through natural surveillance, access control, and territorial reinforcement
Put sensitive equipment in the interior core, arranged as concentric zones (defensible space)
A visitor log's purpose is an audit trail of who was in the facility and when
Security guards add human judgment that automated access controls cannot replicate
Integrating CCTV with alarm systems lets operators visually verify what tripped an alarm
CCTV footage retention is set by organizational policy and legal or compliance requirements
Store sensitive media and equipment in a locked cabinet or rack with restricted keys and access logging
Fail-secure doors stay locked on power loss but must still allow emergency egress
Bollards block vehicle attacks, and active barriers move while passive ones stay fixed
An electronic access control system both authenticates the person and authorizes the entry

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf