CISSP Practice

102. Biometrics-based access controls are implemented using which of the following?

a. Administrative and directive controls

b. Physical and logical controls

c. Management and preventive controls

d. Corrective and recovery controls

102. b. Physical controls (e.g., memory cards, smart cards, or hardware tokens) are used to identify a user, and logical controls (e.g., fingerprint or voice print) are used to authenticate the same user.

103. Protective lighting does which of the following for computer facilities?

a. Detection and correction

b. Deterrent and detection

c. Correction and action

d. Protection and correction

103. b. Protective lighting should act as a deterrent and make detection likely. The lighting should enable the security staff to observe others without being seen.

104. The effectiveness of physical security controls is most determined by which of the following?

a. Control device used

b. Vulnerabilities in the device

c. Implementation of the device

d. Planning device used

104. b. Organizations should determine whether intruders could easily defeat the controls (i.e., vulnerabilities) in the access control devices. Until the vulnerabilities are eliminated, implementation and operation of the control device do not matter much.

105. Which of the following intruder detection systems cannot be used as a primary system?

a. Photoelectric detection systems

b. Motion detection systems

c. Proximity detection systems

d. Audio detection systems

105. c. Proximity detection systems identify the approach or presence of an object or an individual. It is designed to be supplemental and cannot be used effectively as a primary system because of the system’s vulnerability to nuisance alarms caused by electric supply fluctuations and by the presence of mops, pails, and so on placed near the system. Animals and birds can trigger a system alarm if it is too sensitive. Therefore, proximity systems should be backed up by other security systems. Photoelectric systems operate based on light, motion systems operate based on signal, and audio systems operate based on sound.

106. Which of the following controls the mantraps in a computer center?

a. A person’s body weight and a smart card

b. A person’s body weight and a biometric feature

c. A person’s body weight and a memory card

d. A person’s body weight and a personal identification number

106. b. Mantraps are used in highly-sensitive areas and have a built-in weighing scale. The mantrap-controlling software looks at a combination of a person’s body weight and a biometric feature such as fingerprint scan, hand geometry, facial recognition, iris scan, and voice recognition, and compares it to stored information about that person. Smart cards, memory cards, and personal identification numbers (PINs) can be stolen or lost, and they are a weak form of authentication even when combined with the body weight. A person’s body weight and a biometric features authenticate what the user is, which is stronger than the other controls.

107. The primary function of a physical protection system should be performed in which of the following order?

a. Detection, response, and delay

b. Detection, delay, and response

c. Delay, detection, and response

d. Response, delay, and detection

107. b. A physical protection system must accomplish its objectives by either deterrence or a combination of detection, delay, and response, in that order.

108. What must begin after a physical intrusion detection alarm is initiated and reported?

a. Communication

b. Interruption

c. Assessment

d. Deployment

108. c. When a physical intrusion detection alarm is initiated and reported, situation assessment begins. You need to know whether the alarm is a valid or a nuisance alarm and details about the cause of the alarm.

109. Which of the following is the most costly countermeasure to reduce physical security risks?

a. Procedural controls

b. Hardware devices

c. Electronic systems

d. Personnel

109. d. Personnel such as security guards are the greatest expense due to direct salaries plus fringe benefits paid to them. It is good to use people only in those areas where procedural controls, hardware devices, or electronic systems cannot be utilized at all or cannot be utilized more effectively.