📖 Story📚 Glossary🗺️ Concepts💡 Examples🃏 Flashcards✅ Quiz🎯 Tricks
Chapter 7 · Quiz

Physical Security Quiz

Test your knowledge of physical security controls and concepts.

📋 Instructions: Answer all questions, then click Grade Quiz to see your results.
1. A company wants to prevent vehicles from driving through the entrance of their data center while still allowing pedestrian access. Which physical security control is MOST appropriate?
✅ C — Bollards are specifically designed to stop vehicles while allowing pedestrians to pass freely. Fencing defines a perimeter but isn't engineered to stop vehicles at speed. Vestibules control pedestrian entry. Cameras detect but don't prevent vehicle intrusion.
2. An unauthorized person follows an authorized employee through a secured server room door before it closes. Which term describes this attack, and which control would BEST prevent it?
✅ B — Tailgating (piggybacking) is following an authorized person through a secured entry without presenting credentials. An access control vestibule physically prevents this by ensuring only one person can pass through at a time — the outer door must fully close before the inner door can open.
3. A security sensor needs to detect intruders in a large outdoor parking area at night, regardless of lighting conditions. Which sensor type is BEST suited for this requirement?
✅ D — Microwave sensors cover large areas (hundreds to thousands of square meters) with a single unit and are unaffected by lighting. They're ideal for open exterior areas like parking lots. Infrared sensors work in the dark but have shorter range. Ultrasonic is best for enclosed spaces. Pressure sensors only detect at the point of contact.
4. A financial institution requires that the vault can only be opened when two separate authorized employees are both present and both provide credentials simultaneously. Which physical security principle does this implement?
✅ C — Two-person integrity (dual control) requires two authorized individuals to be simultaneously present and cooperating to access a sensitive asset. It is specifically designed to prevent insider threats — one person acting alone (whether malicious, coerced, or compromised) cannot access the vault without a second independent person.
5. A hospital installs facial recognition cameras at secured entries. After installation, the system frequently fails to recognize authorized staff approaching from outside. An audit finds that overhead lights are directly behind approaching staff, creating silhouettes. What was the root cause of the failure?
✅ C — Facial recognition requires proper front-facing illumination to capture distinguishable facial features. Backlighting creates silhouettes and facial shadows, making recognition impossible. Lighting design for security must consider angle, coverage, and avoidance of both shadows (hiding spots) and glare (camera blindness).
6. Matching: Match each sensor type to its primary characteristic.

SENSOR TYPE

Infrared Sensor
Pressure Sensor
Microwave Sensor
Ultrasonic Sensor

CHARACTERISTIC

Detects body heat; works in complete darkness; used in motion detectors
Detects change in force/weight; used on floors and windows
Covers large open areas; emits signals and detects movement in reflection
Emits sound waves; analyzes echoes; best for enclosed spaces
7. Analysis: A company's security audit reveals that their data center has excellent electronic controls (badge readers, CCTV, sensors) but no physical perimeter barriers — anyone can walk up to the building from any direction. What specific risks does this create, and which controls should be prioritized first?
Risks Created by No Physical Perimeter:
• Vehicle ram attack: an attacker can drive directly to the building entrance
• Uncontrolled pedestrian approach: attackers can reach doors, windows, utility access points, dumpsters, and side entries without passing any checkpoint
• CCTV and sensors are reactive (detect after the fact) — without perimeter barriers, an attacker reaches the building before any prevention occurs
• Social engineering facilitated: no chokepoint means no guard sees approaching individuals in advance

Priority Order:
1. Bollards at vehicle approach points — prevents the highest-severity, hardest-to-stop attack (vehicle intrusion)
2. Perimeter fencing — defines the boundary and channels all pedestrian traffic to controlled entry points
3. Single gated entry for vehicles with badge reader or guard verification
4. Signage and CCTV at perimeter line to document and deter

Electronic controls (existing) are now protecting the interior from someone who has already reached the building — the perimeter fixes the outermost layer first, following defense in depth logic.
8. Evaluation: A cost-cutting manager argues: "We have 24/7 security guards and a full CCTV system — we don't need sensors. Sensors are redundant." Evaluate this claim. When, if ever, are sensors truly redundant with guards and cameras?
Disagree — sensors are not redundant with guards and cameras.

Why guards + cameras are insufficient alone:
• Guards have human limitations: fatigue, distraction, bribery, shift gaps
• Cameras require power and can be blinded, cut, or disabled by an attacker
• Cameras require human monitoring — at scale, no one watches every feed constantly
• Cameras record passively — motion detection is a camera feature, not guaranteed in all systems

Why sensors add unique value:
• Infrared sensors detect body heat in complete darkness — unaffected by camera power being cut
• Pressure sensors detect intrusion at the point of contact, independently of any network
• Sensors operate on different systems and power circuits — an attacker who disables cameras does not disable sensors
• Defense in depth principle: each layer (guards, cameras, sensors) must fail independently before the asset is compromised

Conclusion: Sensors are a separate, independent detection layer. They provide coverage exactly when other layers fail — at night, during power disruption, or during targeted attacks on surveillance equipment. "Redundant" implies they do the same thing — they don't. They detect what cameras and tired guards miss.