Physical and Environmental Security
This domain tests whether you can spot physical routes into information and the environmental risks that take systems down. Questions are usually short situational items about doors, desks, devices and server rooms.
Controlling access to spaces
Badges, PINs, visitor logs and escorted visitors, mantraps for sensitive areas, and challenge procedures for anyone without a visible badge. Tailgating, also called piggybacking, is someone following an authorized person through a controlled door; the defense is polite challenge and escort, not confrontation. Report unescorted strangers and propped doors.
Desk and screen discipline
Clean desk means no sensitive papers or removable media left out at end of day. Clear screen means locking the session whenever you step away. Store paper in locked cabinets, use shred consoles for confidential waste, and never keep passwords on sticky notes or under keyboards. Position screens away from windows and public view.
Device physical security
Cable locks in shared spaces, secure storage overnight, privacy screens when traveling, carry devices as hand luggage, and report loss or theft immediately so remote wipe and revocation can start.
Environmental controls
Fire detection plus clean-agent or inert-gas suppression, because water damages electronics. UPS for short outages and generators for extended ones. Temperature and humidity control, water-leak detection, cable management, and raised floors in data centers. Fire exits and extinguisher types matter: never use water on electrical fires.
Worked example
An employee carrying boxes asks a badge holder to hold the server-room door. The badge holder complies to be helpful. Reasoning: this is tailgating; helpfulness bypasses the control. The correct action is to direct the person to reception for a badge and escort, or to offer to fetch someone authorized. The control that failed is door discipline, not the badge system, and the fix is challenge training plus a mantrapt for high-value areas.
Marks that are easy to lose
- Assuming CCTV deters or prevents entry; it records after the fact.
- Using water or a standard extinguisher on electrical equipment.
- Propping a door for ventilation or convenience.
- Believing a locked office door replaces locked cabinets and clean desk.