Access Control and Physical Security
What the candidate must know
Access control is the process of granting, denying, and recording entry to a controlled area. Know the layers: perimeter, building envelope, interior zones, and high-security areas (defense in depth). Understand credential types (badge, PIN, biometric, key) and the three authentication factors - something you know, something you have, something you are. Know tailgating and piggybacking (following an authorized person through a door), mantraps, turnstiles, visitor management (sign-in, escort, badge visible), and key control (logging, no sharing, return on termination). Familiarize yourself with CCTV purpose and limits (deterrence, evidence, monitoring - not a substitute for patrol), alarm response, and the challenge procedure for unbadged persons: polite, confident, verify, escort or deny.
Traps
Questions ask what to do when a person in a suit with no badge says "I'm with corporate" - the right answer is verify through the proper channel, not assume. Another trap: holding a door for someone out of politeness - that defeats access control. Watch for questions about sharing badges or passwords (never), and about propping doors (immediate security issue, secure and report).
Rule of thumb
No badge, no entry - verify, don't assume. Courtesy plus verification, every time.