I85PREP
⌘ K
PSAC study materials
PSAC study resources

PSAC practice questions

One question at a time. Build your PSAC understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Physical Security Assessment and Planning

In physical security planning, what is the primary purpose of a layered defense (defense in depth) strategy?

  1. To ensure an adversary must defeat multiple independent barriers before reaching a critical asset Correct answer.
  2. To satisfy insurance requirements with a single certified perimeter
  3. To reduce the number of security officers required on each shift
  4. To centralize all alarm monitoring in one control room

Explanation

Layered defense places successive and independent countermeasures-perimeter, building envelope, interior zones, and asset-level protection-so that defeating one layer does not grant access to the target. The goal is to delay, detect, and respond across multiple opportunities rather than rely on any single control.

Question 2Physical Security Assessment and Planning

A security planner is defining the Design Basis Threat (DBT) for a facility. Which input is most essential to that document?

  1. The adversary's capabilities, intent, and tactics the protection system must counter Correct answer.
  2. The facility's annual security budget forecast
  3. The local fire code occupancy limits
  4. The vendor list for access control hardware

Explanation

The DBT describes the threat the protection system is designed to defeat, including adversary numbers, weapons, tools, transportation, and tactics. It anchors subsequent risk analysis and countermeasure selection, so it must reflect credible adversary capability and intent.

Question 3Physical Security Assessment and Planning

Which term describes the time between an adversary's first detectable action and the arrival of a response force?

  1. Dwell time
  2. Standoff distance
  3. Response time Correct answer.
  4. Delay factor

Explanation

Response time is measured from alarm annunciation to the arrival of responders at the scene. Planners compare it against the total delay provided by physical barriers to determine whether response can occur before the adversary completes the task.

Question 4Physical Security Assessment and Planning

What does CPTED stand for in physical security planning?

  1. Crime Prevention Through Environmental Design Correct answer.
  2. Controlled Perimeter Tactical Entry Design
  3. Critical Property Threat Evaluation Directive
  4. Certified Protection Training and Evaluation Doctrine

Explanation

CPTED is a design philosophy using natural surveillance, natural access control, territorial reinforcement, and maintenance to reduce crime opportunity. It complements hardware-based controls by shaping the built environment and user behavior.

Question 5Physical Security Assessment and Planning

A planner is calculating the total time an adversary needs to penetrate a perimeter fence, cross open ground, and breach a vault door. Which concept is being quantified?

  1. Asset criticality
  2. Alarm assessment time
  3. Detection probability
  4. Total delay time Correct answer.

Explanation

Total delay time aggregates the time consumed by each successive barrier an adversary must defeat. It is compared with detection and response timelines to determine whether responders can intercept before the adversary succeeds.

Question 6Physical Security Assessment and Planning

In a risk assessment, risk is commonly expressed as a function of which three elements?

  1. Probability, insurance, and audit
  2. Threat, vulnerability, and consequence Correct answer.
  3. Likelihood, budget, and staffing
  4. Cost, schedule, and quality

Explanation

Risk is generally modeled as the interaction of threat (adversary capability and intent), vulnerability (weakness in the protection system), and consequence (impact if the event occurs). Reducing any element lowers overall risk.

Question 7Physical Security Assessment and Planning

Which document typically records the agreed protection objectives, assumptions, and countermeasure decisions for a facility?

  1. Fire evacuation map
  2. Equipment warranty
  3. Occupancy permit
  4. Security master plan Correct answer.

Explanation

The security master plan documents protection objectives, the DBT, risk findings, and the planned countermeasure strategy. It provides the traceable rationale linking identified risks to selected controls.

Question 8Physical Security Assessment and Planning

What is the purpose of an exclusion zone in a physical protection layout?

  1. To provide a staging area for incoming deliveries
  2. To house the security control room near the main entrance
  3. To designate employee parking adjacent to the loading dock
  4. To keep unauthorized persons and vehicles at a distance from a protected asset Correct answer.

Explanation

An exclusion zone establishes a controlled standoff area where unauthorized persons and vehicles are not permitted, reducing the threat from vehicle-borne or standoff weapons. It is a spatial control enforced through barriers, signage, and patrols.

Question 9Physical Security Assessment and Planning

A facility must protect a data center where a brief outage would halt revenue. The planner proposes redundant power, dual-path communications, and a secondary control room. Which protection principle do these measures primarily support?

  1. Detection through intrusion sensors
  2. Confidentiality through encryption
  3. Availability through redundancy and resilience Correct answer.
  4. Deterrence through visible patrols

Explanation

Redundant power, diverse communications paths, and alternate control facilities preserve function when a component fails or is attacked. These measures address availability and resilience rather than secrecy or detection.

Question 10Physical Security Assessment and Planning

A planner is siting a new perimeter intrusion detection system. Which factor most directly reduces nuisance alarms without weakening detection performance?

  1. Environmental tuning to local weather, terrain, and wildlife conditions Correct answer.
  2. Disabling alarm assessment to speed operator response
  3. Removing the fence fabric to improve line of sight
  4. Increasing sensor sensitivity to the maximum setting

Explanation

Nuisance alarms often stem from environmental sources such as wind, rain, vegetation, and animals. Tuning sensors to the actual site conditions reduces false and nuisance alarms while preserving sensitivity to genuine intrusions.

Question 11Physical Security Assessment and Planning

During design review, a planner notes that the only CCTV coverage of the main gate is a fixed camera aimed at the roadway, not the guard post. What is the most significant gap this creates?

  1. Inability to assess activity at the guard post during an alarm or incident Correct answer.
  2. Excessive video storage consumption
  3. Failure of the camera to meet lighting standards
  4. Reduced network bandwidth for access control

Explanation

Assessment requires that cameras view the area where an alarm or incident occurs so operators can verify what is happening. A camera aimed only at the roadway cannot confirm activity at the guard post, undermining assessment and response.

Question 12Physical Security Assessment and Planning

A risk assessment finds that a loading dock door is left open during shifts, allowing direct access to a warehouse. Which countermeasure is the most appropriate first-line control?

  1. Additional exterior lighting on the parking lot
  2. A higher fence around the vehicle yard
  3. A quarterly penetration test of the vault
  4. A door position switch interlocked with an alarm and a written open-door procedure Correct answer.

Explanation

The identified vulnerability is an uncontrolled opening that permits direct access. A door position monitor tied to an alarm, paired with a procedural control, directly addresses the exposure at its source. Other measures do not close the open door.

Question 13Physical Security Assessment and Planning

A planner must decide between a guard force and an electronic access control system for a low-traffic service entrance. Which consideration most strongly favors the electronic system?

  1. Ability to conduct foot patrols of the perimeter
  2. Personal recognition of frequent visitors
  3. Immediate physical intervention during an assault
  4. Consistent enforcement of access rules with lower recurring labor cost Correct answer.

Explanation

Electronic access control enforces authorization rules consistently and avoids the recurring cost of continuous staffing at a low-traffic point. Guards remain valuable for patrol, intervention, and recognition tasks that electronics cannot perform.

Question 14Physical Security Assessment and Planning

An adversary is assessed to require 12 minutes to breach the protected area, and the response force needs 18 minutes to arrive. What does this comparison indicate?

  1. The delay time is excessive and should be reduced
  2. The response force is overstaffed for the site
  3. The detection system is unnecessary
  4. The protection system cannot reliably interdict before the adversary completes the task Correct answer.

Explanation

When response time exceeds the adversary's required task time, interception cannot be assured through response alone. The planner must increase delay, reduce response time, or add other measures to close the gap.

Question 15Physical Security Assessment and Planning

Which practice best supports alarm assessment in a security control room?

  1. Routing all alarms directly to local police without verification
  2. Pairing each alarm with video or a guard response that can verify the cause Correct answer.
  3. Recording alarms only in a handwritten log
  4. Suppressing repeat alarms to reduce operator workload

Explanation

Assessment confirms whether an alarm represents a genuine intrusion or a nuisance condition. Pairing alarms with video or a verifying guard response allows operators to classify events accurately and dispatch appropriately.

Question 16Physical Security Assessment and Planning

A planner is evaluating natural surveillance as part of a CPTED review of a parking structure. Which design change most directly improves natural surveillance?

  1. Replacing solid stairwell walls with open, well-lit glazing facing the parking deck Correct answer.
  2. Adding opaque signage to cover the stairwell glazing
  3. Installing decorative planters that block sightlines
  4. Increasing the height of the perimeter wall

Explanation

Natural surveillance depends on clear sightlines and visibility of activity. Open glazing that lets occupants and passersby see into stairwells and decks increases the perception of being observed and reduces concealment.

Question 17Physical Security Assessment and Planning

A facility receives a credible threat indicating a vehicle-borne attack. Which planning response most directly addresses the standoff requirement?

  1. Installing certified vehicle barriers at a calculated distance from the asset Correct answer.
  2. Extending CCTV coverage to the mailroom
  3. Adding more interior motion sensors
  4. Increasing the number of badge readers at employee entrances

Explanation

Vehicle-borne threats are mitigated by maintaining standoff distance enforced with rated barriers. The barrier must be placed at a distance calculated to reduce blast effects on the protected asset.

Question 18Physical Security Assessment and Planning

In a security master plan, why should countermeasure decisions be traceable to specific risk findings?

  1. It removes the requirement for a design basis threat
  2. It guarantees the facility will never be breached
  3. It eliminates the need for periodic plan updates
  4. Traceability justifies investment and supports later review when threats or conditions change Correct answer.

Explanation

Linking each countermeasure to a documented risk finding shows why the investment is warranted and allows the plan to be revisited when threats, operations, or the facility change. Traceability supports audit and continuous improvement.

Question 19Physical Security Assessment and Planning

A planner is selecting barriers for a perimeter and must balance security with life-safety egress. Which approach is most appropriate?

  1. Rely solely on signage to direct intruders away
  2. Use barriers that delay intrusion while providing compliant, monitored emergency egress Correct answer.
  3. Lock all exits permanently to prevent forced entry
  4. Remove all perimeter barriers to ensure egress

Explanation

Effective planning reconciles security with life safety by using barriers that resist intrusion yet allow code-compliant egress, often with alarmed or monitored exit doors. Permanently locking exits creates an unacceptable life-safety hazard.

Question 20Physical Security Assessment and Planning

A planner is assessing the value of a layered approach where the outer fence, the building envelope, and the vault each provide independent delay. What is the principal security benefit of independence between layers?

  1. It allows one alarm system to serve all layers
  2. A single defeated layer does not automatically compromise the next layer's protection Correct answer.
  3. It reduces the total number of barriers needed
  4. It removes the need for response forces

Explanation

Independent layers mean that a defeat or bypass of one control does not inherently grant access through the next. This redundancy forces an adversary to overcome each layer separately, increasing total delay and detection opportunity.

Question 21Physical Security Assessment and Planning

A risk analysis shows that a credible insider could disable the primary alarm panel before any alarm is transmitted. Which design change best mitigates this single point of failure?

  1. Adding an independent, tamper-protected alarm transmission path that reports panel compromise Correct answer.
  2. Increasing camera resolution at the main entrance
  3. Extending patrol routes around the parking area
  4. Adding more badge readers at interior doors

Explanation

The vulnerability is that compromising one panel prevents alarm transmission. An independent transmission path that reports tampering or loss of the primary panel removes the single point of failure and preserves detection reporting.

Question 22Physical Security Assessment and Planning

A planner must justify a countermeasure against a low-likelihood but catastrophic consequence event. Which analytic approach best supports the decision?

  1. Relying only on historical incident frequency at similar sites
  2. Comparing the reduction in expected consequence against the countermeasure's lifecycle cost Correct answer.
  3. Deferring the decision until the threat is observed
  4. Selecting the lowest-cost countermeasure regardless of effect

Explanation

For low-likelihood, high-consequence risks, decision-makers need to weigh the expected reduction in consequence against the full lifecycle cost of the control. This produces a defensible basis even when historical frequency data are sparse.

Question 23Physical Security Assessment and Planning

A design review finds that the CCTV assessment cameras and the intrusion sensors share a single network switch with no backup power. What is the most significant planning concern?

  1. The switch will require more badge readers
  2. A common-mode failure could disable both detection and assessment simultaneously Correct answer.
  3. The sensors will produce too many nuisance alarms
  4. The cameras will consume excessive storage

Explanation

Sharing a switch and power source creates a common-mode failure in which one fault disables both detection and assessment. Planners should separate critical paths or provide backup power to preserve at least one function during failure.

Question 24Physical Security Assessment and Planning

An adversary assessment indicates the threat will use a vehicle to ram a gate and then proceed on foot. Which combination of countermeasures best addresses both phases?

  1. Mailroom screening plus a secondary control room
  2. Additional badge readers at the gate plus exterior lighting
  3. Rated vehicle barriers at the gate plus interior detection and response for the on-foot phase Correct answer.
  4. Taller signage at the gate plus a visitor log

Explanation

The threat has two distinct phases-vehicle breach and dismounted movement-so the plan must address each. Rated barriers counter the ram, while interior detection and response address the on-foot intruder after the gate.

Question 25Physical Security Assessment and Planning

A planner is reviewing a site where the DBT assumes a single intruder, but intelligence now suggests coordinated teams. What is the most appropriate planning response?

  1. Reduce the response force to save cost
  2. Increase only the number of CCTV cameras
  3. Keep the existing plan because the barriers were certified
  4. Revisit the DBT and reassess delay, detection, and response assumptions against the revised threat Correct answer.

Explanation

The DBT is the foundation of the protection design, so a credible change in adversary capability requires revisiting it and reassessing whether delay, detection, and response remain adequate. Simply adding cameras does not address the coordinated-team tactics.

Question 26Physical Security Assessment and Planning

In physical protection planning, what distinguishes a design-basis threat (DBT) from a general threat assessment?

  1. The DBT is the insurance valuation used to size the guard force budget
  2. The DBT lists every adversary group that has ever operated in the region regardless of capability
  3. The DBT is the specific adversary capability and tactic set that protection features are formally designed to defeat Correct answer.
  4. The DBT is the maximum credible accident scenario used only for fire and seismic engineering

Explanation

A design-basis threat fixes the adversary attributes (numbers, weapons, tools, tactics, insider support) against which the physical protection system is engineered and then tested. A general threat assessment surveys the wider environment; the DBT narrows that into an explicit, documented design input so detection, delay, and response can be sized coherently.

Question 27Physical Security Assessment and Planning

A planner is defining the protected area boundary for a facility that stores sensitive material in an inner vault. Which set of nested boundaries is most consistent with standard physical protection layering?

  1. Property line, then parking lot, then reception lobby, then records room
  2. Site perimeter, then building envelope, then limited-access area, then the vault material-access area Correct answer.
  3. Guard house, then loading dock, then cafeteria, then mail room
  4. Fence line, then visitor center, then emergency assembly point, then generator yard

Explanation

Physical protection layering runs from the site perimeter inward through the building envelope and limited-access areas to the material-access area holding the highest-value assets. Each boundary adds detection and delay so an adversary must defeat successive layers. The other lists mix in non-security spaces or order areas without regard to increasing asset sensitivity.

Question 28Physical Security Assessment and Planning

Which statement best describes the role of a physical protection system performance measure such as probability of detection at a boundary?

  1. It quantifies how reliably the layer contributes to interrupting the adversary before the asset is reached Correct answer.
  2. It records the maintenance cost of the sensor suite over its service life
  3. It replaces the need for a response force once sensors are installed
  4. It guarantees that no adversary can ever complete the attack path

Explanation

Performance measures express how much a layer contributes to the overall goal of interrupting the adversary path, with detection feeding assessment and response. They are probabilistic and layer-specific, so they inform design trade-offs rather than guaranteeing absolute protection. Cost and maintenance are separate planning inputs.

Question 29Physical Security Assessment and Planning

A planner is documenting the assumptions used in a facility risk assessment. Why is recording these assumptions important for later design decisions?

  1. It allows the assessment to be reused unchanged for any future facility
  2. It converts qualitative judgments into certified engineering calculations
  3. It ensures reviewers can test whether countermeasure choices remain valid if an assumption changes Correct answer.
  4. It removes the need to validate the threat assessment with intelligence sources

Explanation

Documented assumptions make the analysis auditable: if an assumption such as adversary numbers or response time changes, reviewers can see which countermeasures were justified by it and revisit them. This traceability is central to defensible security planning. It does not make the assessment universally reusable or substitute for threat validation.

Question 30Physical Security Assessment and Planning

A planner is laying out a vehicle approach to a high-value building. Which combination best applies standoff distance principles?

  1. Locate the closest permitted vehicle position as far from the asset as practical and harden the intervening path Correct answer.
  2. Move the visitor parking closer to the building so guards can observe vehicles
  3. Place bollards and planters at the curb and widen the approach lane to speed traffic flow
  4. Rely on a painted line on the pavement to mark the prohibited vehicle area

Explanation

Standoff planning maximizes the distance between the asset and the nearest point an adversary vehicle can reach, then adds hardening or obstacles along that path to absorb and deflect blast effects. Widening lanes, painted markings, or bringing vehicles closer all reduce the protective benefit.

Question 31Physical Security Assessment and Planning

During a site survey, a planner finds a drainage culvert that passes under the perimeter fence and empties inside the protected area. What is the most appropriate planning response?

  1. Assume the small diameter makes it unusable and exclude it from the threat analysis
  2. Treat it as an intrusion path and add a secured grate, sensor coverage, and inspection access Correct answer.
  3. Remove the culvert from the site drawings so it does not appear in the security plan
  4. Note it as a maintenance item for the facilities team and leave the security design unchanged

Explanation

Any opening through a perimeter boundary is a potential bypass of the fence line and must be closed, monitored, or both, with access retained for maintenance. Effective planning hardens the culvert with a secured grate and adds detection so the bypass is covered. Ignoring or concealing the opening leaves an unprotected path to the asset.

Question 32Physical Security Assessment and Planning

A planner is writing the response section of a physical protection plan for a remote site where local police arrival is unreliable. Which planning approach is most defensible?

  1. Assume police will arrive within the design response time and design delay accordingly
  2. Delete the response section because response is outside the facility's control
  3. Document the assumed response time, then design detection and delay so interruption does not depend solely on offsite police Correct answer.
  4. Increase the asset value estimate so the risk calculation shows acceptable residual risk

Explanation

Response planning must rest on a realistic, documented response time; where offsite response is unreliable, the design should add onsite response capability or more delay so the adversary is still interrupted. Assuming prompt police arrival without evidence creates a false sense of protection. Response is a legitimate planning element even when partly external.

Question 33Physical Security Assessment and Planning

A planner is comparing two barrier designs for a perimeter. Design A provides high delay but blocks the only emergency egress route. Design B provides moderate delay with a controlled egress gate. Which choice best reflects sound physical security planning?

  1. Design B, because protection must be balanced with life-safety egress requirements Correct answer.
  2. Design A, provided the barrier is painted a high-visibility color
  3. Design B, because delay has no value in a physical protection system
  4. Design A, because maximum delay always outweighs other considerations

Explanation

Physical security planning must satisfy life-safety codes and egress requirements; a barrier that traps occupants is unacceptable regardless of its delay value. Design B preserves egress while still contributing delay, which is the balanced outcome. Delay remains valuable, so dismissing it entirely is also wrong.

Question 34Physical Security Assessment and Planning

A planner is deciding where to place intrusion detection sensors along a fence line. Which placement principle best supports timely detection of an adversary cutting the fence?

  1. Place sensors facing outward toward the public road to detect approaching vehicles
  2. Mount sensors only at the gate so alarms are easy to interpret
  3. Rely on periodic guard patrols as the sole detection method for the fence
  4. Use a sensor technology that detects the fence fabric disturbance along its full length Correct answer.

Explanation

Fence-mounted or fence-disturbance detection covers the entire boundary so a cut is detected at the point of attack and as early as possible. Covering only the gate leaves most of the fence unwatched, and patrols alone provide intermittent detection that an adversary can time around.

Question 35Physical Security Assessment and Planning

A planner is reviewing a control room where operators must assess alarms from multiple sensor zones. Which design feature most improves the operator's ability to make a timely alarm assessment decision?

  1. Immediate video or sensor display of the alarmed zone alongside clear zone labeling Correct answer.
  2. Delaying all alarms by ten minutes to reduce nuisance activations
  3. A single audible tone that sounds identically for every alarm type
  4. A printed list of zone numbers kept in a desk drawer

Explanation

Timely assessment depends on the operator quickly seeing what triggered the alarm and where, so automatic display of the alarmed zone with clear labeling is essential. Uniform tones give no location cue, and deliberate delays destroy the time available for response.

Question 36Physical Security Assessment and Planning

A planner must protect a small server room inside a leased office where the landlord controls the building shell. Which countermeasure set is most proportionate to the residual risk?

  1. Rebuild the entire building envelope to meet the facility's own perimeter standard
  2. Post a guard at the building entrance and consider the server room protected
  3. Concentrate protection on the server room envelope with access control, door monitoring, and local detection Correct answer.
  4. Rely on the landlord's general building access control as the only protection

Explanation

Where the planner cannot control the building shell, protection should be concentrated on the boundary that can be controlled: the server room itself, with access control, door contacts, and local intrusion detection. Rebuilding the shell is disproportionate, and relying on general building access or a lobby guard leaves the room itself unprotected.

Question 37Physical Security Assessment and Planning

A planner is reviewing a site plan and notices that the only lighting on the rear service yard is a single fixture at the loading door, leaving the fence line dark. Which planning conclusion is most accurate?

  1. The dark fence line undermines detection and assessment there and should be illuminated to support CCTV and patrols Correct answer.
  2. The lighting is adequate because the door is the most likely entry point
  3. Adding more cameras eliminates the need for lighting in the yard
  4. Lighting has no relationship to physical protection performance

Explanation

Perimeter lighting supports both detection and assessment by enabling CCTV and guards to observe activity along the fence line. A single fixture at the door leaves the rest of the boundary in conditions that favor an intruder. Cameras cannot compensate for a scene that is too dark to image usefully.

Question 38Physical Security Assessment and Planning

A planner is conducting a path analysis for an adversary attempting to reach a storage vault. For each possible first detection point, response time is compared with the adversary's remaining delay before completing the attack. Which finding most directly indicates a weakness in the protection design?

  1. The estimated remaining adversary delay exceeds the response time after first detection at the outer fence
  2. The estimated remaining adversary delay exceeds the response time after first detection at an interior checkpoint
  3. The estimated remaining adversary delay exceeds the response time for every assessed first detection point
  4. The estimated remaining adversary delay is shorter than the response time after first detection at the vault door Correct answer.

Explanation

Interruption requires the response force to arrive before the adversary completes the attack. If first detection occurs at the vault door and the remaining delay is shorter than the response time, response arrives too late. The relevant comparison is remaining delay after detection, not an isolated segment's task duration.

Question 39Physical Security Assessment and Planning

A planner is asked to justify a layered protection design to a review board skeptical of cost. Which argument best demonstrates the value of independent layers?

  1. Each layer is designed to the same performance specification so cost is evenly distributed
  2. The outermost layer alone determines overall performance, so inner layers are optional
  3. Layering is required only when the asset value exceeds a fixed regulatory threshold
  4. The layers are independent, so defeating one does not automatically defeat the others and overall interruption probability rises Correct answer.

Explanation

The value of layering comes from independence: an adversary must defeat each layer in sequence, and the combined probability of interruption is higher than any single layer alone. This is the core cost-justification argument. Identical specifications, reliance on the outer layer, or arbitrary thresholds miss the point.

Question 40Physical Security Assessment and Planning

A planner is reviewing a design where the CCTV assessment cameras and the intrusion alarm panel share a single network switch with no backup power. Which conclusion about the protection design is most accurate?

  1. Backup power is unnecessary because the switch is low-voltage equipment
  2. The shared switch improves reliability by consolidating maintenance
  3. A single point of failure exists, so loss of the switch or power degrades both detection assessment and alarm reporting Correct answer.
  4. The design is acceptable because cameras and alarms are separate functions

Explanation

Sharing a switch and power source across assessment and alarm reporting creates a common-mode failure: one outage can blind assessment and silence alarms simultaneously. Sound design separates critical paths and provides backup power so a single fault does not defeat multiple functions. Consolidation for maintenance convenience does not offset this vulnerability.

Question 41Access Control and Intrusion Detection

In a mandatory access control (MAC) system using the Bell-LaPadula model, a process cleared at Secret attempts to read a document classified Top Secret. What does the model enforce?

  1. The read is denied because Secret and Top Secret are incomparable compartments
  2. The read is denied because the subject's clearance is lower than the object's classification Correct answer.
  3. The read is allowed because reading upward never leaks data to lower levels
  4. The read is allowed only if the process also holds discretionary read permission

Explanation

Bell-LaPadula's simple security property (no read up) forbids a subject from reading an object whose classification dominates the subject's clearance. A Secret-cleared process therefore cannot read a Top Secret document. Discretionary permissions do not override the mandatory rule.

Question 42Access Control and Intrusion Detection

A network IDS sensor is placed on a switch port configured to receive a copy of all traffic passing through the switch. Which mechanism is being used?

  1. 802.1X port authentication
  2. Port mirroring (SPAN) Correct answer.
  3. Dynamic ARP inspection
  4. VLAN hopping

Explanation

Port mirroring, often called SPAN, copies frames from monitored ports to a designated analysis port so an IDS can inspect traffic it would not otherwise see. VLAN hopping and ARP inspection are attack or defense mechanisms unrelated to copying traffic to a sensor.

Question 43Access Control and Intrusion Detection

Which access control model determines permissions primarily from the user's job function rather than from the identity of the individual user?

  1. Mandatory access control
  2. Discretionary access control
  3. Role-based access control Correct answer.
  4. Rule-based access control

Explanation

RBAC assigns permissions to roles and then assigns users to roles, so authorization follows job function. DAC ties permissions to owner discretion, MAC to classification labels, and rule-based control to policy conditions rather than job roles.

Question 44Access Control and Intrusion Detection

An intrusion detection system generates an alert for every login attempt that fails more than five times in a minute from the same host. What detection method is this?

  1. Threshold-based detection Correct answer.
  2. Anomaly-based detection
  3. Protocol anomaly detection
  4. Signature-based detection

Explanation

A threshold rule fires when a counted event exceeds a defined limit within a time window, which matches the five-failures-per-minute trigger. Signature detection matches known patterns, and anomaly detection compares behavior to a learned baseline rather than a fixed count.

Question 45Access Control and Intrusion Detection

What is the primary purpose of a honeypot in a network intrusion detection strategy?

  1. To provide authenticated backup access when primary systems fail
  2. To accelerate encryption of stored data at rest
  3. To replace the firewall at the network perimeter
  4. To attract and observe attacker activity while diverting attention from production systems Correct answer.

Explanation

A honeypot is a decoy system whose value lies in luring and recording attacker behavior with low false-positive noise. It is not a resilience, cryptographic, or perimeter-filtering control.

Question 46Access Control and Intrusion Detection

Which authentication factor category does a hardware token that generates a time-based one-time code belong to?

  1. Something you are
  2. Something you know
  3. Something you have Correct answer.
  4. Somewhere you are

Explanation

A physical token is a possession factor, so it falls under something you have. Knowledge factors are memorized secrets, inherence factors are biometric traits, and location is a contextual attribute rather than one of the three classic factors.

Question 47Access Control and Intrusion Detection

Which principle states that a user should be granted only the access required to perform their assigned duties?

  1. Least privilege Correct answer.
  2. Need-to-know
  3. Separation of duties
  4. Defense in depth

Explanation

Least privilege limits rights to the minimum necessary for the job. Separation of duties splits critical tasks among people, defense in depth layers controls, and need-to-know is a related but distinct concept about access to specific information.

Question 48Access Control and Intrusion Detection

What does a false positive in an intrusion detection system represent?

  1. A genuine attack that the system failed to detect
  2. A benign event that the system incorrectly flagged as malicious Correct answer.
  3. A signature update that failed to load
  4. A log entry that was dropped before analysis

Explanation

A false positive is a benign activity misclassified as an intrusion, which consumes analyst time and can cause alert fatigue. A missed real attack is a false negative, and the other options describe operational faults rather than classification errors.

Question 49Access Control and Intrusion Detection

A user authenticated with a password is then prompted for a code from an authenticator app. Which concept does this illustrate?

  1. Single sign-on
  2. Multi-factor authentication Correct answer.
  3. Kerberos delegation
  4. Federated identity

Explanation

Combining a knowledge factor (password) with a possession factor (authenticator app) is multi-factor authentication because the factors come from different categories. SSO and federation concern credential reuse across systems, and delegation concerns service impersonation.

Question 50Access Control and Intrusion Detection

An organization wants a central protocol for carrying authentication, authorization, and accounting data between network devices and a central server. Which protocol is designed for this?

  1. SNMP
  2. RADIUS Correct answer.
  3. NTP
  4. DNS

Explanation

RADIUS is the standard AAA protocol for transmitting authentication, authorization, and accounting information between network access devices and a central server. SNMP is for device management, NTP for time synchronization, and DNS for name resolution.