Physical Security, Access Control, and Perimeter Protection
This domain tests whether you can look at a site and see how an intruder would get in, then rank the fixes. Answers are judged on structure and reasoning, not on equipment brand names.
Layered defence and the four Ds
The standard model is concentric layers: perimeter, building exterior, interior space, and the asset itself. Every layer should deter, detect, delay, and deny. A fence that is never patrolled deters only the lazy; it does not detect.
Perimeter and lighting
Walls, fences, gates, bollards, clear zones, and controlled vegetation all buy time. Lighting should be uniform enough to remove shadow pockets and must never glare into a guard's or camera's view. Perimeter inspection is a documented task - record gaps, overgrowth, damaged mesh, and faulty locks, with time and location.
Access control fundamentals
- Three factors: something you know (PIN), something you have (card, key), something you are (biometrics).
- Positive identification at the gate: badge check plus visitor log, escort for visitors, time-in and time-out.
- Tailgating and piggybacking are the most common failures; mitigations include turnstiles, mantrap vestibules, one-person-per-read rules, and vigilant staffing.
- Key control: numbered keys, signature log, no unauthorised duplication, rekeying on loss.
- Two-person rule for sensitive areas such as vaults, armoury, and server rooms.
- Alarms are only as good as the response plan; a siren without a responder is noise.
Worked example
A warehouse has a 2.4-metre fence, one camera, and a blind loading dock. The gap is not the fence height but the unmonitored dock and lack of patrol. Recommend, in priority order: lock and alarm the dock door, add lighting over the dock, add a documented patrol checkpoint, then add camera coverage. Detection and delay first, technology last.
Traps that cost marks
Recommending more cameras as the only answer; ignoring insider risk; forgetting to document the vulnerability you observed; treating a locked door as sufficient without key control.