I85PREP
⌘ K
PSAP study materials
PSAP study resources

PSAP practice questions

One question at a time. Build your PSAP understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Access Control Fundamentals and Risk Assessment

In a formal risk assessment, what does the term 'risk' most precisely express?

  1. The list of assets stored in the configuration management database
  2. The total count of vulnerabilities detected by an automated scanner
  3. The likelihood that a threat exploits a vulnerability combined with the resulting impact Correct answer.
  4. The set of security controls currently deployed in an environment

Explanation

Risk is conventionally modeled as a function of the probability that a threat event occurs and the magnitude of harm it causes, often expressed as likelihood times impact. Vulnerabilities, controls, and asset inventories are inputs that shape that calculation rather than the risk itself.

Question 2Access Control Fundamentals and Risk Assessment

Which statement best describes the purpose of the principle of least privilege?

  1. Granting each subject only the access rights required to perform its assigned tasks Correct answer.
  2. Encrypting all data at rest with a single organization-wide key
  3. Logging every access attempt for later forensic review
  4. Requiring every user to hold at least two separate accounts

Explanation

Least privilege limits each subject's permissions to the minimum necessary for its function, reducing the blast radius of misuse or compromise. It is a design principle about authorization scope, not about account counts, encryption, or auditing.

Question 3Access Control Fundamentals and Risk Assessment

A security analyst is told that a control is 'preventive.' Which control type matches that description?

  1. A log review performed after an incident is detected
  2. A backup restore test conducted quarterly
  3. A firewall rule that blocks unauthorized inbound traffic Correct answer.
  4. A security awareness email sent to all staff

Explanation

Preventive controls act before an event to stop unauthorized activity, and a firewall rule that denies traffic is a classic example. Detection, recovery, and awareness activities serve different control functions even when they contribute to overall security.

Question 4Access Control Fundamentals and Risk Assessment

Which access control model bases authorization decisions on a subject's job function rather than on individual identity?

  1. Mandatory access control
  2. Role-based access control Correct answer.
  3. Rule-based access control
  4. Discretionary access control

Explanation

Role-based access control assigns permissions to roles and then assigns users to those roles, so entitlements follow job function. Discretionary and mandatory models key on owner discretion and system-labeled classifications respectively, not on job roles.

Question 5Access Control Fundamentals and Risk Assessment

What is the primary purpose of performing a business impact analysis (BIA) during risk assessment?

  1. To identify critical business functions and quantify the consequences of their disruption Correct answer.
  2. To select which antivirus product the organization should purchase
  3. To calculate the annual cost of security awareness training
  4. To enumerate every open port on internet-facing hosts

Explanation

A BIA identifies the processes whose failure would most harm the organization and estimates the operational and financial consequences of disruption. Those findings feed recovery priorities and risk treatment decisions rather than technical scanning or procurement choices.

Question 6Access Control Fundamentals and Risk Assessment

Which element is a component of the CIA triad used to describe information security objectives?

  1. Integrity Correct answer.
  2. Authentication
  3. Non-repudiation
  4. Accounting

Explanation

The CIA triad comprises confidentiality, integrity, and availability. Non-repudiation, authentication, and accounting are important security services but are not members of that triad.

Question 7Access Control Fundamentals and Risk Assessment

In risk terminology, what distinguishes a threat from a vulnerability?

  1. A threat is a potential cause of harm, while a vulnerability is a weakness that the threat can exploit Correct answer.
  2. A threat is a deployed control, while a vulnerability is a residual risk
  3. A threat is a legal obligation, while a vulnerability is an audit finding
  4. A threat is a weakness in code, while a vulnerability is an actor who attacks systems

Explanation

A threat is any circumstance or actor with the potential to cause harm, such as an attacker or a flood. A vulnerability is an internal weakness, such as an unpatched service, that a threat can act upon to produce impact.

Question 8Access Control Fundamentals and Risk Assessment

Which activity best exemplifies a detective control in an access control program?

  1. Requiring complex passwords at account creation
  2. Segregating the network into security zones
  3. Monitoring authentication logs for repeated failed logins Correct answer.
  4. Issuing smart cards to all employees

Explanation

Detective controls identify and record events that have already occurred, and monitoring failed authentication attempts detects possible intrusion activity. Password rules, credential issuance, and segmentation are preventive measures that act before an event.

Question 9Access Control Fundamentals and Risk Assessment

A hospital must ensure only physicians on the current duty roster can view a patient record, and the roster changes hourly. Which access control approach best fits this requirement?

  1. Attribute-based access control that evaluates the duty-status attribute at request time Correct answer.
  2. A shared clinical account used by whoever is on duty
  3. Static discretionary permissions granted by the record owner
  4. Mandatory access control using classification labels only

Explanation

Attribute-based access control evaluates attributes such as duty status at the moment of the request, so entitlements track rapidly changing conditions. Static permissions and label-only models cannot reflect hourly roster changes, and shared accounts destroy accountability.

Question 10Access Control Fundamentals and Risk Assessment

An organization rates a risk as high likelihood and low impact. Which treatment decision is most consistent with a standard risk matrix?

  1. The risk automatically becomes a compliance violation
  2. The organization may accept the risk but should monitor it and reassess if conditions change Correct answer.
  3. The risk must always be transferred to an insurer
  4. The risk can be ignored because impact is low

Explanation

A high-likelihood, low-impact risk typically falls in a moderate band where acceptance with monitoring is a defensible choice, since frequent small losses can accumulate. Impact alone does not justify dismissal, transfer is optional rather than mandatory, and regulatory status depends on specific obligations.

Question 11Access Control Fundamentals and Risk Assessment

During a risk assessment, an analyst calculates residual risk. What does that value represent?

  1. The risk before any controls are considered
  2. The probability that a control will fail a compliance audit
  3. The risk remaining after existing or planned controls are applied Correct answer.
  4. The total cost of implementing all recommended safeguards

Explanation

Residual risk is what remains once controls have been applied or credited, and it is compared against the organization's risk appetite. Inherent risk, by contrast, is assessed before controls, and control cost or audit failure probability are separate measures.

Question 12Access Control Fundamentals and Risk Assessment

Which pairing of access control category and example is correct?

  1. Physical control - firewall access list
  2. Technical control - employee background check
  3. Administrative control - intrusion detection system
  4. Physical control - locked server room door Correct answer.

Explanation

Access controls are categorized as administrative, technical, or physical, and a locked server room door is a physical control. Background checks are administrative, intrusion detection systems and firewalls are technical.

Question 13Access Control Fundamentals and Risk Assessment

An attacker gains access by pretending to be a help desk technician and persuading a user to reset a password. Which threat category does this represent?

  1. Social engineering Correct answer.
  2. Denial of service
  3. Man-in-the-middle interception
  4. Privilege escalation through a software flaw

Explanation

Social engineering manipulates people into divulging information or performing actions that undermine security, as when a caller impersonates support staff. Denial of service, software exploitation, and traffic interception involve technical mechanisms rather than human persuasion.

Question 14Access Control Fundamentals and Risk Assessment

Which statement correctly describes separation of duties as an access control safeguard?

  1. All administrative accounts must be shared among the operations team
  2. No single individual should control all phases of a sensitive transaction Correct answer.
  3. Every user must be assigned at least two conflicting roles
  4. Access rights should be granted permanently to avoid disruption

Explanation

Separation of duties splits a sensitive process so that collusion would be required to commit and conceal fraud, meaning no one person controls every phase. It does not mandate conflicting roles, shared accounts, or permanent entitlements.

Question 15Access Control Fundamentals and Risk Assessment

A risk assessment team wants to express risk using a formula that multiplies threat likelihood, vulnerability likelihood, and impact. Which approach does this describe?

  1. A penetration test report
  2. A pure quantitative model based only on monetary loss history
  3. A compliance gap analysis
  4. A qualitative-to-quantitative hybrid scoring model Correct answer.

Explanation

Combining ordinal likelihood and impact factors into a numeric score is a hybrid or semi-quantitative model, common in risk registers and heat maps. Pure quantitative models use monetary values, while gap analyses and penetration tests produce different outputs.

Question 16Access Control Fundamentals and Risk Assessment

Which scenario best illustrates the concept of implicit deny in access control?

  1. A user is granted access because a manager verbally approved it
  2. An administrator temporarily disables auditing during maintenance
  3. A request that matches no allow rule is rejected by default Correct answer.
  4. A firewall permits all outbound traffic to simplify operations

Explanation

Implicit deny means that anything not explicitly permitted is denied, so an unmatched request fails closed. Verbal approvals, disabled auditing, and permissive outbound rules all weaken the default-deny posture.

Question 17Access Control Fundamentals and Risk Assessment

An organization must decide whether to remediate or accept a finding from a vulnerability scan. Which factor is most relevant to that decision?

  1. The business criticality of the affected asset and the exploitability of the weakness Correct answer.
  2. The number of pages in the scanner's PDF report
  3. The vendor's marketing tier for the scanning product
  4. The alphabetical order of the scanner's plugin names

Explanation

Risk-based prioritization weighs how important the asset is to the business against how easily the weakness can be exploited and the harm it would cause. Report formatting and product branding have no bearing on remediation priority.

Question 18Access Control Fundamentals and Risk Assessment

Which access control practice most directly supports the accountability objective of a security program?

  1. Publishing the password policy on the intranet
  2. Allowing a single shared administrator account for convenience
  3. Disabling session timeouts to reduce user friction
  4. Requiring unique user identifiers and logging authenticated actions Correct answer.

Explanation

Accountability requires that actions be attributable to a specific individual, which unique identifiers combined with activity logging provide. Shared accounts, extended sessions, and policy publication do not create attribution.

Question 19Access Control Fundamentals and Risk Assessment

A risk assessment identifies that a legacy application cannot be patched and must remain online. Which treatment strategy is being applied when the organization purchases cyber insurance for that exposure?

  1. Risk avoidance
  2. Risk mitigation
  3. Risk acceptance
  4. Risk transfer Correct answer.

Explanation

Purchasing insurance shifts some financial consequence of a risk to a third party, which is risk transfer. Avoidance would eliminate the activity, mitigation would reduce likelihood or impact through controls, and acceptance would retain the risk without transferring it.

Question 20Access Control Fundamentals and Risk Assessment

Which statement about discretionary access control (DAC) is accurate?

  1. Resource owners can determine who is granted access to their objects Correct answer.
  2. Access is based exclusively on the time of day and location
  3. Access is granted only through centrally administered roles
  4. Access is determined solely by system-assigned sensitivity labels

Explanation

In DAC, the owner of an object has discretion to grant or revoke access, which is flexible but can lead to inconsistent protection. Label-driven decisions describe mandatory access control, role administration describes RBAC, and contextual conditions describe rule-based control.

Question 21Access Control Fundamentals and Risk Assessment

An analyst is comparing two vendors using annualized loss expectancy (ALE). Vendor A's control reduces ALE by 40,000 dollars at an annual cost of 15,000 dollars. What does a standard cost-benefit analysis conclude?

  1. The control is unjustified because any cost reduces profit
  2. The control should be rejected because ALE is a qualitative measure
  3. The control's value cannot be assessed without a penetration test
  4. The control is cost-justified because the loss reduction exceeds its annual cost Correct answer.

Explanation

Cost-benefit analysis compares the reduction in ALE against the control's annual cost; a 40,000 dollar reduction against 15,000 dollars in cost yields a net benefit. ALE is a quantitative measure, and a penetration test is not required to perform this arithmetic.

Question 22Access Control Fundamentals and Risk Assessment

An organization applies both role-based permissions and a rule that denies access from foreign IP ranges outside business hours. Which statement best characterizes this design?

  1. It violates least privilege by combining two models
  2. It eliminates the need for authentication because rules are enforced
  3. It layers role-based authorization with rule-based constraints to enforce defense in depth Correct answer.
  4. It is purely mandatory access control because labels are involved

Explanation

Combining RBAC entitlements with contextual rules such as time and location constraints is a layered, defense-in-depth approach. No labels are used, layering models does not itself violate least privilege, and authentication remains a prerequisite for authorization.

Question 23Access Control Fundamentals and Risk Assessment

A risk register lists a threat with high impact but very low likelihood, and the organization has a low risk appetite. Which reasoning best supports the treatment decision?

  1. The risk must be avoided entirely because appetite is low
  2. Compensating controls or transfer may be warranted because impact exceeds appetite even though likelihood is low Correct answer.
  3. The risk can be disregarded because likelihood is the only factor that matters
  4. The risk rating should be recalculated until it falls within appetite

Explanation

Risk appetite defines how much impact an organization will tolerate, so a high-impact event can exceed appetite even at low likelihood, justifying compensating controls or transfer. Likelihood is not the sole factor, avoidance is not mandatory, and manipulating ratings to fit appetite is improper.

Question 24Access Control Fundamentals and Risk Assessment

An auditor finds that terminated employees retain active directory accounts for up to 30 days. Which risk assessment conclusion is most defensible?

  1. The provisioning process lacks timely deprovisioning, creating unauthorized access risk that should be remediated Correct answer.
  2. The finding is low risk because terminated users rarely attempt access
  3. The finding should be closed as a false positive because directory accounts are not access controls
  4. The finding is acceptable because accounts are eventually disabled

Explanation

Delayed deprovisioning leaves credentials usable after employment ends, which is an unauthorized access exposure that warrants remediation and a defined SLA. Assuming terminated users are harmless, relying on eventual disablement, or dismissing directory accounts ignores the control failure.

Question 25Access Control Fundamentals and Risk Assessment

A team must choose between a detective control with low cost and a preventive control with high cost for the same risk. Which analysis is most appropriate?

  1. Defer the decision until the next external audit
  2. Always choose the cheaper control because budget is the primary constraint
  3. Compare each control's reduction in residual risk against its lifecycle cost and the organization's risk tolerance Correct answer.
  4. Always choose the preventive control because detection is never useful

Explanation

Sound selection compares how much each option reduces residual risk relative to its total cost, including operation and maintenance, and whether the result satisfies risk tolerance. Cost alone, control category alone, or audit timing are insufficient decision criteria.

Question 26Access Control Fundamentals and Risk Assessment

An access control review classifies a fingerprint scanner used at a data center door as which type of authentication factor?

  1. Something you know
  2. Something you are Correct answer.
  3. Somewhere you are
  4. Something you have

Explanation

Authentication factors are grouped by what the user possesses, remembers, is, or where the user is located. A fingerprint is a physiological biometric trait, so it belongs to the inherence category, commonly described as something you are. Location-based context such as a network range or geofence is a separate factor class and does not describe a biometric.

Question 27Access Control Fundamentals and Risk Assessment

Which practice is the clearest example of the least privilege principle applied to a database administrator account?

  1. Granting the administrator standing full control so incidents are resolved quickly
  2. Retaining the account's elevated rights permanently in case of an emergency
  3. Assigning administrative rights only for the maintenance window and removing them afterward Correct answer.
  4. Sharing a single privileged account among the database team to simplify auditing

Explanation

Least privilege means each identity receives only the access required for the task, for only as long as it is required. Time-bound elevation during a maintenance window satisfies that limit and reduces the exposure window. Standing, shared, or permanent elevated rights all exceed what the task requires and weaken accountability.

Question 28Access Control Fundamentals and Risk Assessment

An analyst scores a risk using likelihood multiplied by impact and records the result before any control is applied. Which term describes this recorded value?

  1. Residual risk
  2. Control effectiveness
  3. Risk appetite
  4. Inherent risk Correct answer.

Explanation

Inherent risk is the level of risk that exists before controls or mitigations are considered. Residual risk, by contrast, is what remains after controls are implemented and evaluated. Recording the pre-control score establishes the baseline against which the effect of a safeguard can later be measured.

Question 29Access Control Fundamentals and Risk Assessment

A payroll system allows each employee to set permissions on their own timesheet records and pass that authority to a coworker. Which access control model does this behavior illustrate?

  1. Mandatory access control
  2. Discretionary access control Correct answer.
  3. Rule-based access control
  4. Role-based access control

Explanation

Under discretionary access control, the owner of a resource decides who may access it and can delegate that authority. Allowing an employee to set permissions on personal records and hand control to another user is the defining discretionary behavior. Mandatory and role-based models instead derive access from labels or job functions assigned by an administrator.

Question 30Access Control Fundamentals and Risk Assessment

A risk assessment finds that a critical billing server has an unpatched service with a known public exploit and no compensating control. Leadership asks which factor most directly justifies prioritizing this finding above a medium-rated finding.

  1. The remediation requires a change window that must be scheduled in advance
  2. The affected server has been in service longer than other servers in the estate
  3. The exposure combines high likelihood of exploitation with high business impact Correct answer.
  4. The finding was reported by an external assessor rather than internal staff

Explanation

Prioritization in risk assessment is driven by the combination of likelihood and impact, so a known exploitable flaw on a critical system produces a high exposure that warrants early treatment. Source of the report, asset age, and scheduling logistics may affect planning but do not by themselves raise the risk level. The analysis should focus on the probability of a threat event and the consequence to the business.

Question 31Physical Access Control Systems (PACS) Architecture and Components

In a PACS, which component is responsible for converting a credential read into a decision to unlock or keep a door secured?

  1. The electrified lock hardware
  2. The access control panel Correct answer.
  3. The request-to-exit sensor
  4. The credential reader

Explanation

The access control panel (controller) receives the credential data from the reader, compares it against stored access rules and schedules, and then energizes or de-energizes the lock output. Readers only capture and transmit credential data, and locks only act on the panel's command.

Question 32Physical Access Control Systems (PACS) Architecture and Components

Which PACS topology places the access decision at the door location so doors continue to operate if the server or network is unavailable?

  1. Fully server-centric with no local intelligence
  2. Host-only architecture with readers wired directly to the server
  3. Cloud-only architecture with no local fallback
  4. Distributed (intelligent controller) architecture Correct answer.

Explanation

In a distributed architecture, intelligent controllers at the door hold the access database and schedules locally, so they can keep granting access during a network or server outage. Server-centric designs depend on the host for every decision and fail open or fail secure when connectivity is lost.

Question 33Physical Access Control Systems (PACS) Architecture and Components

A Wiegand interface between a reader and a panel is best characterized as which type of signaling?

  1. A power-over-Ethernet negotiation standard
  2. An RS-485 multi-drop polling bus
  3. An encrypted bidirectional network protocol
  4. A one-way data transmission using data-0 and data-high bit streams Correct answer.

Explanation

Wiegand is a simple one-way interface where the reader sends bits to the panel using data-0 and data-high lines, typically with a card-present or LED control line. It does not encrypt data or support the two-way messaging found in network protocols.

Question 34Physical Access Control Systems (PACS) Architecture and Components

What is the primary purpose of a fail-safe (fail-unlocked) lock in a PACS design?

  1. To authenticate the reader before granting access
  2. To record every door position change in the panel log
  3. To unlock the door when power is removed, supporting life-safety egress Correct answer.
  4. To keep the door locked when power is lost

Explanation

Fail-safe locks are energized to lock and release when power is removed, which supports life-safety egress requirements so occupants can exit during a power loss or fire alarm. Fail-secure locks behave oppositely and stay locked without power.

Question 35Physical Access Control Systems (PACS) Architecture and Components

A request-to-exit (REX) device is typically wired to the access panel to serve which function?

  1. To shunt the door alarm and release the lock for legitimate egress without a credential Correct answer.
  2. To provide backup power to the lock
  3. To enroll new cardholders at the door
  4. To extend the reader's read range

Explanation

A REX device, such as a passive infrared sensor or push button, tells the panel that a person is exiting so the panel can release the lock and suppress the forced-door alarm. It does not perform enrollment, extend read range, or supply power.

Question 36Physical Access Control Systems (PACS) Architecture and Components

Which statement accurately describes the role of a door position switch (DPS) in a PACS?

  1. It supplies power to the reader over the network
  2. It reports whether the door is open or closed so the panel can detect held-open and forced conditions Correct answer.
  3. It reads the credential and transmits it to the panel
  4. It provides the electric strike's holding force

Explanation

A door position switch is a contact that reports the physical state of the door to the panel, enabling held-open and forced-door alarms. It does not read credentials, hold the strike, or deliver power.

Question 37Physical Access Control Systems (PACS) Architecture and Components

In a typical PACS, what is the function of the access control server?

  1. To convert AC power to the lock's operating voltage
  2. To store cardholder records, access rules, and audit logs and to manage controllers Correct answer.
  3. To physically hold the door closed
  4. To capture the badge image at the door

Explanation

The server hosts the access control application that stores cardholder data, access levels, schedules, and audit history, and it manages and distributes configuration to controllers. Physical locking, power conversion, and badge imaging are handled by other components.

Question 38Physical Access Control Systems (PACS) Architecture and Components

Which credential technology transmits a unique serial number only, with no mutual authentication between card and reader?

  1. Low-frequency 125 kHz proximity (prox) Correct answer.
  2. FIPS 201 PIV card
  3. High-frequency MIFARE DESFire EV2
  4. Seos smart card

Explanation

Low-frequency 125 kHz proximity cards typically transmit a static serial number and perform no mutual authentication, making them vulnerable to cloning. The other listed technologies support cryptographic authentication and are not simple serial-number credentials.

Question 39Physical Access Control Systems (PACS) Architecture and Components

A PACS uses a 26-bit Wiegand format. Which limitation is most significant when planning a large multi-site deployment?

  1. It encrypts all data between reader and panel
  2. It requires PoE to operate
  3. Its facility code and card number fields provide a limited number of unique combinations Correct answer.
  4. It cannot be read by proximity readers

Explanation

A 26-bit Wiegand format splits bits into a facility code and card number, yielding a limited address space that can be exhausted or duplicated across organizations. It does not encrypt data and is commonly used with proximity readers.

Question 40Physical Access Control Systems (PACS) Architecture and Components

Which PACS component typically provides supervised, regulated power to locks and readers and includes battery backup?

  1. The access control panel's reader port
  2. The door position switch
  3. The dedicated power supply with battery backup Correct answer.
  4. The REX sensor

Explanation

A dedicated power supply, often with battery backup and supervision, provides regulated power to locks and readers and supports operation during outages. Reader ports, DPS, and REX devices do not supply lock power.

Question 41Physical Access Control Systems (PACS) Architecture and Components

An integrator must ensure a door releases automatically when the fire alarm activates. Which wiring approach supports this?

  1. Wire the lock directly to the panel's reader port
  2. Wire the lock power through a normally closed relay that opens on fire alarm Correct answer.
  3. Wire the lock to the door position switch
  4. Wire the lock to the REX sensor output

Explanation

Routing lock power through a normally closed relay that opens on fire alarm removes power from fail-safe locks, releasing the door for egress. Reader ports, REX outputs, and DPS contacts are not designed to switch lock power.

Question 42Physical Access Control Systems (PACS) Architecture and Components

Which statement best describes the function of an electric strike compared with a magnetic lock?

  1. Both devices hold the door by electromagnetic force and differ only in voltage
  2. A strike replaces the latch and holds the door by electromagnet, while a maglock releases a mechanical latch
  3. An electric strike releases a mechanical latch in the frame, while a magnetic lock holds the door by electromagnetic force Correct answer.
  4. An electric strike requires a REX device, while a magnetic lock does not

Explanation

An electric strike is installed in the frame and releases the existing mechanical latch when energized, whereas a magnetic lock holds the door closed by electromagnetic force against an armature plate. Their holding mechanisms and installation locations differ.

Question 43Physical Access Control Systems (PACS) Architecture and Components

What does a reader's "read range" specification depend on most directly?

  1. The panel's firmware version
  2. The credential technology and reader antenna design Correct answer.
  3. The server's storage capacity
  4. The lock's holding force

Explanation

Read range is determined primarily by the credential technology (for example, 125 kHz prox versus 13.56 MHz smart card) and the reader's antenna design and power. Panel firmware, lock holding force, and server storage do not set read range.

Question 44Physical Access Control Systems (PACS) Architecture and Components

A site requires that a badge be presented at both an entry reader and an exit reader to record who entered and who left. Which design element does this describe?

  1. A single REX-only egress
  2. A fail-secure lock configuration
  3. Anti-passback with in/out readers Correct answer.
  4. A door position switch only

Explanation

Anti-passback uses separate in and out readers to track entry and exit and to prevent a credential from being reused to enter without first exiting. REX-only egress, fail-secure locks, and a DPS alone do not track direction of travel.

Question 45Physical Access Control Systems (PACS) Architecture and Components

Which element of a PACS defines the times during which a cardholder's credential is valid at a given door?

  1. The access level and time schedule assigned to the cardholder Correct answer.
  2. The reader's LED color
  3. The lock's holding force rating
  4. The panel's battery capacity

Explanation

Access levels combine doors with time schedules to define when and where a credential is valid. LED color, lock holding force, and battery capacity do not define authorization timing.

Question 46Physical Access Control Systems (PACS) Architecture and Components

What is the purpose of a "first card unlock" or "two-person rule" feature in a PACS?

  1. To reduce reader power consumption
  2. To require a specific sequence or number of valid credentials before unlocking Correct answer.
  3. To extend the life of the electric strike
  4. To encrypt Wiegand transmissions

Explanation

First-card unlock and two-person rule features require a defined sequence or combination of valid credentials before the door releases, adding a layer of control for sensitive areas. They are authorization rules, not power, hardware-life, or encryption features.

Question 47Physical Access Control Systems (PACS) Architecture and Components

Which of the following best describes the role of the PACS client workstation?

  1. It converts credential data into Wiegand bits
  2. It supplies power to the electric lock
  3. It provides the user interface for operators to monitor alarms and manage cardholders Correct answer.
  4. It makes real-time access decisions at the door

Explanation

The client workstation is the operator interface for monitoring events, acknowledging alarms, and administering cardholders and access levels. Access decisions occur at the controller, credential conversion happens at the reader, and lock power comes from a power supply.

Question 48Physical Access Control Systems (PACS) Architecture and Components

An operator wants to know when a door has been propped open beyond its allowed time. Which combination of components enables this?

  1. A power supply and a battery
  2. A REX sensor and a lock
  3. A reader and a credential format
  4. A door position switch and a held-open time threshold in the panel Correct answer.

Explanation

Held-open detection requires a door position switch to report the door state and a configured time threshold in the panel or software to alarm when the door remains open too long. Readers, credentials, power supplies, and REX sensors do not by themselves detect held-open conditions.

Question 49Physical Access Control Systems (PACS) Architecture and Components

What is the primary security weakness of transmitting a static credential serial number over an unencrypted reader interface?

  1. The credential can be captured and replayed or cloned Correct answer.
  2. The lock will fail secure
  3. The panel will lose its schedule data
  4. The reader will overheat

Explanation

A static serial number sent without encryption or mutual authentication can be captured and replayed or used to clone a credential. Overheating, lock fail behavior, and schedule loss are unrelated to credential transmission security.

Question 50Physical Access Control Systems (PACS) Architecture and Components

A PACS controller is described as "intelligent" primarily because it:

  1. Provides PoE to the entire building
  2. Stores video surveillance footage
  3. Uses a faster processor than the server
  4. Contains a local database of cardholders, access levels, and schedules and can decide access without the host Correct answer.

Explanation

An intelligent controller holds its own copy of cardholder data, access levels, and schedules, enabling local access decisions and continued operation when the host is unavailable. Processor speed, video storage, and building-wide PoE are not the defining characteristics.