CISSP (Chapter 5 - Physical and Environmental Security)

Question 1

CISSP (Chapter 5 - Physical and Environmental Security)

What is the first step that should be taken when a fire has been detected?A. Turn off the HVAC system and activate fire door releases.B. Determine which type of fire it is.C. Advise individuals within the building to leave.D. Activate the fire suppression system

Answer 1

C. Human life takes precedence. Although the other answers are important steps in this type of situation, the first step is to warn others and save as many lives as possible.

Question 2

CISSP (Chapter 5 - Physical and Environmental Security)

A company needs to implement a CCTV system that will monitor a large area outside the facility. Which of the following is the correct lens combinationfor this?A. A wide-angle lens and a small lens openingB. A wide-angle lens and a large lens openingC. A wide-angle lens and a large lens opening with a small focal lengthD. A wide-angle lens and a large lens opening with a large focal length

Answer 2

A. The depth of field refers to the portion of the environment that is in focus when shown on the monitor. The depth of field varies depending upon the size of the lens opening, the distance of the object being focused on, and the focal length of the lens. The depth of field increases as the size of the lens opening decreases, the subject distance increases, or the focal length of the lens decreases. So if you want to cover a large area and not focus on specific items, it is best to use a wide-angle lens and a small lens opening.

Question 3

CISSP (Chapter 5 - Physical and Environmental Security)

When should a Class C fire extinguisher be used instead of a Class A fire extinguisher?A. When electrical equipment is on fireB. When wood and paper are on fireC. When a combustible liquid is on fireD. When the fire is in an open area

Answer 3

A. A Class C fire is an electrical fire. Thus, an extinguisher with the proper suppression agent should be used.

Question 4

CISSP (Chapter 5 - Physical and Environmental Security)

Which of the following is not a true statement about CCTV lenses?A. Lenses that have a manual iris should be used in outside monitoring.B. Zoom lenses will carry out focus functionality automatically.C. Depth of field increases as the size of the lens opening decreases.D. Depth of field increases as the focal length of the lens decreases

Answer 4

A. Manual iris lenses have a ring around the CCTV lens that can be manually turned and controlled. A lens that has a manual iris would be used in an area that has fixed lighting, since the iris cannot self-adjust to changes of light. An auto iris lens should be used in environments where the light changes, such as an outdoor setting. As the environment brightens, this is sensed by the iris, which automatically adjusts itself. Security personnel will configure the CCTV to have a specific fixed exposure value, which the iris is responsible for maintaining. The other answers are true

Question 5

CISSP (Chapter 5 - Physical and Environmental Security)

How does halon fight fires?A. It reduces the fire’s fuel intake.B. It reduces the temperature of the area and cools the fire out.C. It disrupts the chemical reactions of a fire.D. It reduces the oxygen in the area.

Answer 5

C. Halon is a type of gas used to interfere with the chemical reactions between the elements of a fire. A fire requires fuel, oxygen, high temperatures, and chemical reactions to burn properly. Different suppressant agents have been developed to attack each aspect of a fire: CO2 displaces the oxygen, water reduces the temperature, and soda acid removes the fuel.

Question 6

CISSP (Chapter 5 - Physical and Environmental Security)

What is a mantrap?A. A trusted security domainB. A logical access control mechanismC. A double-door room used for physical access controlD. A fire suppression device

Answer 6

C. A mantrap is a small room with two doors. The first door is locked; a person is identified and authenticated by a security guard, biometric system, smart card reader, or swipe card reader. Once the person is authenticated and access is authorized, the first door opens and allows the person into the mantrap. The first door locks and the person is trapped. The person must be authenticated again before the second door unlocks and allows him into the facility

Question 7

CISSP (Chapter 5 - Physical and Environmental Security)

What is true about a transponder?A. It is a card that can be read without sliding it through a card reader.B. It is a biometric proximity device.C. It is a card that a user swipes through a card reader to gain access to a facility.D. It exchanges tokens with an authentication server.

Answer 7

A. A transponder is a type of physical access control device that does not require the user to slide a card through a reader. The reader and card communicate directly. The card and reader have a receiver, transmitter, and battery. The reader sends signals to the card to request information. The card sends the reader an access code.

Question 8

CISSP (Chapter 5 - Physical and Environmental Security)

When is a security guard the best choice for a physical access control mechanism?A. When discriminating judgment is requiredB. When intrusion detection is requiredC. When the security budget is lowD. When access controls are in place

Answer 8

A. Although many effective physical security mechanisms are on the market today, none can look at a situation, make a judgment about it, and decide what the next step should be. A security guard is employed when a company needs to have a countermeasure that can think and make decisions in different scenarios.

Question 9

CISSP (Chapter 5 - Physical and Environmental Security)

Which of the following is not a characteristic of an electrostatic intrusion detection system?A. It creates an electrostatic field and monitors for a capacitance change.B. It can be used as an intrusion detection system for large areas.C. It produces a balance between the electric capacitance and inductance of an object.D. It can detect if an intruder comes within a certain range of an object.

Answer 9

B. An electrostatic IDS creates an electrostatic field, which is just an electric field associated with static electric charges. The IDS creates a balanced electrostatic field between itself and the object being monitored. If an intruder comes within a certain range of the monitored object, there is capacitance change. The IDS can detect this change and sound an alarm.

Question 10

CISSP (Chapter 5 - Physical and Environmental Security)

What is a common problem with vibration-detection devices used for perimeter security?A. They can be defeated by emitting the right electrical signals in the protected area.B. The power source is easily disabled.C. They cause false alarms.D. They interfere with computing devices.

Answer 10

C. This type of system is sensitive to sounds and vibrations and detects the changes in the noise level of an area it is placed within. This level of sensitivity can cause many false alarms. These devices do not emit any waves; they only listen for sounds within an area and are considered passive devices.

Question 11

CISSP (Chapter 5 - Physical and Environmental Security)

Which of the following is an example of glare protection?A. Using automated iris lenses with short focal lengthsB. Using standby lighting, which is produced by a CCTV cameraC. Directing light toward entry points and away from a security force postD. Ensuring that the lighting system uses positive pressure

Answer 11

C. When lighting is installed, it should be directed toward areas where potential intruders would most likely be coming from, and directed away from the security force posts. For example, lighting should be pointed at gates or exterior access points, and the guard locations should be in the shadows, or under a lower amount of illumination. This is referred to as “glare protection” for the security force.

Question 12

CISSP (Chapter 5 - Physical and Environmental Security)

Which of the following is not a main component of CPTED?A. Natural access controlB. Natural surveillanceC. Territorial reinforcementD. Target hardening

Answer 12

D. Natural access control is the use of the environment to control access to entry points, such as using landscaping and bollards. An example of natural surveillance is the construction of pedestrian walkways so there is a clear line of sight of all the activities in the surroundings. Territorial reinforcement gives people a sense of ownership of a property, giving them a greater tendency to protect it. These concepts are all parts of CPTED. Target hardening has to do with implementing locks, security guards, and proximity devices.

Question 13

CISSP (Chapter 5 - Physical and Environmental Security)

Which problems may be caused by humidity in an area with electrical devices?A. High humidity causes excess electricity, and low humidity causes corrosion.B. High humidity causes corrosion, and low humidity causes static electricity.C. High humidity causes power fluctuations, and low humidity causes static electricity.D. High humidity causes corrosion, and low humidity causes power fluctuations.

Answer 13

B. High humidity can cause corrosion, and low humidity can cause excessive static electricity. Static electricity can short-out devices or cause loss of information.

Question 14

CISSP (Chapter 5 - Physical and Environmental Security)

What does positive pressurization pertaining to ventilation mean?A. When a door opens, the air comes in.B. When a fire takes place, the power supply is disabled.C. When a fire takes place, the smoke is diverted to one room.D. When a door opens, the air goes out.

Answer 14

D. Positive pressurization means that when someone opens a door, the air goes out, and outside air does not come in. If a facility were on fire and the doors were opened, positive pressure would cause the smoke to go out instead of being pushed back into the building.

Question 15

CISSP (Chapter 5 - Physical and Environmental Security)

Which of the following answers contains a category of controls that does not belong in a physical security program?A. Deterrence and delayingB. Response and detectionC. Assessment and detectionD. Delaying and lighting

Answer 15

D. The categories of controls that should make up any physical security program are deterrence, delaying, detection, assessment, and response. Lighting is a control itself, not a category of controls.

Question 16

CISSP (Chapter 5 - Physical and Environmental Security)

Which is not an administrative control pertaining to emergency procedures?A. Intrusion detection systemsB. Awareness and trainingC. Drills and inspectionsD. Delegation of duties

Answer 16

A. Awareness and training, drills and inspections, and delegation of duties are all items that have a direct correlation to proper emergency procedures. It is management’s responsibility to ensure that these items are in place, properly tested, and carried out. Intrusion detection systems are technical or physical controls—not administrative.

Question 17

CISSP (Chapter 5 - Physical and Environmental Security)

If an access control has a fail-safe characteristic but not a fail-secure characteristic, what does that mean?A. It defaults to no access.B. It defaults to being unlocked.C. It defaults to being locked.D. It defaults to sounding a remote alarm instead of a local alarm

Answer 17

B. A fail-safe setting means that if a power disruption were to affect the automated locking system, the doors would default to being unlocked. A fail-secure configuration means a door would default to being locked if there were any problems with the power

Question 18

CISSP (Chapter 5 - Physical and Environmental Security)

Which of the following is not considered a delaying mechanism?A. LocksB. Defense-in-depth measuresC. Warning signsD. Access controls

Answer 18

C. Every physical security program should have delaying mechanisms, which have the purpose of slowing down an intruder so security personnel can be alerted and arrive at the scene. A warning sign is a deterrence control, not a delaying control.

Question 19

CISSP (Chapter 5 - Physical and Environmental Security)

What are the two general types of proximity identification devices?A. Biometric devices and access control devicesB. Swipe card devices and passive devicesC. Preset code devices and wireless devicesD. User-activated devices and system sensing devices

Answer 19

D. A user-activated system requires the user to do something: swipe the card through the reader and/or enter a code. A system sensing device recognizes the presence of the card and communicates with it without the user needing to carry out any activity.

Question 20

CISSP (Chapter 5 - Physical and Environmental Security)

Which of the following answers best describes the relationship between a risk analysis, acceptable risk level, baselines, countermeasures, and metrics?A. The risk analysis output is used to determine the proper countermeasures required. Baselines are derived to measure these countermeasures. Metrics are used to track countermeasure performance to ensure baselines are being met.B. The risk analysis output is used to help management understand andset an acceptable risk level. Baselines are derived from this level. Metrics are used to track countermeasure performance to ensure baselines are being met.C. The risk analysis output is used to help management understand and set baselines. An acceptable risk level is derived from these baselines. Metrics are used to track countermeasure performance to ensure baselines are being met.D. The risk analysis output is used to help management understand and set an acceptable risk level. Baselines are derived from the metrics. Metricsare used to track countermeasure performance to ensure baselines are being met.

Answer 20

B. The physical security team needs to carry out a risk analysis, which will identify the organization’s vulnerabilities, threats, and business impacts. The team should present these findings to management and work with them to define an acceptable risk level for the physical security program. From there, the team should develop baselines (minimum levels of security) and metrics to properly evaluate and determine whether the baselines are being met by the implemented countermeasures. Once the team identifies and implements the countermeasures, the countermeasures’ performance should be continually evaluated and expressed in the previously created metrics. These performance values are compared against the set baselines. If the baselines are continually maintained, then the security program is successful because the company’s acceptable risk level is not being exceeded.

Question 21

CISSP (Chapter 5 - Physical and Environmental Security)

Most of today’s CCTV systems use charged-coupled devices. Which of the following is not a characteristic of these devices?A. Receives input through the lenses and converts it into an electronic signalB. Captures signals in the infrared rangeC. Provides better-quality imagesD. Records data on hard drives instead of tapes

Answer 21

D. The CCD is an electrical circuit that receives input light from the lens and converts it into an electronic signal, which is then displayed on the monitor. Images are focused through a lens onto the CCD chip surface, which forms the electrical representation of the optical image. This technology allows the capture of extraordinary details of objects and precise representation because it has sensors that work in the infrared range, which extends beyond human perception. The CCD sensor picks up this extra “data” and integrates it into the images shown on the monitor, to allow for better granularity and quality in the video. CCD does not record data.

Question 22

CISSP (Chapter 5 - Physical and Environmental Security)

Which is not a drawback to installing intrusion detection and monitoring systems?A. It’s expensive to install.B. It cannot be penetrated.C. It requires human response.D. It’s subject to false alarms.

Answer 22

B. Monitoring and intrusion detection systems are expensive, require someone to respond when they set off an alarm, and, because of their level of sensitivity, can cause several false alarms. Like any other type of technology or device, they have their own vulnerabilities that can be exploited and penetrated

Question 23

CISSP (Chapter 5 - Physical and Environmental Security)

What is a cipher lock?A. A lock that uses cryptographic keysB. A lock that uses a type of key that cannot be reproducedC. A lock that uses a token and perimeter readerD. A lock that uses a keypad

Answer 23

D. Cipher locks, also known as programmable locks, use keypads to control access into an area or facility. The lock can require a swipe card and a specific combination that’s entered into the keypad.

Question 24

CISSP (Chapter 5 - Physical and Environmental Security)

If a cipher lock has a door delay option, what does that mean?A. After a door is open for a specific period, the alarm goes off.B. It can only be opened during emergency situations.C. It has a hostage alarm capability.D. It has supervisory override capability.

Answer 24

A. A security guard would want to be alerted when a door has been open for an extended period. It may be an indication that something is taking place other than a person entering or exiting the door. A security system can have a threshold set so that if the door is open past the defined time period, an alarm sounds.

Question 25

CISSP (Chapter 5 - Physical and Environmental Security)

Which of the following best describes the difference between a warded lock and a tumbler lock?A. A tumbler lock is more simplistic and easier to circumvent thana warded lock.B. A tumbler lock uses an internal bolt, and a warded lock uses internal cylinders.C. A tumbler lock has more components than a warded lock.D. A warded lock is mainly used externally, and a tumbler lock is used internally.

Answer 25

C. The tumbler lock has more pieces and parts than a warded lock. The key fits into a cylinder, which raises the lock metal pieces to the correct height so the bolt can slide to the locked or unlocked position. A warded lock is easier to circumvent than a tumbler lock.

Question 26

CISSP (Chapter 5 - Physical and Environmental Security)

During the construction of her company’s facility, Mary has been told that light frame construction material has been used to build the internal walls. Which of the following best describes why Mary is concerned about this issue?i. It provides the least amount of protection against fire.ii. It provides the least amount of protection against forcible entry attempts.iii. It is noncombustible.iv. It provides the least amount of protection for mounting walls and windows.A. i, iiiB. i, iiC. ii, iiiD. ii, iii, iv

Answer 26

B. Light frame construction material provides the least amount of protection against fire and forcible entry attempts. It is composed of untreated lumber that would be combustible during a fire. Light frame construction material is usually used to build homes, primarily because it is cheap, but also because homes typically are not under the same types of fire and intrusion threats that office buildings are.

Question 27

CISSP (Chapter 5 - Physical and Environmental Security)

Which of the following is not true pertaining to facility construction characteristics?i. Calculations of approximate penetration times for different types of explosives and attacks are based on the thickness of the concrete walls and the gauge of rebar used.ii. Using thicker rebar and properly placing it within the concrete provides increased protection.iii. Reinforced walls, rebar, and the use of double walls can be used as delaying mechanisms.iv. Steel rods encased in concrete are referred to as rebar.A. All of themB. None of themC. iiiD. i, ii

Answer 27

B. Calculations of approximate penetration times for different types of explosives and attacks are based on the thickness of the concrete walls and the gauge of rebar used. (Rebar refers to the steel rods encased within the concrete.) So even if the concrete were damaged, it would take longer to actually cut or break through the rebar. Using thicker rebar and properly placing it within the concrete provides even more protection. Reinforced walls, rebar, and the use of double walls can be used as delaying mechanisms. The idea is that it will take the bad guy longer to get through two reinforced walls, which gives the response force sufficient time to arrive at the scene and stop the attacker.

Question 28

CISSP (Chapter 5 - Physical and Environmental Security)

It is important to choose the correct type of windows when building a facility. Each type of window provides a different level of protection. Which of the following is a correct description of window glass types?i. Standard glass is made by heating the glass and then suddenly cooling it.ii. Tempered glass windows are commonly used in residential homes and are easily broken.iii. Acrylic glass has two sheets of glass with a plastic film in between.iv. Laminated glass can be made out of polycarbonate acrylic, which is stronger than standard glass but produces toxic fumes if burned.A. ii, iiiB. ii, iii, ivC. None of themD. All of them

Answer 28

C. Standard glass windows are commonly used in residential homes and are easily broken. Tempered glass is made by heating the glass and then suddenly cooling it. This increases its mechanical strength, which means it can handle more stress and is harder to break. It is usually five to seven times stronger than standard glass. Acrylic glass can be made out of polycarbonate acrylic, which is stronger than standard glass but produces toxic fumes if burned. Laminated glass has two sheets of glass with a plastic film in between. This added plastic makes it much more difficult to break the window.

Question 29

CISSP (Chapter 5 - Physical and Environmental Security)

Sandy needs to implement the right type of fencing in an area where there is no foot traffic or observation capabilities. Sandy has decided to implement a Perimeter Intrusion Detection and Assessment System. Which of the following is not a characteristic of this type of fence?i. It has sensors located on the wire mesh and at the base of the fence.ii. It cannot detect if someone attempts to cut or climb the fence.iii. It has a passive cable vibration sensor that sets off an alarm if an intrusion is detected.iv. It can cause many false alarms.A. iB. iiC. iii, ivD. i, ii, iv

Answer 29

B. Perimeter Intrusion Detection and Assessment System (PIDAS) is a type of fencing that has sensors located on the wire mesh and at the base of the fence. It is used to detect if someone attempts to cut or climb the fence. It has a passive cable vibration sensor that sets off an alarm if an intrusion is detected. PIDAS is very sensitive and can cause many false alarms.

Question 30

CISSP (Chapter 5 - Physical and Environmental Security)

CCTV lenses have irises, which control the amount of light that enters the lens. Which of the following has an incorrect characteristic of the types of CCTV irises that are available?i. Automated iris lenses have a ring around the CCTV lens that can be manually turned and controlled.ii. A lens with a manual iris would be used in areas that have fixed lighting, since the iris cannot self-adjust to changes of light.iii. An auto iris lens should be used in environments where the light changes, as in an outdoor setting.iv. As the environment brightens, this is sensed by the manual iris, which automatically adjusts itself.A. i, ivB. i, ii, iiiC. i, iiD. i, ii, iv

Answer 30

A. CCTV lenses have irises, which control the amount of light that enters the lens. Manual iris lenses have a ring around the CCTV lens that can be manually turned and controlled. A lens with a manual iris would be used in areas that have fixed lighting, since the iris cannot self-adjust to changes of light. An auto iris lens should be used in environments where the light changes, as in an outdoor setting. As the environment brightens, this is sensed by the iris, which automatically adjusts itself. Security personnel will configure the CCTV to have a specific fixed exposure value, which the iris is responsible for maintaining. On a sunny day, the iris lens closes to reduce the amount of light entering the camera, while at night, the iris opens to capture more light—just like our eyes.