CISSP Physical Security

What height of fence is required to deter casual intruders? A. 8 feet B. 6 feet C. 4 feet D. 12 feet

( C) Fences 3-4 feet high prevents only casual intruders. Six-foot-high fences become difficult to climb. Critical assets should be physically protected with a fence that is 8 feet high with a three-strand topping of razor wire or razor wire in coils.

You are put in charge of the new semiconductor facility, and your boss is concerned about ESD. To protect sensitive equipment from ESD damage, the humidity should be kept at what level? A. 10-20 percent B. 20-40 percent C. 40-60 percent D. 60-80 percent

( C) In home environments, electrostatic discharge (ESD) may be an annoyance. In the workplace, its results can be much more severe. ESD can damage or destroy sensitive electronic components, attract contaminants, and cause products to stick together. American National Standards Institute (ANSI) specifications recommend a 40-60 percent humidity range for the prevention of ESD. Humidity above 60 percent is uncomfortable for people, and below 40 percent increases the risk of static generation. Individuals in charge of the environment should consider equipping their areas with active humidity-monitoring equipment to ensure that values stay within the required range.

Which of the following is classified as a ASTM Class II gate? A. Commercial B. Industrial C. Residential D. Restricted access

(A) A Class II gate is designed for commercial use. Answers B, C, and D are incorrect, because residential gates are Class I, industrial gates are Class III, and restricted access are Class IV.

A cipher lock is programmable. A. True B. False

(A) A cipher lock is typically found in the configuration of a keypad. These locks are programmable and do not use keys.

A magnesium fire is best suppressed with a Class D extinguisher. A. True B. False

(A) A magnesium fire is considered a Class D fire and would be fought by applying a special dry powder only.

Which of the following fits into the category of a power loss? A. Blackouts B. Spikes and surges C. Brownouts D. Surges

(A) A power outage, which can be called a blackout, is when power is lost for an extended time. The largest blackout ever to occur in the U.S. happened on August 14, 2003. It affected nearly 60 million people. A brownout occurs when power companies experience an increasingly high demand for power. Spikes are associated with power excesses.

Because of an upturn in business, your company has started running a second shift. Some of the line workers complain to your boss that it is very dark in the parking lot. He advises you to investigate the purchase and installation of new exterior lighting. What level of illumination does NIST recommend for lighting critical areas? A. Two feet of candlepower at a height of 8 feet B. Two feet of candlepower at a height of 10 feet C. Four feet of candlepower at a height of 8 feet D. Four feet of candlepower at a height of 6 feet

(A) Although lighting adds to the security of a facility, it is best when applied with other types of deterrents. The National Institute of Standards and Technology (NIST) states that the standard for perimeter protection using lighting is an illumination of 2 feet of candlepower at a height of 8 feet.

Although not all facilities have windows, those that do can have varying types. Which window type is used to prevent shattering and maintain its integrity during a fire? A. Wired B. Security film C. Laminated glass D. Standard glass

(A) Answer A is correct, because wired glass is designed to maintain its integrity and not shatter easily. Answers B, C, and D do not match that description.

Which type of gate is best suited for a prison or restricted-access area that is monitored directly or remotely? A. Class IV B. Class D C. Class A D. Class 1

(A) Answers B, C, and D are incorrect. Gates are broken into four basic groups, which include Class, I, II, III, and IV. Class IV gates are designed for high security environments that also require monitoring.

What class of fire suppression should be used against common fires, such as paper and computer printouts? A. Class A B. Class B C. Class C D. Class D

(A) Class A fire suppression should be used to fight common fires. The extinguishing method of choice is water or soda acid. Class B is for burnable fuels and oils, Class C is for electrical fires, and Class D is for chemical fires

Doors with automatic locks can serve as a good form of physical protection. These doors can be configured to respond to power outages in either a fail-safe or fail-open condition. Which of the following describes fail-open? A. If a loss of power occurs, the door remains unlocked. B. If a loss of power occurs, the door opens automatically. C. In case of a power outage, the door has a BPS and continues to operate normally. D. In case of a power outage, the door will unlock, but it can be secured with a special key.

(A) If a door is considered fail-open, it remains unlocked during a power outage. All other answers are incorrect, because they do not adequately describe the operation of fail-open systems.

Control types such as lights are a type of physical deterrent. A. True B. False

(A) Lights are a good example of a physical deterrent. Well-lighted areas make an attacker worry that he will be seen or detected.

Your technician is preparing to buy all the equipment that has been budgeted for next year. While reviewing the specifications for several pieces of equipment, he notices that each device has an MTBF rating. He asks if you can explain what this means. Which of the following is the best response? A. The MTBF is used to determine the expected average time between failures. B. The MTBF is used to determine the expected time before a repair is needed. C. The MTBF is just a ratio of MTTR used to evaluate product repair time. D. The MTBF is used to determine how many backup devices are needed.

(A) Mean Time Between Failures (MTBF) is the average amount of time between device breakdowns. Higher numbers mean that the devices last longer.

Which of the following is the best HVAC choice for an organization to use in case of fire and smoke? A. Positive pressurization B. Sealed windows C. Negative pressurization D. Neutral pressurization

(A) Positive pressurization is an heating, ventilation, and air-conditioning (HVAC) design in which positive pressure is maintained in the system, so as a door or window is opened, air is forced out. This protects employees in case of a fire by forcing smoke outside, away from the employees. This positive pressurization also helps keep contaminants out of the building when doors are opened. The air rushes out, rather than in carrying pollen and other substances.

Which of the following fire-suppression systems works by removing the fuel element? A. Soda acid B. CO2 C. Water D. Oxygen

(A) Soda acid works by removing the fuel element of a fire. CO2 works by removing the oxygen from a fire. Water works by reducing the temperature of a fire. Oxygen would not reduce a fire, but would actually cause it to grow larger.

A closed-circuit TV (CCTV) system has been installed to monitor a bank's ATM. The lighting has been adjusted to prevent dark areas, and the depth of field and degree of focus are appropriate for proper monitoring. However, the guard has asked if it would be possible to provide greater width to the area being monitored to permit a subject to be captured for a longer stretch of time. Which adjustment is needed? A. Decrease the focal length B. Increase the focal length C. Decrease the iris D. Increase the iris

(A) The focal length adjusts the breadth of view. A shorter focal length permits a wide-angle view, and a long focal length provides a telephoto view. Therefore, answer B is incorrect. In real life, the organization may opt for a zoom lens that permits the guard to redirect the field of view as necessary. Answers C and D are incorrect because the iris controls the amount of light the camera receives and needs to be larger as the amount of light available decreases.

The facility and the data center should not share a common HVAC system. A. True B. False

(A) The organization and the data center should have separate HVAC systems that are not interconnected. The HVAC used in the data center should be dedicated, controlled, and monitored.

Control types such as an annunciation system are a type of intrusion detection. A. True B. False

(A) The purpose of annunciation is to give the guard or other individuals an early warning of a problem or security breach to allow action to be taken before a situation degrades or further damage occurs.

Permitting your data center to be too warm can cause what problem? A. The equipment turns off. B. The equipment works slower. C. The computer parts get corroded. D. Static electricity is introduced.

(A) Too hot of an environment can cause the equipment to overheat and turn off. Too cold a temperature can cause the performance speed to drop. Corrosion is introduced when there is too much moisture in the air, and static electricity is introduced when the humidity is too low.

Wire mesh embedded between two sheets of glass typically is used for a fire break. A. True B. False

(A) Wire mesh secures the glass and prevents it from losing its integrity. As such, a solid barrier is maintained, and a fire break is provided.

Areas of fixed lighting should be observed with a CCTV camera that supports an auto iris lens. A. True B. False

(B) A CCTV camera that monitors an area of fixed lighting should have a fixed iris lens. An auto iris lens is not needed, because the lighting is maintained at a constant level.

Bump keys are used to bypass cipher locks. A. True B. False

(B) A bump key is a special key that has been cut to a number nine position and has a small amount of extra material shaved from the front and the shank of the key. When slight pressure is applied and the key is bumped or tapped, the pins are driven upward, giving the attacker access. Bump keys are easy to make and easy to obtain on the Internet.

A mantrap is a turnstile and a badge reader. A. True B. False

(B) A mantrap is a set of two doors and a small room that is designed to hold someone until he or she is fully cleared for access to prevent piggybacking.

You are asked to secure the operations of a South American electronics production plant. Because of rising energy prices, this small country has been plagued with power problems over the last several years. One major problem has been the fluctuation of power to greater-than-normal levels. Which of the following best describes this event? A. Faults and blackouts B. Spikes and surges C. Sags and brownouts D. Noise and EMI

(B) A power excess can quickly damage sensitive electronic equipment. The best way to guard against this type of problem is through the use of surge protectors. Brownouts occur when power companies experience an increasingly high demand for power, and blackouts are associated with power loss. EMI is unwanted electrical signals that produce undesirable effects and otherwise disrupt the control system circuits. Electrical noise can cause interference.

What is a critical consideration when discussing physical security? A. Guard dogs B. Layered access control C. Fences D. CCTV

(B) Access control is the key to physical security, and it works best when deployed in layers. Each layer acts as a physical barrier. At a minimum, a system should have three physical barriers: entrance to the building, entrance to the computer center, and entrance to the computer room itself. These barriers can include guards, biometric access control, locked doors, CCTV, and alarm systems.

Which of the following statements about CCTV is not true? A. CCTV is a good example of a deterrent system. B. CCTV is a good example of an automated intrusion detection system. C. CCTV is effective at deterring security violations. D. CCTV is a good example of a detection system.

(B) Although closed-circuit TV (CCTV) systems are good deterrent-and-detection systems, they are not automatic. CCTV requires individuals to watch the captured video, detect the malicious activity, and respond accordingly.

You are asked to perform a review of the physical controls of your company's data center. Your review will include access control and various preventive and detective controls. With this in mind, what would you say is the primary purpose of CCTV from a control perspective? A. CCTV will allow the review of internal or external activity. B. CCTV can mitigate risk by detecting, assessing, and identifying intruders. C. CCTV is only a detective control. D. CCTV can not generally be used in public areas.

(B) Answers A, C, and D are incorrect, because CCTV is used in public areas and can be used as more than just a detective control, depending on its configuration. CCTV can be used as a preventive, detective, or even compensating control. While CCTV should have some type of recording system for review, what is important to consider is where and how the CCTV system will be used.

Superior Solutions, Inc., has acquired a contract for the upgrade of a local manufacturer's fire-suppression system. The client wants to find suitable replacements for its Halon fire-suppression system. Which of the following is not a suitable replacement? A. Argon B. Hydrogen bromide C. Inergen D. FM-200

(B) Argon, Inergen, low-pressure water mists, and FM-200 are some of the acceptable replacements for Halon. Halon has been phased out, because it acts as an ozone-depleting substance when released into the atmosphere. Hydrogen bromide is a byproduct of Halon and is considered toxic.

Bollards are used to control the egress and ingress of people. A. True B. False

(B) Bollards can be concrete or steel. They are used to block vehicular traffic, particularly at entrances and lobbies, or to protect areas from being rammed by speeding cars, trucks, or vans.

You are asked to review the design of your organization's new data center. The proposed data center will be unmanned and typically will not have anyone working inside. With this in mind, which of the following fire-suppression methods works by removing the oxygen element? A. Soda acid B. CO2 C. Water D. NO2

(B) CO2 works by removing the oxygen from a fire. Soda acid works by removing the fuel element of a fire. Water works by reducing the temperature of a fire. Answer D, nitrous oxide, does not reduce a fire

What class of fire suppression should be used against oil or gas fires? A. Class A B. Class B C. Class C D. Class D

(B) Class B fire suppression should be used against any type of burnable fuel. The recommended suppressants include CO2, soda acid, and Halon. The other answers are incorrect, because Class A corresponds to common combustibles, Class C is for electrical fires, and Class D is for chemical and grease fires.

CPTED is designed to deny access by means of physical and man-made barriers, such as locks and fences. A. True B. False

(B) Crime Prevention Through Environmental Design (CPTED) is designed to deter criminal behavior. An example is placing the parking lot near an area in which employees sit so that they can see and monitor their cars. Lighting the area at night is another example.

Data center doors typically are hinged to the outside. A. True B. False

(B) Data center doors should be hinged to the inside to harden the facility and make removing the doors more difficult.

Which of the following water-suppression systems contains compressed air or nitrogen? A. Wet pipe B. Dry pipe C. Deluge system D. Preaction system

(B) Dry pipe systems contain compressed air instead of water. The pipes are hooked up to a storage tank or water main. The system uses a valve that is sensitive to pressure. When the system is activated, the sprinkler heads open and force the compressed air to rush forward. This results in a drop in pipe pressure, which signals the pressure-sensitive valve connecting to the water supply.

You are asked to sit in on a meeting with the design team working on the new security data center. Because this facility will have extremely high security, you are concerned about having the appropriate type of fence in place. There will be limited access to this facility, and Class IV gates will be used. What is the correct specification for this perimeter barrier? A. 2-inch mesh, 9 gauge B. 3/8-inch mesh, 11 gauge C. 1-inch mesh, 9 gauge D. 2-inch mesh, 6 gauge

(B) Fences are one of the first lines of defenses and, as such, should be of the right design to protect the physical facility. A 3/8-inch mesh, 11-gauge wire is the specification for an extremely high-security fence. Answer A specifies a normal fence design. Answer C specifies a very high-security fence design, and answer D specifies a greater-than-normal fence design.

Placing your headlights on low beam when approaching a security checkpoint is an example of glare protection. A. True B. False

(B) Glare protection requires a properly designed guardhouse with lights facing away from the guards and toward potential attackers. Approaching vehicles turn off their headlights so that the guards at a security checkpoint can clearly see them and their occupants.

Doors with automatic locks can serve as a good form of physical protection. These doors can be configured to respond to power outages in either a fail-safe or fail-open condition. Which of the following describes fail-safe? A. If a loss of power occurs, the door opens automatically. B. If a loss of power occurs, the door remains locked. C. In case of a power outage, the door has a BPS and continues to operate normally. D. In case of a power outage, the door will lock but can be opened with a passkey.

(B) If a door is considered fail-safe, it remains locked during a power outage. If this type of door is being used, people's safety must take precedence. This means that the door should be equipped with a panic bar or other mechanism that allows individuals to safely exit the building during a power outage or emergency. All other answers are incorrect, because they do not adequately describe the operation of fail-safe locks.

Your lab manager is preparing to buy all the equipment that has been budgeted for next year. While reviewing the specifications for several pieces of equipment, he notices that each device has a Mean Time To Repair (MTTR) rating. He asks you what this means. Which of the following is the best response? A. The MTTR is used to determine the expected time before the repair can be completed. Higher numbers are better. B. The MTTR is used to determine the expected time before the repair can be completed. Lower numbers are better. C. The MTTR is used to determine the expected time between failures. Higher numbers are better. D. The MTTR is used to determine the expected time between failures. Lower numbers are better.

(B) Mean Time To Repair (MTTR) is a value used to calculate the average time to bring a device back up to operating standards. Lower numbers mean reduced downtime. Answers C and D describe Mean Tme Before Failures (MTBF) and do not describe MTTR.

Which of the following is a major drawback of the decision to use security guards as a form of physical deterrent? A. Schedule B. Salary and benefits C. Liability D. Culpability

(B) One major drawback of employing guards as a physical security deterrent is the cost of salaries. All other answers are incorrect. Liability is addressed by the fact that security guards typically are bonded and have had to pass state board licensing requirements. The guards' schedule and benefits are also not the primary drawback. Culpability simply means that the guard is deserving of blame.

What is one of the largest drawbacks of using guard dogs as a physical security control? A. Care B. Liability C. Investment D. Training

(B) Perhaps you've heard the phrase "junkyard dog." In that type of setting, dogs are highly effective, because no one should be in the facility during off hours. However, dogs lack the skill to differentiate between authorized and unauthorized personnel, so they can be a legal liability that results in criminal charges or a civil lawsuit.

Plenum cable is used for environmental reasons. A. True B. False

(B) Plenum-grade cable is used because it is designed to release less toxic gas in case of a fire so that employees' health and welfare are maintained.

What type of attack relies on the trusting nature of employees and the art of deception? A. Hijacking B. Social engineering C. Spoofing D. Deception

(B) Social engineering is a type of attack in which intruders attempt to gain physical access to your facility by exploiting people's generally trusting nature. A social engineering attack may come from someone posing as a vendor or as someone coming to the facility to repair a problem. Regardless of how the person appears, social engineering can be hard to detect. Social engineering can also be used to gain logical access by means of tricking a user to giving out some type of sensitive information

Which of the following replacements for Halon has been recommended by the EPA? A. Argon B. FM-200 C. Inergen D. FM-300

(B) The EPA considers FM-200 the replacement of choice for Halon systems. FM-200 has been adopted by the majority of the world's fire protection companies and has been installed in tens of thousands of systems across the globe. It is similar to Halon but does not affect the ozone layer. Argon and Inergen will work, but they are not as effective. FM-300 does not exist.

You are asked to serve as a consultant on the design of a new facility. Which of the following is the best location for the server room? A. Near the outside of the building B. Near the center of the building C. In an area that has plenty of traffic so that equipment can be observed by other employees and guests D. In an area that offers easy access

(B) The best location for a server room is near the center of the building. This location is more secure from natural disasters and helps protect against intruders. This type of configuration requires the intruder to pass multiple employees and possibly checkpoints before reaching the server room. If employees are properly educated, they will ask what the unauthorized person is doing in the area. The theory of layered security applies to physical security just as much as it does to the other domains!

You are hired to consult for TrayTec, a small manufacturing firm. This firm is preparing to construct a data center. What is the recommended temperature for rooms containing computer equipment? A. 50-65 degrees Fahrenheit B. 60-75 degrees Fahrenheit C. 65-85 degrees Fahrenheit D. 70-85 degrees Fahrenheit

(B) The recommended temperature for rooms containing computer equipment is 60-75 degrees Fahrenheit (15-23 degrees Celsius). Temperatures of 80-85 degrees Fahrenheit are not considered catastrophic; however, higher temperatures can result in lowering the life expectancy of equipment.

Warded locks are more secure than pin-and-tumbler locks. A. True B. False

(B) The two basic types of locks are warded and pin-and-tumbler. Pin-and-tumbler is considered higher security.

Which of the following heat-activated fire-detection systems provides the fastest warning time? A. Fixed temperature B. Rate of rise C. Photoelectric D. Piezoelectric

(B) The two valid types of heat-activated fire detection systems are fixed temperature and rate of rise. Rate of rise offers the best response time. However, remember that these systems result in more false-positive alarms.

What is the benefit of a contingency plan? A. Perimeter defense B. Diversity of controls C. Defense in layers D. Facility access controls

(C) A contingency plan protects you when a primary control fails; it represents the concept of multiple layers in your defense. Perimeter defense identifies your first line of defense and is a primary control, not a contingency plan. Diversity of controls refers to having a mixture of a type of control (primary or contingency) so that understanding one instance of a control doesn't guarantee knowledge of the next instance. Facility access controls are your physical perimeter's defense.

Which of the following fits in the category of power degradation? A. Blackouts B. Spikes C. Brownouts D. Surge

(C) A power degradation, such as a brownout, occurs when power companies experience an increasingly high demand for power. Spikes are associated with power excesses. Blackouts are associated with power loss, and surges are associated with excessive power spikes. Sags are another low voltage condition.

You are placed in charge of a small room full of servers. Which of the following is the best protection against brownouts and temporary power loss? A. RAID B. Surge protectors C. UPS D. Voltage regulators

(C) An uninterruptible power supply (UPS) can be used to provide power to critical equipment during short power outages. Surge protectors and voltage regulators help condition the power to ensure that it is clean and smooth. RAID is used for disk drive fault tolerance.

One important area of physical security is fire detection, suppression, and response. One physical control that may be used in this area is a _________, which is an application that's used primarily in firefighting systems. Its hinged gate only remains open in the inflowing direction. It also has a spring that keeps the gate shut when there is no forward pressure. A. Backwater valve B. Duckbill valve C. Clapper valve D. Diaphragm valve

(C) Answers A, B, and D are incorrect. Answer C is correct as a clapper valve uses a hinged gate only remains open in the inflowing direction. It also has a spring that keeps the gate shut when there is no forward pressure.

Which one of the following is not one of the three main types of fire-detection systems? A. Heat sensing B. Flame sensing C. CO2 sensing D. Smoke sensing

(C) CO2 sensing is not a valid type of fire detection. The three categories of fire-detection systems are heat sensing, flame sensing, and smoke sensing. According to OSHA standard 1910.164, the employer is responsible for ensuring that the number, spacing, and location of fire detectors are based on design data obtained from field experience, tests, engineering surveys, the manufacturer's recommendations, or a recognized testing laboratory listing.

What class of fire suppression should be used against electrical fires, such as computers or electronic equipment? A. Class E B. Class D C. Class C D. Class B

(C) Class C fire suppression should be used against electrical fires. CO2 and Halon are recommended suppression methods. Class A corresponds to common combustibles, Class B is for burnable fuels, and Class D is for chemical and grease fires.

Which of the following would you be least likely to find in a data center? A. Dry pipe fire control B. Smoke detectors C. Drop ceilings D. Surge protection

(C) Drop ceilings (plenum space) should not be used in data centers or areas that are adjacent to server rooms. Although these are convenient for hiding cables, the better location is under the raised floor. Drop ceilings offer the intruder a potential path over the wall and into the data center if the wall does not run all the way to the roof. This gives potential intruders easy access. All the other items are recommended for server rooms. Dry pipe fire control offers the potential for water, but also provides adequate time to turn off or power down electronics. Smoke detectors are a must for all areas. Surge protection can be used to protect expensive equipment.

What height of fence is required to deter determined intruders? A. 4 feet B. 5 feet C. 8 feet D. 6 feet

(C) Fences 3 to 4 feet high prevent only the casual intruder. Six-foot-high fences are difficult to climb. Critical assets should be physically protected with a fence that is 8 feet high. A three-strand barbed-wire topping is an effective added security measure. If you are trying to keep out the bad guys, you should point the razor wire topping out. If you are really concerned about who's hanging around the perimeter of your facility, consider installing a perimeter intrusion and detection assessment system (PIDAS). This special fencing system has sensors so that it can detect intruders.

Why is Halon no longer being produced or sold? A. It has been found to cause cancer in laboratory animals. B. The base components in Halon are considered rare. This has resulted in a massive price increase. Other options are now much cheaper. C. Its use was banned because it was an ozone-depleting agent. D. Its use was banned because it is considered a dual-use technology that can be used to produce weapons.

(C) Halon has been found to destroy the ozone layer. Because of this, it was banned, and an international agreement was signed in 1994. As long as exposure is low, Halon is considered harmless to humans; however, in greater amounts, Halon can cause difficulty breathing, chest pains, and skin irritation.

Above what concentration is Halon considered toxic when inhaled? A. 5 percent B. 6 percent C. 10 percent D. 15 percent

(C) If Halon is deployed in concentrations of greater than 10 percent and in temperatures of 900 degrees or more, it degrades into hydrogen fluoride, hydrogen bromide, and bromine. This toxic compound is not something that people should breathe. Halon has also been discovered to be three to ten times more damaging to the ozone layer than CFCs.

Which intrusion detection system can sense changes in heat waves in an area? A. Wave pattern B. Proximity detection C. Passive infrared system D. Acoustical system

(C) Passive infrared systems look for the rise of heat waves. Acoustical systems are sensitive to changes in sound and vibration. Proximity detection works by detecting changes in the magnetic field. Wave pattern bounces various frequency waves around a room while verifying that the pattern is undisturbed.

Which of the following describes best practices for a company's evacuation and emergency response plans? A. Once a year, surprise emergency drills should be held to see if managers understand corporate policy. Employees' demonstrated knowledge of procedures should be discussed in their yearly performance evaluations. B. Employees should be provided with written descriptions of emergency actions as part of their corporate indoctrination and should be required to keep the documents in a ready state at their workstations. C. Periodic refresher training should be provided to all employees. Planned exercises with realistic predetermined scenarios should be executed, where managers account for personnel as part of any evacuations. D. Emergency plans should be posted in all work spaces and lounge areas throughout a corporation. All employees should have a way to submit suggestions for improving the plan.

(C) People need to be focused on the emergency they are practicing a response to in order for that response to become an automatic function in case of a real emergency. The practice should be carried out to completion, including the requirement that managers account for the proper evacuation of all personnel by accounting for those personnel after the rehearsed evacuation. It is also important to look out for any piggybackers going into the facility after the exercise.

Which of the following best describes piggybacking? A. The act of stealing someone's access card to gain access later B. The act of watching over someone's shoulder to steal a password for later use C. The act of following someone through a secured door to gain unauthorized access D. The act of spoofing someone's identity to gain unauthorized access

(C) Piggybacking is the act of following someone through a secured door without being identified to obtain unauthorized access. The act of watching over someone's shoulder as he enters a password is called shoulder surfing. To spoof someone's identity is to pretend to be that person.

What is a special type of identification device that does not require action by users because the user only needs to have it passed close to the ID device? A. Biometric systems B. Access control badges C. Proximity badges D. CCTV

(C) Proximity identification can be used to activate doors or locks or to identify employees. These systems only require users to pass in proximity to the sensor or sensing system. All other answers are incorrect, because they do not describe a proximity system.

Which of the following statements about server rooms is incorrect? A. Server rooms should have barriers on all six sides. B. Server rooms should be kept at cold temperatures. C. Server rooms should be accessible to IT staff. D. Server rooms should not be shared with IT workers.

(C) Server rooms are typically inaccessible to IT staff, because their activities should be done remotely. Even if your employees are fully authorized, they should not share space with the server room where critical equipment is located. Noise and cold temperatures are not conducive to the working environment. Access should be controlled for even authorized IT workers, except when they have specific reasons to access equipment.

Which of the following is not a valid intrusion detection system? A. Wave pattern B. Proximity detection C. Geometric system D. Acoustical system

(C) Some of the technologies that can be used to detect intruders are wave pattern, which bounces various frequency waves around a room while verifying that the pattern is undisturbed; proximity detection, which works by detecting changes in the magnetic field; and acoustical systems, which are sensitive to changes in sound and vibration.

Halon extinguishers contained a gas that interrupts the chemical reaction of a fire. They were useful and popular for fighting electrical fires that required a nonconductive and noncorrosive control agent. However, Halon was found to be damaging to our environment and was removed from the list of acceptable agents. What document first limited the use of Halon? A. Clean Air Act B. Halon Emissions Reduction Rule C. Environmental Protection Act of 1990 D. Montreal Protocol

(C) The Montreal Protocol of 1987 was an international agreement to phase out all substances that damaged the ozone layer as soon as possible. Therefore, the Montreal Protocol initiated the effort to reduce the use of Halon, and it led to the ban of Halon. The UK's Environmental Protection Act of 1990 declared that it was illegal to "treat, keep or dispose of controlled waste in a manner likely to cause pollution to the environment." The Halon Emission Reduction Rule banned the manufacturing of Halon and specified methods for proper disposal. The Clean Air Act of 1990, incorporated in U.S. Code, provides legislation to curb the use of materials that are harmful to the environment.

Which of the following is not a valid fire-suppression system? A. Wet pipe B. Dry pipe C. Reaction system D. Deluge system

(C) The four primary fire-suppression systems are wet pipe, dry pipe, deluge system, and preaction system.

Which of the following physical security practices is the best security solution implementation? A. Placing a Halon fire extinguisher system in the new cafeteria. B. Erecting parking-lot lighting on poles in the center of periodic islands, on which trees have been planted for beautification. C. Installing emergency-exit fire doors that fail-close in the event of a power failure and that have push panic bars for emergency release.

(C) When possible, you want emergency doors to fail open in the case of a power failure. However, when fail-open is not appropriate, it is critical that the doors have a push panic bar that permits people to exit in the event of an emergency. Not only are Halon fire systems no longer available for deployment, but they would be inappropriate for a cafeteria. On the customer side of a cafeteria, water should be deployed as the suppression agent. On the kitchen side of a cafeteria, wet chemicals are used. Trees should not be planted under the poles that provide safety lighting, because their foliage will block the light. Data centers should be located in the center of an organization's building, where outside windows are unavailable and inappropriate.

Which of the following would be considered a gas-discharge fire-extinguishing system? A. Wet pipe B. Dry pipe C. Flame-activated sprinkler D. Handheld CO2 fire extinguisher

(D) A handheld CO2 fire extinguisher is considered a gas-discharge fire-extinguishing system. Wet-pipe systems are filled with water. Dry-pipe systems contain compressed air until fire suppression systems are triggered, and then the pipe is filled with water. Flame-activated sprinklers trigger when a predefined temperature is reached.

Which intrusion detection system can sense changes in vibration and noise level in an area? A. Wave pattern B. Proximity detection C. Passive infrared system D. Acoustical system

(D) Acoustical systems are sensitive to changes, sound, and vibration. Proximity detection works by detecting changes to the magnetic field. Passive infrared systems look for the rise of heat waves. Wave pattern bounces various frequency waves around a room while verifying that the pattern is undisturbed.

Your manager wants to know which of the following you, as a CISSP, would rank as the item of highest priority. How should you answer? A. Duty to the ISC2 code of ethics B. Duty to protect company assets C. Duty to company policy D. Duty to public safety

(D) Although the other items on the list are important, the protection of human life makes duty to public safety the number-one priority of the CISSP.

You are asked to examine the placement of lighting to be used for perimeter security. The organization is worried about how lighting can be used to detect individuals who are at the fence line of a high-security facility, attempting to gain access to the facility. There is a road outside of the fence line and several guard stations near the facility doors. Which of the following would be the best approach? A. Place the lighting on the outside of the fence, away from the facility, evenly spaced on poles 5 feet high. B. Place the lighting on the inside of the fence, toward the facility, evenly spaced on poles 8 feet high. C. Place the lighting evenly spaced above the fence 5 feet high. D. Place the lighting evenly spaced above the fence 8 feet high.

(D) Answers A, B, and C are incorrect because lighting should be placed over the fence so that trespassers can be easily spotted and their field of view is reduced during an attack. Lighting should not illuminate security guard posts, roads, or security elements. Guards should clearly be able to see the attacking individuals.

When considering external boundary mechanisms, care should be taken to ensure that only authorized individuals are allowed access. Which of the following is not one of the services that a boundary mechanism, specifically a fence, provides? A. Acts as a buffer and delaying mechanism B. Offers increased protection C. Helps control access D. Prevents intruders

(D) Answers A, B, and C are incorrect. Although fences can act as buffering and delaying mechanisms, offer increased protection, and can help control access, a fence can be cut, climbed, or bypassed.

When you're choosing the physical location for a new facility, which of the following should you not avoid? A. Airport flight paths B. Chemical refineries C. Railway freight lines D. Hospitals

(D) Any time you start building from scratch, you should consider the surroundings. Areas that are close to airline flight paths, freight lines, or chemical plants may be subject to explosions or crashes. Answer D is correct because having a hospital nearby can be considered an asset. This allows the company to quickly get help to anyone who gets injured.

What class of fire suppression should be used against chemical or grease fires? A. Class A B. Class B C. Class C D. Class D

(D) Class D fire suppression should be used against grease or chemical fires. The other answers are wrong because Class A corresponds to common combustibles, Class B is for burnable fuels, and Class C is for electrical fires.

Your company is about to begin the parallel test of its latest application, which will then be deployed in house. The company has set up temporary space in a secure room that backs up to the data center. When the equipment in the new lab is powered up, what power anomaly might the computers experience? A. Surge B. Brownout C. Noise D. Sag

(D) Devices that draw a large amount of current can cause an "in-rush current" that causes a sag in surrounding equipment. A surge is a prolonged period of increased voltage, a brownout is a prolonged period of decreased voltage, and noise is interference - a disruption often caused by RFI or EMI

Which of the following is the specification for Halon that can be used as a gas agent? A. Halon 2800 B. Halon 1625 C. Halon 1311 D. Halon 1301

(D) Halon can be found in two types: Halon 1211 is used in portable extinguishers, and Halon 1301 is a gas agent used in fixed flooding systems.

Controlled humidity is important in preventing ESD. What level of static discharge is the approximate amount required to destroy data on hard drives? A. 100 static volts B. 500 static volts C. 1,000 static volts D. 1,500 static volts

(D) In low-humidity environments, it's not impossible to create static charges in excess of 20,000 volts. It takes only about 1,500 static volts to damage a hard drive or cause destruction of data. Sensitive electronic components can be damaged by less than 100 static volts.

Which of the following lock types would you rate as the most secure when installed properly? A. Wafer lock B. Combination lock C. Pin lock D. Cipher lock

(D) Of these locks, a cipher lock is considered the most secure. A wafer lock is the least secure; it is the type found on filing cabinets. Pin locks or tumbler locks can be defeated with bump keys, and combination locks can be defeated with a cut aluminum can that is wrapped around the locking bolt. Electronic combination locks are more secure, but without further qualification, "combination locks" refers to the style used on lockers.

What is the absolute first requirement of security? A. Implementation of CPTED B. Mitigation of damage C. Protecting assets D. Protecting people

(D) The absolute first requirement of a CISSP is protecting people. Answers A, B, and C are important, but a CISSP's first goal is always people's safety and welfare.

While you are consulting for TrayTec, Inc., an employee approaches you with a question. Which of the following would you say is not a reason to put a raised floor in the server room? A. For increased airflow B. To allow easy access to cables C. To prevent damage to equipment in case of a flood or water leak D. To isolate equipment from harmful vibrations

(D) Using a raised floor provides many benefits, including increased airflow, easy access to cables, prevention of flooding damage to computers, and easier reconfiguration. Vibration is not a critical concern.

You are asked to create the new company policy on emergency response and training. You want to make sure that the policy defines how employees are trained to deal with fire drills. Which of the following is the best way to carry out emergency fire drills? A. Fire drills should be timed to correspond with company breaks. B. Fire drills should be a scheduled event that all employees are told about. C. Fire drills should be a random event that the employees are unaware of before the event. D. Fire drills are an unnecessary event that cuts into employee work time, thereby reducing productivity.

Fire drills should be a random event that the employees are unaware of before the drill. Fire drills should not be scheduled, because that defeats the purpose. Fires or natural disasters are not scheduled events. Finally, productivity is not the driving force; rather, it should be employee safety. Employees should have a designated area to go to that is outside the facility in a safe zone. Supervisors or others should be in charge of the safe zones, where there can be an employee count to ensure that everyone is present and accounted for. After the drill, there should be a single point of reentry, and employees should have their IDs checked before returning to work.