Physical and Environmental Security CISA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An IS auditor is reviewing the physical security of a research and development facility. The facility has a single entry point with a security guard who checks employee badges. The auditor wants to test whether the control is effective. Which audit procedure would provide the MOST reliable evidence?

   • AObserve the entry point during peak hours to see if the guard checks every badge.
   • BInterview the security guard about the badge checking procedure.
   • CReview the badge issuance policy and compare it to the employee database.
   • DReview the visitor log for the last month to see if all visitors signed in.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which monitoring control provides a visual record of individuals entering a secure area?

   • AMantrap
   • BAccess log
   • CCCTV system
   • DBiometric reader
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which audit technique is most effective in evaluating the adequacy of environmental controls?

   • AReviewing the budget for environmental controls
   • BInterviewing the CEO
   • CPerforming a walkthrough of the facility
   • DReviewing maintenance logs
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An IS auditor is reviewing the physical security of a financial institution's headquarters. The building has a 24/7 security guard at the main entrance, a badge access system for internal doors, and CCTV coverage of the lobby. The auditor is concerned about the risk of tailgating. Which combination of controls would MOST effectively mitigate this risk?

   • AIncrease the number of security guards at the main entrance.
   • BRequire employees to wear badges that are visible at all times.
   • CAdd more CCTV cameras to cover the entrance and internal doors.
   • DInstall a turnstile at the main entrance that requires one badge swipe per person.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company's server room is protected by a biometric access control system. The system records the time and identity of each entry. During an audit, the IS auditor finds that the system's audit log is not being reviewed. What is the MOST likely risk associated with this finding?

   • AThe biometric data may be stolen from the system's database.
   • BUnauthorized access attempts may go undetected, and there is no accountability for who entered the room.
   • CThe biometric system may malfunction and lock out authorized personnel.
   • DThe system may not be able to authenticate users quickly enough during peak hours.
   Reveal Solution Discussion Select an answer first