Which statement best distinguishes physical access control from logical access control?

Physical access control is preventive, while logical access control is detective.

Physical access control applies to people, while logical access control applies only to machines.

Physical access control is implemented only by hardware, while logical access control is implemented only by software.

Physical access control protects tangible assets, while logical access control protects information and systems.

Which combination of processes is commonly referred to as the AAA triad in system access control?

Authentication, authorization, and auditing

Accounting, authorization, and approval

Authentication, availability, and accountability

Authorization, assurance, and access

A company uses a third-party SaaS application for HR management. The company wants to allow employees to access the application using their corporate credentials, and it wants to automatically deprovision access when an employee leaves. Which approach is most appropriate?

Use a shared service account for all employees to access the SaaS application.

Use API keys for each employee to access the SaaS application.

Create a separate account for each employee in the SaaS application and manually disable it when they leave.

Use federated identity with SAML, and configure the SaaS application to accept assertions from the corporate identity provider.

A software company provides a public API for its customers to integrate with its services. The company needs to control access to the API, ensuring that only authorized customers can use it and that each customer can only access their own data. Which access control mechanism is most appropriate?

Use a combination of API keys for identification and OAuth 2.0 scopes for authorization.

Issue each customer a unique API key and require it in the request header.

Implement a service account for each customer with a shared password.

Use OAuth 2.0 with scopes to grant customers specific permissions.

Certified Information Systems Security Professional

Domain 5Objective 1

5.1 - Control Physical and Logical Access to Assets CISSP Practice Questions (Page 1)

Part of the Identity and Access Management (IAM) domain, which accounts for 13% of the CISSP exam. ISC2 does not publish an official question count, but from its 180-minute exam (~70–120 total, ~9–16 in this domain), expect 2–3 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

7concepts

13%of the exam

Questions 1–5

1foundation · medium
Which device security measure is designed to prevent unauthorized devices from connecting to a network?
Select an answer first
2foundation · medium
Which statement best distinguishes physical access control from logical access control?
Select an answer first
3foundation · medium
Which combination of processes is commonly referred to as the AAA triad in system access control?
Select an answer first
4expert · medium
A company uses a third-party SaaS application for HR management. The company wants to allow employees to access the application using their corporate credentials, and it wants to automatically deprovision access when an employee leaves. Which approach is most appropriate?
Select an answer first
5application · medium
A software company provides a public API for its customers to integrate with its services. The company needs to control access to the API, ensuring that only authorized customers can use it and that each customer can only access their own data. Which access control mechanism is most appropriate?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CISSP

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISC2. “CISSP” is a trademark of its owner, used for identification only.