Physical security looks like the easy part of Security+. Locks and cameras. Maybe somebody at the front desk. Nothing to memorize, right?
Then the questions show up and people miss them anyway. Why? Not because the material is hard. Because they pick the control that sounds strongest instead of the one that closes the gap in the story.
Here is the shift that fixed it for me. Every physical security question describes a way in. Find that first. The right control is whatever makes that specific method stop working.
Read the stem for the entry method
Ignore the options on your first pass. Ask one thing about the scenario: how did this person get somewhere they should not be?
Somebody walked in behind an employee. Somebody used a badge that was not theirs. A car pulled up to the lobby doors. Or someone crossed a dark stretch of the property at 2 a.m. Each of those has a control built for it, and the options will usually include three controls built for the other ones.
The pairs worth knowing cold
Tailgating or piggybacking. An employee badges in and a second person slips through behind them. A better badge reader does nothing here, because the reader already worked exactly as designed. What you want is an access control vestibule: two interlocking doors where the second stays locked until the first one closes, so people move through one at a time. Turnstiles and guards land in the same slot.
A badge that is not theirs. Cloned, or just lifted off somebody's desk. That badge proved possession and nothing else, so you add a second factor at the door. A PIN, or a fingerprint. Maybe a guard who checks your face against the photo on the card. Same multifactor logic as a login, just standing in a hallway.
A vehicle at the entrance. Bollards. Short posts that stop a car and let people walk right past. If a stem mentions a truck or a vehicle anywhere near a building entrance, bollards is sitting in the options waiting for you.
Getting onto the property at all. Fencing. It rarely stops someone determined, though, and it was never supposed to. It funnels everyone toward the one entrance you actually watch.
Movement where nobody belongs. Now you are into sensors, and this is where the exam gets picky.
Sorting the four sensors
CompTIA lists infrared, pressure, microwave, and ultrasonic. All four detect motion. What separates them is the physical property each one measures, and the scenario always leaks it.
- Infrared reads heat. A warm body gives itself away in a completely dark room.
- Pressure reads weight. Force on a floor mat or a plate. Somebody stepped somewhere.
- Microwave reads movement across a space and covers a lot more ground than infrared. Think warehouses and big open floors.
- Ultrasonic sends out sound and listens to what comes back. Motion changes the reflection.
Heat. Weight. Movement across a wide space. Sound. Match the word in the scenario to the property, and the sensor picks itself.
The trap that costs people points
Half of these controls prevent something. The other half only tell you what already happened.
Video surveillance stops nobody. Badge logs stop nobody. Both are excellent at answering who came through this door at 11:40 and how long they stayed inside. When a question asks which control would have prevented the incident, then, cameras are bait. When a question asks how to determine who entered, cameras and badge logs are your answer and the vestibule is bait.
Read the verb in the last line of the stem. Prevent? Detect? Identify? Those three point at different halves of the list.
Security guards get treated as the universal right answer for a similar reason. A guard can do nearly anything a control does and adapt on the spot. When a stem mentions a tight budget, though, or a remote site with nobody stationed there, the human option is the one they want you to rule out.
Drilling it
I went back through this material while rewriting the lessons on SecPlus Mastery, and the drill that actually worked was writing the scenario backwards. Take one control. Write the break-in it exists to stop as a single sentence, told like a story. A contractor follows a badged employee through the side door. Then say the control out loud.
Do twenty of those and the real questions start looking obvious, because by then you have already seen the story once.
If you want a cold read on where you stand across all five domains before sinking a week into any one of them, the free diagnostic at secplusmastery.com/diagnostic will tell you fast.
Physical security is worth an hour of your time. It is one of the few spots on this exam where the answer sits in plain language inside the scenario, as long as you read for how they got in.
Top comments (0)