Which of the following questions is less likely to help in assessing physical access controls?

Which of the following questions is less likely to help in assessing physical access controls?
A .  Does management regularly review the list of persons with physical access to sensitive facilities?
B .  Is the operating system configured to prevent circumvention of the security software and application controls?
C .  Are keys or other access devices needed to enter the computer room and media library?
D .  Are visitors to sensitive areas signed in and escorted?

View Answer

Answer: B

Explanation: Physical security and environmental security are part of operational controls, and are measures taken to protect systems, buildings, and related supporting infrastructures against threats associated with their physical environment. All the questions above are useful in assessing physical access controls except for the one regarding operating system configuration, which is a logical access control. Source: SWANSON, Marianne, NIST Special Publication 800-26, Security Self-Assessment Guide for Information Technology Systems, November 2001 (Pages A-21 to A-24).