nerdexam
(ISC)2

CISSP-ISSAP · Question #53

You are implementing some security services in an organization, such as smart cards, biometrics, access control lists, firewalls, intrusion detection systems, and clipping levels. Which of the…

The correct answer is B. Logical access control. Logical access control encompasses technology-based mechanisms that control access to systems, data, and resources through software and hardware - this includes smart cards, biometrics, ACLs, firewalls, IDS, and clipping levels, all of which operate through automated, technical…

Identity and Access Management (IAM) Architecture

Question

You are implementing some security services in an organization, such as smart cards, biometrics, access control lists, firewalls, intrusion detection systems, and clipping levels. Which of the following categories of implementation of the access control includes all these security services?

Options

  • AAdministrative access control
  • BLogical access control
  • CPhysical access control
  • DPreventive access control

How the community answered

(27 responses)
  • A
    11% (3)
  • B
    78% (21)
  • C
    7% (2)
  • D
    4% (1)

Explanation

Logical access control encompasses technology-based mechanisms that control access to systems, data, and resources through software and hardware - this includes smart cards, biometrics, ACLs, firewalls, IDS, and clipping levels, all of which operate through automated, technical enforcement rather than human policy or physical barriers.

Why the distractors are wrong:

  • A (Administrative): Administrative controls are policy- and procedure-based - things like security policies, background checks, and training. They govern how people should behave, not technical enforcement.
  • C (Physical): Physical controls protect tangible assets through barriers - locks, guards, fences, and cameras. While smart cards can have a physical component, the listed items collectively describe logical enforcement mechanisms.
  • D (Preventive): Preventive is a functional category (describing what a control does), not an implementation category. The question specifically asks about implementation type, and logical/physical/administrative are the three implementation categories.

Memory tip: Think Logical = Layer of technology - if it runs on software, hardware, or digital credentials, it's logical. Administrative = paperwork/people, Physical = you can touch the barrier. The question lists items that all operate through technical systems, so Logical is your anchor.

Topics

#Logical access control#Authentication mechanisms#System access controls#Control classification

Community Discussion

No community discussion yet for this question.

Full CISSP-ISSAP Practice