nerdexam
(ISC)2

CISSP · Question #744

What would be the PRIMARY concern when designing and coordinating a security assessment for an Automatic Teller Machine (ATM) system?

The correct answer is A. Physical access to the electronic hardware. When assessing ATM security, physical access to the electronic hardware is the primary concern because ATMs are high-value targets where physical tampering (e.g., skimming, card trapping, jackpotting) can directly compromise financial data and cash dispensing mechanisms.

Submitted by yuriko_h· Mar 5, 2026Asset Security

Question

What would be the PRIMARY concern when designing and coordinating a security assessment for an Automatic Teller Machine (ATM) system?

Options

  • APhysical access to the electronic hardware
  • BRegularly scheduled maintenance process
  • CAvailability of the network connection
  • DProcessing delays

How the community answered

(36 responses)
  • A
    72% (26)
  • B
    6% (2)
  • C
    17% (6)
  • D
    6% (2)

Why each option

When assessing ATM security, physical access to the electronic hardware is the primary concern because ATMs are high-value targets where physical tampering (e.g., skimming, card trapping, jackpotting) can directly compromise financial data and cash dispensing mechanisms.

APhysical access to the electronic hardwareCorrect

ATMs contain sensitive hardware components including card readers, PIN pads, and cash dispensers that are vulnerable to physical attacks such as skimming device installation, card trapping, and direct hardware manipulation (jackpotting). A security assessment must prioritize physical access controls-locks, enclosures, tamper-evident seals, and surveillance-because physical compromise can bypass all logical security controls and directly result in financial fraud or theft.

BRegularly scheduled maintenance process

While maintenance scheduling is an operational consideration, it is not a primary security concern during a security assessment, as it does not directly address vulnerabilities that adversaries would exploit to compromise the ATM.

CAvailability of the network connection

Network connectivity availability is an operational/availability concern; although network security is relevant, the primary security assessment focus for ATMs centers on physical tamper risks rather than network uptime.

DProcessing delays

Processing delays relate to performance and availability, not to the core security vulnerabilities that a security assessment of an ATM system is designed to identify and mitigate.

Concept tested: Physical security assessment priorities for ATM systems

Source: https://www.europol.europa.eu/cms/sites/default/files/documents/atm_fraud_guide_for_industry.pdf

Topics

#Physical security#ATM security#Security assessment

Community Discussion

No community discussion yet for this question.

Full CISSP Practice