A facilities team is documenting the difference between physical and logical access controls before drafting a new asset protection policy. Which statement best characterises the distinction a CISSP candidate should rely on?
- APhysical controls protect the perimeter of a site, while logical controls protect only the internal network segments behind that perimeter.
- BPhysical controls are preventive in nature, while logical controls are detective in nature and used mainly to support investigations.
- CPhysical controls govern tangible barriers and environmental measures, while logical controls govern software-enforced restrictions on data, systems, and accounts. Correct
- DPhysical controls are mandatory for regulatory compliance, while logical controls are discretionary measures chosen by data owners.
Why A is wrong: This conflates network segmentation with the broader logical access category. Logical controls cover applications, databases, files, and endpoints, not just internal network zones, so the definition is too narrow.
Why B is wrong: Both categories include preventive, detective, deterrent, and corrective examples. Treating physical as purely preventive and logical as purely detective misrepresents how control functions are classified.
Why C is correct: This captures the canonical CISSP distinction: physical controls (fences, guards, mantraps, locks) protect tangible assets and the environment, while logical controls (permissions, ACLs, MFA, encryption) enforce access in software.
Why D is wrong: Regulatory regimes mandate both categories where appropriate, and discretionary access control is a specific logical model, not a description of the whole category, so this framing is incorrect.