CISSP - Identity and Access Management (IAM) (13% of the exam) - Section 5.1

Control physical and logical access to assets including information, systems, devices, facilities, and applications.

Describe physical access control mechanisms for facilities and devices alongside logical access controls for information systems and applications, explaining how they together protect assets. Recognise gaps where physical and logical controls are misaligned and identify the correct control to close each gap.

physical access controllogical access controlasset protectionaccess to facilities

Practice question for this objective

Free sampleIdentity and Access Management (IAM)easy

While reviewing access mechanisms for a new application, an analyst is asked to identify which item is a logical access control rather than a physical one. Which option fits that description?

AAn access control list on a file share that permits read access to one group and denies access to all others. Correct
BA turnstile at the building entrance that releases only when a valid employee badge is presented to a reader.
CA guard who inspects identification at the loading dock before allowing vehicles or contractors to enter the site.
DA reinforced cage around a wiring closet that limits who can reach the cabling and network distribution panels.

Identify access control lists as logical access controls that mediate access within information systems. Logical access controls operate inside information systems and enforce authorisation against authenticated subjects. An access control list compares the subject's identity or group membership to permissions on an object such as a file or share and grants or denies access accordingly. Physical access controls, by contrast, act on people and objects in physical space, regardless of whether they are activated by an electronic credential.

Why A is correct: An access control list is enforced by the operating system or application against authenticated subjects. It mediates logical access to information assets and is the canonical example of a logical access control.

Why B is wrong: A turnstile is a tangible barrier that constrains physical passage into a facility. Even though it is triggered by a badge reader, the control itself acts on a person's movement and is therefore physical.

Why C is wrong: A guard performing identity checks at a loading dock is enforcing physical access to a facility. The control is human and physical, not a software-enforced restriction on information assets.

Why D is wrong: A locked cage restricts physical contact with equipment and cabling. It is a physical access control protecting the device layer, not a logical mechanism inside an information system.

See more CISSP practice questions, answers explained.

Exam traps in Identity and Access Management (IAM)

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

Physical controls protect the perimeter of a site, while logical controls protect only the internal network segments behind that perimeter.
Why it is wrong: This conflates network segmentation with the broader logical access category. Logical controls cover applications, databases, files, and endpoints, not just internal network zones, so the definition is too narrow.
Combining the asset types means a single control framework can be applied uniformly across every asset without further tailoring to each category.
Why it is wrong: Asset types still demand tailored controls. The integrated view aids planning, but it does not mean one uniform control set fits every category without adjustment, so this overstates the consequence.
Allow the existing facilities team to retain master keys for the room because they already hold keys to every other room in the building.
Why it is wrong: Continuing the building-wide master key model is convenient for facilities staff, but it grants entry to people whose duties do not require access to design servers, breaching least privilege for an asset whose sensitivity has just risen sharply.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.