CISSP - Identity and Access Management (IAM) - Section 5.1

Control physical and logical access to assets including information, systems, devices, facilities, and applications.

Describe physical access control mechanisms for facilities and devices alongside logical access controls for information systems and applications, explaining how they together protect assets. Recognise gaps where physical and logical controls are misaligned and identify the correct control to close each gap.

physical access controllogical access controlasset protectionaccess to facilities

Practice question for this objective

Free sampleIdentity and Access Management (IAM)easy

While reviewing access mechanisms for a new application, an analyst is asked to identify which item is a logical access control rather than a physical one. Which option fits that description?

  • AAn access control list on a file share that permits read access to one group and denies access to all others. Correct
  • BA turnstile at the building entrance that releases only when a valid employee badge is presented to a reader.
  • CA guard who inspects identification at the loading dock before allowing vehicles or contractors to enter the site.
  • DA reinforced cage around a wiring closet that limits who can reach the cabling and network distribution panels.
Identify access control lists as logical access controls that mediate access within information systems. Logical access controls operate inside information systems and enforce authorisation against authenticated subjects. An access control list compares the subject's identity or group membership to permissions on an object such as a file or share and grants or denies access accordingly. Physical access controls, by contrast, act on people and objects in physical space, regardless of whether they are activated by an electronic credential.

Why A is correct: An access control list is enforced by the operating system or application against authenticated subjects. It mediates logical access to information assets and is the canonical example of a logical access control.

Why B is wrong: A turnstile is a tangible barrier that constrains physical passage into a facility. Even though it is triggered by a badge reader, the control itself acts on a person's movement and is therefore physical.

Why C is wrong: A guard performing identity checks at a loading dock is enforcing physical access to a facility. The control is human and physical, not a software-enforced restriction on information assets.

Why D is wrong: A locked cage restricts physical contact with equipment and cabling. It is a physical access control protecting the device layer, not a logical mechanism inside an information system.

See more CISSP practice questions, answers explained.

More in this domain

Back to all Identity and Access Management (IAM) objectives, or the CISSP cert hub.

Examworthy is not affiliated with or endorsed by (ISC)2. Original, blueprint-aligned practice material only.