CISSP - Security Architecture and Engineering (13% of the exam) - Section 3.8

Apply security principles to site and facility design.

Apply Crime Prevention Through Environmental Design (CPTED) principles and secure architecture concepts when evaluating site and facility layouts. Recognise how lighting, natural surveillance, territorial reinforcement, and physical barriers work together to deter unauthorised access.

CPTEDsite designfacility designsecure architecture

Practice question for this objective

Free sampleSecurity Architecture and Engineeringeasy

A regional bank is selecting a new branch site that will hold a small data closet and a teller counter. The security lead wants to apply Crime Prevention Through Environmental Design (CPTED) principles from the outset. Which choice BEST reflects CPTED in the early site layout?

  • APosition the teller area and entrance so staff and passers-by have clear, unobstructed sightlines to the lobby and car park. Correct
  • BInstall a high perimeter fence with razor wire and motion-activated floodlights covering all approaches.
  • CLocate the data closet in a windowless interior room and route all visitors past it on the way to the teller.
  • DReplace the lobby furniture with bolted-down steel benches and reinforced counters as the primary control.
Recognise that CPTED emphasises natural surveillance, access control, and territorial reinforcement in early site layout decisions. CPTED reduces opportunity for crime by shaping the environment itself. Natural surveillance, achieved through deliberate sightlines so legitimate users can observe the space, deters offenders, supports staff awareness, and is applied before relying on guards, fences, or hardened fittings.

Why A is correct: Natural surveillance is a core CPTED principle. Designing sightlines so staff, customers, and the public can observe the space discourages offenders and supports informal monitoring without relying on extra technology.

Why B is wrong: Hardened perimeters can deter intrusion, but this option leans on target hardening rather than CPTED. CPTED prefers natural surveillance, access control, and territorial reinforcement before defensive walls and lighting overlays.

Why C is wrong: Hiding a sensitive room and forcing visitor traffic past it actually increases exposure and conflicts with CPTED. Sensitive spaces should sit in controlled zones away from public flow, not become incidental landmarks.

Why D is wrong: Bolted furniture is target hardening, useful for robbery resistance but not a CPTED design choice. CPTED first shapes layout, sightlines, and territory; physical hardening is layered on once the environment itself works.

See more CISSP practice questions, answers explained.

Exam traps in Security Architecture and Engineering

Answers that look right on this material and are not. Each one is a distractor from a different question in the CISSP bank for this domain.

  • Separation of duties, because a single engineer should not be permitted to change both the access configuration and the error reporting configuration of the same component.

    Why it is wrong: Separation of duties addresses collusion risk by splitting sensitive tasks between people, which is a procedural control rather than the design choice about default posture being described here.

  • Approve the proposal because clear signage helps emergency responders find the room quickly during an incident.

    Why it is wrong: Emergency response benefits from internal wayfinding for responders, but that is achieved through controlled plans shared with the fire service, not public labelling. Public signs advertise the target to anyone in the lobby.

  • Place the server room next to reception so visitors can see that security is taken seriously.

    Why it is wrong: Putting the server room on the public face of the building advertises a high-value target and shortens the path for an intruder. Visible commitment to security should come from policy and signage, not from siting sensitive infrastructure in public view.

Examworthy is not affiliated with or endorsed by ISC2. Original, blueprint-aligned practice material only.