Which of the following is NOT an example of a physical security control?

Physical security controls are tangible measures implemented to protect facilities, equipment, and other physical assets from unauthorized access, damage, or interference. Remote electronic locks, biometric scanners, and security cameras are all examples of physical devices or systems used to control, restrict, or monitor physical access to a location.

In contrast, Zero Trust is a strategic security model and architecture, not a physical control. It operates on the principle of "never trust, always verify," requiring strict identity verification for every person and device trying to access resources on a network, regardless of their location. It is a set of logical and administrative principles for network security.

A. Remote control electronic locks are tangible devices that physically secure entry points, making them a physical access control.

B. Biometric access controls are physical systems that use unique biological traits to authenticate and grant physical entry.

D. Security cameras are physical devices used for surveillance, which is a detective and deterrent physical security control.

1. National Institute of Standards and Technology (NIST). (2020). Security and Privacy Controls for Information Systems and Organizations (NIST Special Publication 800-53

Rev. 5). U.S. Department of Commerce. In Appendix F

the "Physical and Environmental Protection (PE)" control family explicitly includes controls for physical access like PE-3 Physical Access Control (which covers locks and biometric systems) and PE-6 Monitoring Physical Access (which covers surveillance cameras).

2. Rose

S.

Borchert

O.

Mitchell

S.

& Connelly

S. (2020). Zero Trust Architecture (NIST Special Publication 800-207). U.S. Department of Commerce. Section 1.2

"What is Zero Trust

" defines it as "a set of concepts and ideas designed to minimize uncertainty in enforcing accurate

least privilege per-request access decisions...". This establishes it as a conceptual model

not a physical control.

3. University of California

Berkeley

Information Security Office. (n.d.). Glossary. Retrieved from security.berkeley.edu. The glossary distinguishes between control types

defining Physical Controls as mechanisms to "protect the organization's people

physical assets

and workplace

" citing locks and cameras as examples

separate from Technical (Logical) Controls like Zero Trust principles.