220-1102 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Traditional key lock

  Why it's wrong here

  Mechanical key locks rely solely on a possession factor: anyone holding the physical key—or a copy made from it—receives exactly the same access as an authorized person. They are susceptible to lockpicking, bumping, and impressioning, and provide no audit trail or individual accountability when a key is shared among staff. Furthermore, a lost or stolen key forces rekeying or lock replacement to restore security, an operational burden that a biometric system avoids entirely.

• ✓

  Biometric fingerprint scanner

  Why this is correct

  Biometric fingerprint scanners authenticate based on unique physiological characteristics, which cannot be easily shared, lost, or forgotten, and are extremely difficult to replicate without the physical presence of the authorized individual. Modern scanners use capacitive or optical sensing with liveness detection to reject spoofed fingerprints, and they can integrate with an access-control log to record exactly who entered the server room. While not infallible, biometrics offer a far higher level of assurance for a secured server than mechanical keys, shared codes, or passive cameras alone.

• ✗

  Keypad door lock (cipher lock)

  Why it's wrong here

  Keypad or cipher locks depend on a shared knowledge factor, so a code can be silently observed via shoulder surfing, captured by a hidden camera, or deliberately disclosed to an unauthorized person. Because every authorized user enters the same code, the system cannot distinguish which individual entered, making accountability nearly impossible. Additionally, codes are vulnerable to brute-force guessing if no lockout or alerting policy is enforced, and they must be changed regularly to retain any meaningful security.

• ✗

  Security surveillance camera

  Why it's wrong here

  A security camera is a detective, not a preventive, control: it documents an intrusion after the fact but provides no physical barrier or credential verification at the door. An unauthorized person can simply walk past a camera and into the server room if the door is unlocked, forced, or the lock is bypassed; the footage may identify the intruder later but does not stop the initial breach. To truly control access, the door must be secured with an authentication mechanism, with video surveillance serving only as a complementary monitoring layer.

Go deeper

Related to this question