CISA Protection of Information Assets Practice Question
An IS auditor is reviewing the physical access controls at a data center. Which TWO of the following are the MOST effective controls to prevent unauthorized tailgating?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Mantrap with interlocking doors.
Option C, a mantrap with interlocking doors, is correct because it creates a controlled vestibule where the first door must close and the person must be authenticated before the second door opens, physically preventing a second individual from following through. Option D, turnstiles that allow only one person per authentication, is correct because the physical barrier permits exactly one authenticated entry at a time, so a tailgater cannot pass without their own valid credential. Option A, CCTV cameras, is only a detective control that records events after the fact and does not stop tailgating. Option B, security guards checking badges, is a deterrent and detective measure but is subject to human error, distraction, and social-engineering bypass. Option E, biometric authentication, verifies the identity of the person authenticating but does not by itself prevent a second person from walking through the opened door behind them.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
CCTV cameras at entry points.
Why it's wrong here
CCTV records entry-point activity but cannot physically stop a second person slipping through behind an authenticated badge holder; it only supplies after-the-fact evidence. It is tempting because surveillance deters and supports investigations, and would be the right choice where the requirement is monitoring or forensic reconstruction rather than active prevention.
- ✗
Security guards checking badges.
Why it's wrong here
A guard checking badges verifies each person individually, but tailgating prevention requires one-person-per-authentication enforcement, such as a mantrap or turnstile; a guard can be distracted or bypassed during busy periods. Guards are the correct control where the requirement is visitor screening, identity verification or response to alarms.
- ✓
Mantrap with interlocking doors.
Why this is correct
A mantrap with interlocking doors physically admits one person per cycle, so a second individual cannot follow through before the first door closes. This directly satisfies the stem's requirement to prevent unauthorised tailgating, unlike detective controls such as CCTV, which record the breach only after entry has occurred.
- ✓
Turnstiles that allow only one person per authentication.
Why this is correct
Turnstiles enforcing single-person authentication physically prevent tailgating by requiring each individual to authenticate separately before entry, directly satisfying the stem's requirement to stop unauthorised entry. Unlike cameras or guards, which detect or deter after the fact, this mechanism enforces one-to-one credential-to-person matching at the entry point.
- ✗
Biometric authentication.
Why it's wrong here
Biometric authentication verifies the identity of a single person at a reader; it does not detect or block a second individual entering behind an authenticated user. It is tempting because it is a strong authentication factor, and it would be correct for controlling who may pass a door, but tailgating prevention requires entry-detection controls such as turnstiles or mantraps.
Go deeper
Related to this question
About these practice questions
This CISA question is part of Courseiva's 934-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.