CISA Protection of Information Assets Practice Question
An IS auditor is reviewing the physical security controls at a data center. The auditor observes that entry to the data center requires a smart card and a PIN, and that the door is a single-leaf door with a standard lock. Which of the following is the MOST important physical security control that the auditor should recommend?
⚠ Common exam trap
The trap here is focusing on strengthening authentication methods when the real vulnerability is the lack of anti-tailgating controls, which authentication alone cannot address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a mantrap or double-door entry system to prevent tailgating.
The most important physical security control to recommend is a mantrap or double-door entry system to prevent tailgating. While the data center uses smart card and PIN for authentication, a single door allows multiple people to enter on one authentication. A mantrap ensures that each person is individually authenticated and prevents unauthorized individuals from following authorized personnel. This is a fundamental control for high-security areas like data centers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Require employees to sign a logbook upon entry and exit.
Why it's wrong here
A logbook is a manual detective control that can be bypassed or falsified. It does not prevent tailgating or unauthorized entry. In a high-security data center, automated access controls are preferred. The logbook may provide an audit trail, but it is not a strong preventive measure. The most critical recommendation should address the physical prevention of unauthorized access, which is tailgating.
- ✓
Implement a mantrap or double-door entry system to prevent tailgating.
Why this is correct
A mantrap, or access control vestibule, uses two interlocking doors to ensure that only one person can enter at a time, effectively preventing tailgating. Tailgating is a common physical security breach where an unauthorized person follows an authorized person through a secure door. Given that the data center uses smart cards and PINs, the next logical enhancement is to control physical passage to prevent unauthorized entry via tailgating, which is a critical control for high-security areas.
- ✗
Replace the standard lock with a biometric lock for all employees.
Why it's wrong here
Biometric locks can enhance authentication, but the scenario already includes smart card and PIN, which is multi-factor authentication. The primary risk observed is not weak authentication but the potential for tailgating through a single door. Biometrics would not prevent tailgating if the door is held open. Therefore, while biometrics can be beneficial, they do not address the most significant physical security gap identified in the scenario.
- ✗
Install security cameras inside the data center to monitor activity.
Why it's wrong here
Security cameras are a detective control, not a preventive one. They can record unauthorized access but do not stop it. While cameras are valuable for investigations and deterrence, the most important recommendation should be a preventive control that stops unauthorized entry. The scenario already implies that entry is controlled by smart card and PIN, so the missing preventive control is against tailgating, not monitoring.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.