ISC2 CC Access Controls Concepts Practice Question
A security architect is designing controls to protect a data center. Which TWO of the following are examples of physical access controls? (Select TWO.)
⚠ Common exam trap
The trap is conflating logical access controls (RBAC, password policy, session timeout) with physical ones; candidates often select RBAC because it contains the word 'access,' but the question specifically asks for physical controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Biometric reader on server room door
Option A (biometric reader on server room door) is correct because a biometric reader is a physical authentication mechanism that verifies a person's fingerprint, iris, or other biological trait before granting entry to the server room, making it a classic physical access control. Option B (cable locks on laptops) is correct because a cable lock is a physical restraint that tethers a laptop to a fixed object, deterring theft and unauthorized physical removal of the device. Option C (session timeout settings) is incorrect because it is a logical/technical control that terminates idle sessions, not a physical barrier. Option D (password complexity policy) is incorrect because it is an administrative/logical control governing credential strength. Option E (role-based access control) is incorrect because RBAC is a logical access control model that grants permissions based on job roles, not physical access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Biometric reader on server room door
Why this is correct
A biometric reader authenticates identity through fingerprint or iris traits before granting entry, directly controlling who physically passes through the server room door. It is a preventive physical control restricting human access to the facility.
- ✓
Cable locks on laptops
Why this is correct
Cable locks physically tether laptops to fixed furniture, preventing removal of the device from the premises. This restricts physical possession of hardware, satisfying the requirement for a physical access control rather than a logical or administrative one.
- ✗
Session timeout settings
Why it's wrong here
Session timeout settings are a logical access control, terminating idle authenticated sessions in software; they do not restrict who physically enters the data centre. They are tempting because timeouts limit exposure, but they would be correct only for a logical control question, not physical entry.
- ✗
Password complexity policy
Why it's wrong here
Password complexity policy governs logical authentication credentials in software, not physical entry to the facility. It is tempting because weak passwords are a genuine security weakness, but complexity rules would be the correct answer only when the question asks about logical access controls rather than physical ones.
- ✗
Role-based access control (RBAC)
Why it's wrong here
Role-based access control assigns permissions to job roles within systems, a logical control; it does not govern doors, locks or badges. RBAC is tempting because it restricts access, but it would be correct only for a logical access control scenario, not a physical one.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Authentication and Authorization Methods
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.