Vestibule = Prevent — EK 2.3.B.5, it stops an authorized person admitting an unauthorized one, so the unauthorized entry never occurs. Card-reader log review = Detect — EK 2.3.B.4, the reader already denied unknown badges, but the review is what surfaces a badge that opened the vault at 2 a.m. after the fact. UPS = Correct — EK 2.3.B.7, it cannot stop the outage and it does not tell you one happened; it limits the damage by keeping the bay available while power is gone.

(1) piggybacking — consent is the discriminator. Tailgating is following someone through without their awareness; here the optician knew and badged him anyway. (2) clean desk policy — EK 2.3.A.2, one of the standard workstation-policy requirements. (3) privacy screen filter — also EK 2.3.A.2, a physical barrier against shoulder surfing. (4) deter — EK 2.3.B.2 says fencing, gates and bollards deter adversaries from attempting physical access; they do not stop a determined one. (5) generator — EK 2.3.B.7 draws the line at scope: UPS = one device, short outage; generator = a building or a set of critical devices, long outage.

Belong: the card reader (EK 2.3.B.4 — denies and records), the vestibule (B.5 — one badge, one person), the cabinet locks (B.3 — a second layer inside the room), and disabling USB ports (B.6 — stops an external drive loading malware onto the inventory machine). Do not belong: the flood work on the optics bay is a correct recommendation that Xtensr will fund — but for a different finding. It does nothing for the vault, and putting it in this section is how a report loses the reader. The shared door code is worse than what Delmar has now: it gives twelve people one credential, so the vault has no record of who entered and nothing to revoke when one of them leaves.

C is correct. Work out the consequence first: an adversary at an open badge controller does not just walk somewhere — they can add a credential and then have legitimate access to every door the system governs, including the vault. A camera records that visit and nothing more, and you read the recording after the credential already exists. EK 2.3.B.3 is the fit: a lock or enclosure so the controller cannot be reached at all, with the camera kept as the detective layer on top. (A) mistakes a busy lobby for a monitored one — traffic is not supervision, and the cabinet stayed open through an entire walkthrough. (B) raises a real camera-placement consideration (EK 2.3.B/2.4.B weigh coverage, angle and tamper resistance) but it argues the camera is badly implemented; the note’s defect is that a camera is the wrong function here, and a perfectly lit camera would still be wrong. (D) has the categories backwards — a camera is a physical control, not a managerial one, and managerial controls are the policies and training of EK 2.3.A.

B is correct — this is a defense-in-depth failure, not a locked-door failure. The gate and the desk are real controls, but they are the only controls, and they both sit at the perimeter; anyone already inside for any legitimate reason has an unrestricted path to the company’s crown jewels. Model recommendation: Prevent — relocate the server into a lockable rack cabinet and fit the closet door with a lock, so reaching the corridor is not the same as reaching the server. Detect — fit a card reader so every opening produces an entry log tied to one badge, and add a tamper switch on the cabinet that alarms if it is opened. Correct — keep a current off-site backup of the design data so a stolen or destroyed server does not end the product line. (A) is too strong: a gate and a staffed desk are controls, they are just not enough. (C) is the category error — a technical asset in a physical room needs both. (D) is the excuse to refuse: a control that depends on nobody being careless is not a control, and the closet has no lock to leave open in the first place.

Model: Badge controller cabinet — a locked enclosure around the controller with a tamper switch wired to the alarm (EK 2.3.B.3): the enclosure prevents an adversary reaching the controller and the tamper switch detects an attempt. Without it, someone in the lobby can issue themselves a credential, and every door in the building — including the vault — opens for them legitimately from then on. Testing-bay power panel — an uninterruptible power supply on the panel, with a building generator if Delmar can fund it later (B.7): both are correct controls, because they cannot stop an outage but they hold the bay up through one. Without it a power disruption costs availability — a multi-day calibration run is lost and has to be restarted. Add a surge protector so the returning power does not destroy the instruments. Optics bay — flood barriers at the doors and racking the equipment above grade: correct again, since neither stops the water, they limit what it reaches. Without it Delmar loses the resources themselves — destroyed optics and the space out of service while it dries.