(A) Incorrect — EK 2.3.A.1 training tells employees not to badge others in, which addresses piggybacking, where the employee knowingly grants access. This entry was tailgating: no awareness, so there was no decision for training to change.

(B) Incorrect — EK 2.3.B.4 card readers deny unlisted badges and record use, but the door was already open on a valid badge. This control would document the technician’s entry and detect nothing about the second person.

(D) Incorrect — EK 2.3.B.3 a cabinet lock protects the server if someone reaches it, but it does nothing about who gets into the wing.

(A) Incorrect — I is correct but incomplete. An adversary who never touches a USB port can still sit down at an unlocked, logged-in session, which is what II prevents.

(C) Incorrect — II is correct but III is not. Under EK 2.3.B.2, bollards deter a vehicle or a person from approaching the building; the reception area is already open to visitors by design.

(D) Incorrect — including III treats every physical control as relevant to every risk. Bollards would not change anything about a networked PC with open ports inside the lobby.

(A) Incorrect — EK 2.3.B.7 a UPS provides backup power for a device during an outage, which is exactly the panel-trip problem in the stem.

(B) Incorrect — EK 2.3.B.7 generators supply power at building scale to a set of critical devices, covering an outage longer than a UPS can bridge.

(D) Incorrect — moving the racks above the flood line removes the equipment from the hazard, which protects availability even though no power control is involved.

(B) Incorrect — nothing in EK 2.3 makes perimeter controls a prerequisite for interior controls. A defense-in-depth strategy layers controls; it does not require them in an outside-in order.

(C) Incorrect — row 1 is the strongest row in the plan. EK 2.3.B.3 locks on server cabinets prevent devices from being accessed or stolen, and a high-severity risk closed at low cost is exactly what EK 2.3.B.8 puts first.

(D) Incorrect — the plan lists row 2 at moderate cost, not the highest cost, so the reason given is false. Cost alone would not settle the ranking anyway.

(A) Incorrect — a corrective control restores a system to an operational state. A log tells you a lens left the vault; it does not bring the lens back.

(B) Incorrect — no single control removes the need for the others. Under EK 2.1.G a layered defense uses several control types precisely so one failure does not open the asset.

(C) Incorrect — the reason is false for this room. Finished lenses are the site’s highest-value inventory, so EK 2.2.C.4 low-risk reasoning does not apply, and detection alone leaves the entry open.