AP Cybersecurity Unit 2 Lesson 3 Quiz

Unit 2 • 2.3 • Quiz

Home›AP Cybersecurity›Unit 2 › 2.3 › Quiz

Lesson 2.3 Quiz: Physical Security

5 questions — Demonstrate your understanding of physical security controls

Score: 0 / 0 Answer each question, then check your score below

Scenario Organization

Catalyst Biotech Labs

Catalyst Biotech Labs stores proprietary gene therapy research in a secured facility. Physical security is critical because research samples, server hardware, and intellectual property documents are all physically present on-site. Five physical security scenarios require your evaluation.

Q1 Access Layers

Catalyst’s research lab requires three sequential access controls to enter: (1) badge swipe at the building entrance, (2) biometric fingerprint scan at the lab wing door, (3) PIN code at the individual lab room. This design is called:

(A) Single-factor authentication repeated three times at different locations (B) Multi-layer physical access control using different credential types at progressive checkpoints (C) Redundant access control that wastes employee time without adding security value (D) Biometric-only access control because the fingerprint scan is the only truly secure layer

Three different credential types (something you have — badge, something you are — fingerprint, something you know — PIN) at progressive checkpoints create multi-layer physical access control. Each layer uses a different factor, so compromising one does not grant access through the others.

(A) Incorrect — three different credential types (badge, biometric, PIN) represent different authentication factors, not one factor repeated.

(C) Incorrect — each layer adds security by requiring a different type of credential; this is defense-in-depth for physical access.

(D) Incorrect — all three layers contribute to security; the biometric scan is not the only effective one.

Exam Tip: Physical multi-factor: something you HAVE (badge/key), something you ARE (biometric), something you KNOW (PIN/code). Using all three at progressive checkpoints is the gold standard.

Q2 Mantrap

Catalyst installs a mantrap (airlock-style double door) at the entrance to the server room. Only one door can be open at a time, and each door requires a separate badge scan. This prevents:

(A) Network-based attacks from reaching the servers inside the room (B) Tailgating — because only one person can pass through the space between the two doors at a time, and both badge scans must belong to the same authorized individual (C) Fire damage — the mantrap acts as a firebreak between the server room and the rest of the building (D) Power surges — the mantrap filters electrical current entering the server room

Mantraps are specifically designed to prevent tailgating. The enclosed space between two interlocked doors ensures that each person must individually authenticate. If two people enter the space, the system can lock both doors and alert security.

(A) Incorrect — mantraps are physical access controls; they do not affect network traffic.

(C) Incorrect — mantraps are access controls, not fire suppression or containment systems.

(D) Incorrect — mantraps control physical entry; they have no electrical filtering function.

Exam Tip: Mantrap = anti-tailgating. The key feature is that only ONE person can pass through at a time, and both doors cannot be open simultaneously.

Q3 Environmental

A HVAC failure causes the Catalyst server room temperature to rise from 68°F to 105°F over 4 hours. No temperature alarm was configured. By the time an employee notices, two servers have shut down due to thermal protection. This is a failure of:

(A) Network security — the servers should have been protected by a firewall that blocks thermal attacks (B) Environmental monitoring — automated temperature sensors with alerting thresholds should have notified staff before the temperature reached critical levels (C) Encryption — the servers should have encrypted their thermal data to prevent temperature manipulation (D) Access control — unauthorized individuals must have tampered with the HVAC system

Environmental monitoring (temperature, humidity, water detection) is a physical security control for server rooms. Automated sensors with alert thresholds at warning (e.g., 80°F) and critical (e.g., 90°F) levels would have triggered notifications hours before servers reached thermal shutdown.

(A) Incorrect — temperature is a physical/environmental threat, not a network security concern.

(C) Incorrect — encryption protects data confidentiality; it has no relevance to physical temperature.

(D) Incorrect — the scenario describes an HVAC failure, not deliberate tampering.

Exam Tip: Server room environmental controls: temperature (68-72°F optimal), humidity (40-60%), water detection (leak sensors), fire suppression (clean agent, not water sprinklers).

Q4 Disposal

A Catalyst intern is instructed to dispose of old hard drives from decommissioned lab workstations. The intern places the drives in the regular office recycling bin. These drives contain 3 years of research data. Which disposal method should have been used?

(A) Reformatting the drives before recycling, which permanently erases all data (B) Physical destruction (degaussing, shredding, or drilling) to ensure data cannot be recovered from the media under any circumstances (C) Encrypting the drives with a strong password before placing them in recycling (D) Removing the drive labels so the recycler cannot identify which organization the data belongs to

Physical destruction is the only method that guarantees data cannot be recovered. Reformatting can be reversed with forensic tools. Encryption could be broken if the key is weak or eventually compromised. Removing labels does not protect the data itself. For $400M research data, physical destruction is the only acceptable method.

(A) Incorrect — reformatting does not erase data; forensic recovery tools can restore reformatted drives.

(C) Incorrect — encryption depends on key strength and may be breakable; physical destruction is definitive.

(D) Incorrect — removing labels does not protect the data on the drive in any way.

Exam Tip: Data destruction hierarchy: physical destruction (most secure) > cryptographic erasure > DoD-standard multi-pass overwrite > single-pass overwrite > formatting (least secure, NOT sufficient for sensitive data).

Q5 Convergence

Which of the following BEST illustrates why physical security and cybersecurity must be managed as integrated disciplines rather than separately?

(A) A fire in the server room destroys hardware, causing data loss — a physical event with cyber consequences (B) A phishing email tricks an employee into revealing their building badge number, which the attacker uses to enter the facility and plant a network implant — a cyber attack enabling physical access enabling further cyber access (C) An employee loses their laptop at a coffee shop, exposing unencrypted client data — a physical loss with cyber consequences (D) All of the above demonstrate physical-cyber convergence, where threats cross between physical and digital domains

All three scenarios demonstrate convergence: physical → cyber (fire causing data loss), cyber → physical → cyber (phishing enabling building entry enabling network implant), and physical → cyber (lost laptop exposing data). Threats routinely cross between domains, requiring integrated security management.

(A) Valid example but incomplete — B and C also demonstrate convergence.

(B) Valid example but incomplete — A and C also demonstrate convergence.

(C) Valid example but incomplete — A and B also demonstrate convergence.

Exam Tip: Physical-cyber convergence: threats do not respect the boundary between physical and digital. An organization that manages physical and cyber security separately will have gaps at every intersection point.

Questions Correct

Course Hub → Course Hub

← Lab 2.3 Course Hub →

AP Cybersecurity Unit 2 • 2.3 • Quiz | APCSExamPrep.com | Built by Tanner Crow, AP CS Teacher (11+ years)
AP® is a registered trademark of the College Board, which was not involved in the production of this content.

AP Cybersecurity · Unit 2 · Lesson 2.3 · Quiz

Lesson•Exercise 1•Exercise 2•Lab•Quiz•Next: 2.4 Detecting Physical Attacks →

Back to:Lesson 2.3 Unit 2 Study Guide Course Guide

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Just want free AP CS resources?

Enter your email below and check the subscribe box — no message needed. Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

Send me free AP CS exam tips — daily practice questions, study resources, and exam strategies. + 20% OFF TUTORING
Unsubscribe anytime.

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]