How does entry log analysis detect piggybacking or tailgating?

CED 2.4.C.3: a sensor records how long a badge-access door remains open. Doors open for longer than normal indicate more than one person entered on a single badge swipe.

Where should motion sensors be placed according to the CED?

In areas where traffic is unexpected, like server rooms, or where sensitive materials are stored. High-traffic areas create false alarms that cause real alerts to be ignored (CED 2.4.B.2).

AP Cybersecurity 2.4: Detecting Physical Attacks

Q: What is the difference between stationary and patrolling guards per the CED?

Stationary guards are best at funnel points like entrances and lobbies. Patrolling guards are better suited for perimeters and exterior areas because they are harder for adversaries to plan around (CED 2.4.B.4).

AP Cyber HubUnit 22.1 ▼Lesson Ex 1 Ex 2 Lab Quiz2.2 ▼Lesson Ex 1 Ex 2 Lab Quiz2.3 ▼Lesson Ex 1 Ex 2 Lab Quiz2.4 ▼LessonEx 1 Ex 2 Lab Quiz

Score0 / 10

📅 Last Updated: June 2026 ⏱ ~55 min 📚 Lesson 4 of 4 — Unit 2

AP Cybersecurity — Unit 2: Securing Spaces

Topic 2.4: Detecting Physical Attacks

Cameras, security guards, motion sensors, locks, and access control vestibules — and how to place and combine them to detect physical attacks. Master the CED core detection framework, then explore real-world extensions including door-duration monitoring and integrated systems.

Lesson 4 of 4 ~55 min LO 2.4.A–2.4.C ~4 class periods Skill: Detect Attacks

College Board Essential Knowledge Coverage

Topic 2.4 — What Is Testable

▼

CED Ref	Essential Knowledge	Covered In
2.4.A.1	Cameras: capture visual record; feed recorded AND monitored for max effect; recordings help after-incident investigation	Section 2
2.4.A.2	Security guards: monitor area and respond to suspicious activity	Section 2
2.4.A.3	Motion sensors: alert security to movement in an area	Section 2
2.4.A.4	Employees: often first to notice unauthorized person; can alert security	Section 2
2.4.B.1	Camera placement: visual coverage, angle, tamper risk; points of ingress and egress often monitored	Section 3
2.4.B.2	Motion sensors: place where traffic unexpected (server rooms); high-traffic areas create false alarms reducing alert credibility	Section 3
2.4.B.3	Locks on all entries to sensitive areas; access control vestibule for particularly sensitive areas	Section 3
2.4.B.4	Stationary guards: funnel points (entry gates, lobbies); Patrolling guards: perimeters and exterior areas	Section 3
2.4.C.1	Cameras + facial recognition: alerts when unauthorized individuals enter; live/recorded footage tracks path	Section 4
2.4.C.2	Motion detectors + cameras: motion alert → camera check → verify breach before dispatching response	Section 4
2.4.C.3	Door-duration entry log: sensor records door-open time; longer-than-normal = potential piggybacking/tailgating	Section 4

AP Core (CED Required)

2.4.1 — Learning Objectives (3 min)
2.4.2 — Detection Controls Overview (2.4.A) (8 min)
2.4.3 — Placing Detection Controls (2.4.B) (10 min)
2.4.4 — Applying Detection (2.4.C) (10 min)

Real-World Extension

2.4.5 — Beyond the AP Core: Integrated Systems (8 min)
2.4.6 — Worked Scenarios (CFU 6–10) (10 min)
2.4.7 — Quick Reference & FAQ (6 min)

♡ Bellringer — 3 Questions, 5 Minutes

Students answer independently before the lesson. No notes.

A camera records but no one watches the live feed. What does the CED say both recording AND monitoring provide that recording alone cannot?
Motion sensors: (a) main lobby (300 daily visitors) or (b) server room (4 IT staff). Which reduces detection effectiveness over time, and why?
A badge log shows the same Badge ID at Building A at 9:00 AM and Building B — 25 minutes away — at 9:04 AM. The owner confirms they were at Building A all morning. What does this indicate?

Answers: (1) Recording = after-incident investigation; monitoring = real-time detection. (2) Lobby — false alarms from 300 daily users cause alert fatigue. (3) Card cloning — impossible travel.

12.4.1 — Learning Objectives

Identify cameras, security guards, motion sensors, locks, and access control vestibules as physical security detection controls (2.4.A)
Determine effective placement of cameras, motion sensors, guards, and locks for detecting physical attacks (2.4.B)
Apply detection techniques — cameras with facial recognition, motion detectors paired with cameras, and door-duration entry log analysis — to identify physical attacks (2.4.C)
Recognize that employees working in a physical space are often the first to detect unauthorized persons (2.4.A.4)
Explain why false alarms undermine detection effectiveness and how placement decisions prevent them (2.4.B.2)

22.4.2 — Detection Controls (LO 2.4.A)

★ CED Core — 2.4.A Detection Controls

The AP CED identifies four primary detection controls: (1) Cameras — capture a visual record of adversary activity; (2) Security guards — monitor and respond to suspicious activity; (3) Motion sensors — alert security to movement; (4) Employees — often the first to notice an unauthorized person and alert security.

2.4.A.1Cameras

Cameras capture a visual record of an adversary's malicious activity. The CED emphasizes two requirements: the feed should be recorded (not just live-monitored) and monitored for maximum effect. Recordings are especially helpful in after-incident investigations — they provide a timeline of events, the adversary's path, and their actions after entry.

Classification: Physical type, Detective function. Cameras are also deterrents — visible cameras signal monitoring. CED language: “capture a visual record” and “recordings can be especially helpful in after-incident investigations.”

2.4.A.2Security Guards

Security guards monitor activity in an area and respond to suspicious activity once detected. Guards provide the one capability no automated system replicates: real-time human judgment — they can assess context, ask questions, and escalate appropriately.

Classification: Physical type, Detective function (monitoring and responding). Also Preventative — visible guard presence deters attack attempts.

2.4.A.3Motion Sensors

Motion sensors alert security to movement in an area. They extend detection capability into spaces that cannot be continuously monitored by guards or camera operators, and are especially valuable in after-hours and low-traffic high-security environments.

Classification: Physical type, Detective function. Best practice (CED 2.4.C.2): Motion detectors work best when paired with cameras — when a motion alert fires, the paired camera lets defenders visually verify whether a breach is real before dispatching a response.

2.4.A.4Employees

The CED explicitly identifies employees as a detection source: “Employees that work in a physical space are often the first to notice the presence of an unauthorized person and can alert security.” This is distinct from security guards — regular employees serve as distributed detection agents who know who belongs in their area and who doesn't.

Classification: Human layer (defense-in-depth), Detective function. Enabled by security awareness training (Topic 2.3) — employees need to know what to do when they notice something suspicious.

AP Exam note: This is a frequently overlooked CED item. Employees are an official detection mechanism. The correct defense against piggybacking combines training (so employees refuse to badge others in) AND the same training enabling employees to challenge and report unknown persons.

Check for UnderstandingClassification

Q 1 of 10

According to the AP CED, which of the following is explicitly identified as a physical security detection control alongside cameras, security guards, and motion sensors?

AFirewalls — technical controls that detect unauthorized network access attempts

BAccess logs — recording every badge access event for after-incident investigation

CIntegrated security management systems — correlating signals from multiple detection sources

DEmployees — who are often the first to notice the presence of an unauthorized person and alert security

32.4.3 — Placing Detection Controls (LO 2.4.B)

Knowing which controls to use is only half the answer. The CED devotes a full learning objective to where to place each control — placement determines detection effectiveness.

Camera Placement (CED 2.4.B.1)

CED 2.4.B.1 — Camera Placement Principles When placing cameras, consideration should be given to: visual coverage, angle, and the ability to be tampered with by an adversary. Consideration should also be given to what a camera in a specific area could capture an adversary doing and how that information would be helpful. Points of ingress and egress are often monitored by camera.

Camera Location	What It Detects	CED Reasoning
Points of ingress and egress (CED term)	All persons entering and leaving; timing of entry events; after-hours access	Explicitly named by CED 2.4.B.1 as primary camera placement priority
Server rooms and restricted corridors	Proximity to high-value areas; loitering; adversary path after entry	CED: "what a camera in a specific area could capture an adversary doing"
Lobby and reception	Visitor movement; piggybacking from lobby into secured areas	High-traffic entry point where identity verification matters
Perimeter and exterior areas	Vehicle behavior; dumpster diving activity; perimeter breaches	Paired with guard coverage for perimeter (CED 2.4.B.4)

⚠ Camera Tamper Risk

The CED explicitly notes that camera placement must consider the ability to be tampered with. A camera positioned where an adversary can easily cover, reposition, or destroy it provides false security. High-security areas should use cameras mounted out of reach and at angles that are difficult to block.

Motion Sensor Placement (CED 2.4.B.2)

CED 2.4.B.2 — Motion Sensor Placement Motion sensors should be placed in areas where traffic is unexpected, like server rooms, or areas where sensitive materials are stored and few people have access. Motion sensors in high-traffic areas create many false alarms, making the alarms less likely to be taken seriously when there is a real security event.

⚠ False Alarms — The Hidden Risk

False alarms degrade detection effectiveness. When a motion sensor in a busy hallway fires 50 times per day from normal traffic, security staff begin ignoring alerts — including real ones. Placing sensors in low-traffic, high-security areas maximizes the signal-to-noise ratio. This is a directly testable CED concept (2.4.B.2).

Lock and Access Control Vestibule Placement (CED 2.4.B.3)

CED 2.4.B.3 — Lock Placement Locks should be placed on all entries to areas containing sensitive information or systems. For areas with particularly sensitive information or systems, an organization could use an access control vestibule at the entry point to prevent piggybacking or tailgating.

Guard Deployment (CED 2.4.B.4)

CED 2.4.B.4 — Stationary vs. Patrolling Guards Stationary guards provide constant protection for a specific area, entrance, or high-value item. Patrolling guards are more difficult for an adversary to plan around and can create time pressure. Stationary guards are most effective at places that funnel traffic (entry gates, main entrances, lobbies, entrances to secure areas). Patrolling guards are better suited for perimeters and exterior areas.

Factor	Stationary Guard	Patrolling Guard
CED deployment recommendation	Places that funnel traffic — entry gates, main entrances, lobbies, secure area entries	Perimeters and exterior areas
Key advantage	Constant protection at a specific high-value checkpoint	Harder for adversary to plan around; creates time pressure
Adversary response	Must pass the guard directly — high deterrence at that point	Cannot time attacks reliably — window between patrols is unpredictable

Check for UnderstandingPlacement

Q 2 of 10

The CED states that motion sensors in high-traffic areas create many false alarms, making alarms less likely to be taken seriously. What is the correct placement principle for motion sensors?

APlace motion sensors in all hallways and corridors to maximize coverage throughout the facility.

BPlace motion sensors in areas where traffic is unexpected — like server rooms — or where sensitive materials are stored and few people have access. Avoid high-traffic areas to prevent false alarms that cause real alerts to be ignored.

CPlace motion sensors only at building entrances and exits, since those are the most important detection points.

DPlace motion sensors everywhere except server rooms, since servers themselves detect unauthorized access through system logs.

Check for UnderstandingGuard Deployment

Q 3 of 10

According to the CED (2.4.B.4), which deployment is best suited for security guards at a large campus with a main entrance lobby and a large exterior perimeter?

AAll guards stationary — maximum deterrence at all fixed points simultaneously.

BAll guards patrolling — creates maximum unpredictability for adversaries.

CStationary guard at the main entrance lobby (funnel point); patrolling guards on the exterior perimeter — matching the CED's deployment recommendations for each guard type.

DPatrolling guard at the main entrance; stationary guards on the perimeter.

42.4.4 — Applying Detection Techniques (LO 2.4.C)

The CED identifies three specific application techniques for physical attack detection.

2.4.C.1Cameras + Facial Recognition

Cameras provide visual monitoring and a visual record of activity within a designated space. Cameras can be paired with facial recognition software that provides alerts when unauthorized individuals enter controlled areas. Once a physical breach has been detected, defenders can use live and recorded camera footage to track an adversary's path and actions.

AP Exam note: The CED explicitly includes facial recognition as a camera capability (not as a separate control). Recording and monitoring together maximize effectiveness. Live footage tracks the adversary in real time; recorded footage supports after-incident investigation.

2.4.C.2Motion Detectors + Camera Pairing

Motion detectors work best when paired with cameras. When a security alert is raised because a motion detector has been activated, defenders can use cameras to visually check the space and verify a physical security breach. This pairing reduces false alarm response burden — instead of dispatching a guard to every alert, defenders verify via camera first.

Workflow: Motion sensor triggers alert → defender views camera feed for that area → confirms whether real breach or false alarm → dispatches guard only when confirmed. This is the CED-specified detection workflow.

2.4.C.3Door-Duration Entry Log Analysis

When employees are required to use an electronic badge to unlock a door, a sensor can record how long the door was open. In reviewing entry logs for the door, potential piggybacking or tailgating can be detected by doors being open for longer than normal lengths of time.

Why it works: A normal badge access event — one person authenticating and walking through — has a characteristic door-open duration. If a door remains open significantly longer, it suggests a second person entered. This creates an audit trail for physical access violations without requiring a mantrap.

AP Exam Key: This is the CED's specific mechanism for detecting piggybacking and tailgating at standard doors. Door duration in the entry log is the detection signal — this is a detective control applied through data analysis, not real-time physical intervention.

Check for UnderstandingDetection Application

Q 4 of 10

According to CED 2.4.C.3, how can reviewing entry logs detect potential piggybacking or tailgating at a badge-access door?

ADoors being open for longer than normal lengths of time indicate that more than one person may have entered on a single badge swipe, suggesting piggybacking or tailgating.

BMultiple badge swipes from the same employee in a short time period indicate that a second person used the same badge.

CThe entry log records the weight sensor reading at each door event, detecting when two people entered on one swipe.

DThe entry log cross-references camera footage automatically to count persons entering per badge event.

Check for UnderstandingI/II/III — CED Core

Q 5 of 10

Which of the following statements about physical attack detection are TRUE according to the AP CED?

I. Motion detectors work best when paired with cameras — the camera allows visual verification of whether a motion alert is real or a false alarm.
II. Patrolling guards are specifically recommended for main entrances and lobbies because their unpredictable movement is more effective at funnel points.
III. Cameras can be paired with facial recognition software to alert when unauthorized individuals enter controlled areas.

AI only

BI and III only

CII and III only

DI, II, and III

52.4.5 — Beyond the AP Core: Real-World Extensions

🔔 Note — This Section Goes Beyond the CED Core

The AP exam tests the CED core above (2.4.A–C). The concepts below are real-world physical security tools used by security professionals. Understanding them deepens your ability to reason about scenarios, but they are enrichment, not required CED content. AP exam questions will not ask about access logs, impossible travel, or integrated SIEM systems as core content.

Access Log Analysis (Real-World Extension)

Modern card reader systems log every badge event — who, when, where, granted or denied. Security analysts review these logs for anomaly patterns that camera and motion sensors cannot detect on their own:

Anomaly Pattern	What It Indicates	Attack Detected
Impossible Travel	Same badge ID at two locations physically impossible to reach in elapsed time	Card cloning — duplicate card in use while original is with owner
After-Hours Access by Non-Authorized Role	Badge access to sensitive areas outside normal hours for that role	Unauthorized access; potential insider threat
Excessive Denied Attempts	Repeated failed access attempts at a door or from one badge ID	Physical access attempt; testing cloned badge data
Extended Door-Open Events	Door open significantly longer than normal per the CED entry log method	Tailgating / piggybacking — CED 2.4.C.3 (this specific pattern IS in the CED)

CCTV vs. IP Cameras (Real-World Context)

While the CED simply says "cameras," real deployments choose between two types. CCTV (Closed-Circuit Television) uses dedicated coaxial cables to a local recorder — isolated from networks, harder to hack remotely. IP cameras transmit digital video over a standard network — higher resolution, remote access, integration with other systems, but require cybersecurity measures to protect the camera network itself from attack.

Check for UnderstandingCED Application

Q 6 of 10

Xtensr Labs installs CCTV cameras at all building entrances and exits. How is this control correctly classified, and what does the CED say the camera feed should do for maximum effect?

APhysical and Preventative — cameras prevent attackers from entering by making them visible before they attempt entry.

BPhysical and Detective — cameras are detective controls that capture a visual record. The CED states the feed should be both recorded AND monitored for maximum effect, and recordings are especially helpful in after-incident investigations.

CTechnical and Detective — camera systems use digital technology, making them Technical controls.

DPhysical and Corrective — camera footage corrects security gaps by showing what went wrong.

Check for UnderstandingPlacement Scenario

Q 7 of 10

✎ Predict first: A security team proposes installing motion sensors in the main lobby, the server corridor, and the executive conference room. Based on CED placement principles, which location is most problematic?

A security team proposes motion sensors in three areas: (1) main lobby (200 employees pass through daily), (2) server corridor (accessed only by 6 IT staff), (3) executive conference room (accessed only for scheduled meetings). Based on CED 2.4.B.2, which placement decision is most likely to undermine detection effectiveness?

AThe server corridor — the IT staff will regularly trigger the sensor during authorized access events.

BThe executive conference room — legitimate scheduled meetings will trigger the sensor repeatedly.

CThe main lobby — 200 employees passing through daily will generate constant false alarms, causing security staff to stop taking alerts seriously when a real incident occurs.

DNone — motion sensors in all three locations maximize detection coverage throughout the facility.

Check for UnderstandingSpot the Error

Q 8 of 10

A security consultant states: "Installing CCTV cameras at all building entrances provides sufficient physical security detection. Cameras capture everything that happens, so no other detection controls are needed." Which statement correctly identifies what is wrong?

AThe consultant is correct — comprehensive camera coverage at all entrances provides complete detection.

BCameras alone are insufficient: they do not alert to movement in areas without a human watching live; motion sensors add automated alerting; guards provide real-time response; and employees detect unauthorized persons that cameras may miss. The CED defines four detection mechanisms, not one.

CThe consultant is partially correct — cameras are sufficient as long as someone is watching the live feed at all times.

DThe consultant is wrong only because cameras at entrances miss interior areas — adding interior cameras would make the system sufficient.

Check for UnderstandingScenario Application

Q 9 of 10

After a physical security incident at Xtensr Labs, a forensic review reveals that an adversary entered the server corridor at 11:47 PM and spent 22 minutes inside before leaving. The adversary used a valid badge. The camera was not being monitored live. How should the detection system have flagged this incident before the adversary completed their objective?

AThe camera system would have flagged the incident because cameras automatically alert when access events occur after midnight.

BThe card reader would have rejected the badge because the adversary accessed the corridor outside their authorized hours.

CA motion sensor in the server corridor — which has unexpected late-night traffic — should have triggered an alert. Per CED 2.4.C.2, this should have activated the paired camera for visual verification, enabling a guard to respond.

DThere is no way to detect this incident in real time — since the badge was valid, no detection control could have flagged unauthorized activity.

End of Lesson & Unit 2Comprehensive Integration

Q 10 of 10

Xtensr Labs security director presents the detection plan: "We will install cameras at all entrances and exits (points of ingress and egress), place motion sensors in the server corridor and server room, pair all motion sensors with cameras, station a guard in the main lobby during business hours, and conduct entry log reviews weekly." An advisor asks: "What CED-required detection mechanism is missing from this plan?"

Which detection mechanism does the CED explicitly identify that is absent from the plan described?

AFacial recognition software paired with cameras — required by CED 2.4.C.1.

BEmployees as a detection mechanism — the CED (2.4.A.4) states employees are often the first to notice an unauthorized person and alert security. No mention of employee awareness or reporting procedures is in the plan.

CAn integrated SIEM system — required to correlate detection signals from multiple sources.

DPatrolling guards on the exterior perimeter — the plan only mentions stationary guards in the lobby.

72.4.7 — Quick Reference & FAQ

★ CED Must-Know Summary — Topic 2.4

4 detection controls (2.4.A): Cameras • Security guards • Motion sensors • Employees
Camera placement (2.4.B.1): Points of ingress/egress • Consider coverage, angle, tamper risk
Motion sensor placement (2.4.B.2): Low-traffic, unexpected-traffic areas • Avoid high-traffic (false alarms)
Lock placement (2.4.B.3): All entries to sensitive areas; access control vestibule for particularly sensitive
Guard deployment (2.4.B.4): Stationary = funnel points; Patrolling = perimeters/exterior
Applying detection (2.4.C): Cameras + facial recognition • Motion + paired camera workflow • Door duration in entry logs detects piggybacking/tailgating

Control	CED Function	Best Placement	Attack It Detects
Cameras	Visual record; monitored + recorded (2.4.A.1)	Ingress/egress, restricted corridors, sensitive areas	Any physical intrusion with visual signature
Security Guards	Monitor + respond (2.4.A.2)	Stationary at funnel points; patrolling at perimeters	Suspicious behavior, unauthorized presence
Motion Sensors	Alert to movement (2.4.A.3)	Low-traffic, unexpected-activity areas (server rooms)	Unauthorized presence in restricted areas
Employees	Notice and report (2.4.A.4)	All areas where employees work	Unauthorized persons in work areas
Entry Log (Door Duration)	Audit trail analysis (2.4.C.3)	All badge-access doors	Piggybacking/tailgating (longer-than-normal door open)

What does the CED mean by "points of ingress and egress"?

Ingress means entry points (doors, gates, access points into a building or area). Egress means exit points. The CED (2.4.B.1) specifies that points of ingress and egress are often monitored by camera because every unauthorized access must enter through some ingress point, and tracking egress helps timeline investigations. These are the highest-priority camera placements.
Why do false alarms matter for physical security detection?

The CED (2.4.B.2) explicitly addresses this: false alarms in high-traffic areas make alarms "less likely to be taken seriously when there is a real security event." This is the physical security equivalent of the boy who cried wolf — when security staff experience constant false alerts, they stop responding urgently. Effective detection requires high signal, low noise, which is why motion sensors belong in low-traffic, high-security areas rather than busy hallways.
How does a camera feed need to be managed for maximum effect?

The CED (2.4.A.1) specifies two requirements: the feed must be recorded AND monitored. Recording alone means breaches are only discovered after the fact during review. Monitoring alone without recording means events cannot be analyzed after the fact. Both together provide real-time detection capability AND forensic investigation capability. Recordings are especially valuable in after-incident investigation to reconstruct the adversary's path and actions.
Is facial recognition required AP content for Topic 2.4?

Yes — the CED (2.4.C.1) includes it explicitly: "Cameras can be paired with facial recognition software that can provide alerts when unauthorized individuals enter controlled areas." However, the CED uses "can be paired with" — it is a capability, not a requirement. The AP exam may ask you to identify it as a camera enhancement capability, but it will not assume all camera systems have facial recognition.

Premium Feature

1-on-1 Expert Support

Get personalized help from an AP Cybersecurity instructor — 2,067+ verified hours, 5.0 rating, 499+ reviews.

2,067+ Verified Hours 5.0 Wyzant Rating 499+ Five-Star Reviews

Learn About Expert Sessions →

Tanner Crow

AP Computer Science Teacher — Blue Valley North High School

Tanner has taught AP Computer Science for 11+ years and built APCSExamPrep.com to give every student access to the same resources his own students use. 2,067+ verified tutoring hours on Wyzant, 5.0 rating from 499+ reviews. AP CSA students score 5s at more than double the national average.

11+ Years Teaching AP CS 2,067+ Verified Tutoring Hours 499+ Five-Star Reviews 5.0 Rating on Wyzant

Content last reviewed and updated: June 2026

+Continue Learning

📋 Exit Ticket — Topic 2.4 | 5 Questions | Ready for Canvas / Google Classroom

Students submit before leaving.

The CED identifies four physical security detection controls. List all four. Which is most commonly forgotten by students? (AP Skill: Detect Attacks)
Motion sensors: (a) lobby with 500 daily visitors or (b) server room with 3 IT staff. Apply CED 2.4.B.2 to recommend placement and explain the false alarm risk. (AP Skill: Detect Attacks)
Describe the CED-specified workflow (2.4.C.2) for using motion sensors and cameras together. Why is the pairing more effective than either alone? (AP Skill: Detect Attacks)
An entry log shows a specific door was open for 47 seconds when normal single-person entries average 6 seconds. What does CED 2.4.C.3 say this indicates, and what should the security team do next? (AP Skill: Detect Attacks)
A campus has one main entrance lobby and a large exterior perimeter. Two guards available. Apply CED 2.4.B.4 to determine the correct deployment of each guard and explain why. (AP Skill: Detect Attacks)

Answer Key: (1) Cameras, security guards, motion sensors, employees (most forgotten: employees). (2) Server room — lobby false alarms from 500 daily users cause alert fatigue, degrading real detection. (3) Motion alert → camera check → visual verification → dispatch only if confirmed. Removes false alarm response burden from guards. (4) Potential piggybacking or tailgating — longer than normal = possible second person. Review camera footage from that timestamp; investigate badge holder. (5) Stationary at lobby (funnel point) + patrolling on exterior perimeter (harder to plan around, creates time pressure).

← Topic 2.3

Topic 2.4 — Lesson (Step 1 of 5)
Lesson → Exercise 1 → Exercise 2 → Lab → Quiz

Exercise 1 →

AP Cybersecurity · Unit 2 · Lesson 2.4

← Previous2.3 Protecting Physical Spaces Next →3.1 Network Fundamentals

Keep going:Unit 2 Study Guide Unit 2 Exam Course Guide All Study Guides Practice Questions Score Calculator

Get in Touch

Whether you're a student, parent, or teacher — I'd love to hear from you.

Typically responds within 24 hours

✓

Message Sent!

Thanks for reaching out. I'll get back to you within 24 hours.

Name *

Email *

I am a... (optional)

Which course? (optional)

Phone (optional)

How did you find us? (optional)

🏫 Welcome, fellow educator!

I offer curriculum resources, practice materials, and study guides designed for AP CS teachers. Let me know what you're looking for — whether it's classroom materials, a guest speaker, or Teachers Pay Teachers resources.

Message (optional — leave blank if just subscribing)

✉

[email protected]

📚

Courses

AP CSA, CSP, & Cybersecurity

⏱

Response Time

Within 24 hours

Prefer email? Reach me directly at [email protected]