A county court hosts sealed juvenile records that must stay available only to authorized staff. Which access approach correctly addresses both information and systems?
Select an answer to reveal the explanation.
Short Explanation
Sealed juvenile files need both a locked room and a locked login—one without the other is a half-closed vault. Pair ACLs and authenticated accounts on the system with physical controls on the room or media. Open LAN apps, public postings, or “badge equals login” leave a gap.
Full Explanation
CISSP Domain 5 expects physical and logical access controls to work together. Sealed juvenile records and similar sensitive civic repositories need authenticated accounts and ACLs or permissions on the records application and data, plus physical room, cabinet, or media controls that limit who can approach hosts and offline stores. Neither layer alone is enough: a locked door with an open LAN application still leaks to anyone who reaches the network, and strong app logins with unlocked media or unattended consoles still enable local compromise or shoulder-surfing of sealed content.
Relying only on a locked building entrance while leaving the records application open to anyone on the LAN conflates facility perimeter with system authorization. Posting printed juvenile case summaries on a public bulletin board for “transparency” directly violates confidentiality of sealed material. Disabling authentication on the records app because physical badges exist treats a facility credential as a substitute for system identity and authorization—badges do not encode least-privilege data rights inside the application.
Exam caveat: physical security and logical IAM are complementary; exam scenarios often punish choosing only one. Operational check: verify sealed-records apps require unique authenticated access with least-privilege ACLs, rooms/cabinets protecting hosts and media are controlled and logged, and no “badge-only” or public-disclosure workaround exists for juvenile or sealed case data.