A municipality protects both a data-center cage and a public library self-checkout kiosk. How should access-control strength be applied?
Select an answer to reveal the explanation.
Short Explanation
A server cage and a checkout kiosk are not the same treasure chest. Put heavy MFA, escort, and monitoring on the cage, and use lighter but still deliberate controls on the public kiosk. One-size mantraps everywhere, unlocking the cage because the library uses PINs, or deleting logs ignore asset risk.
Full Explanation
IAM and physical access strength should match asset type, sensitivity, and threat—not a single cosmetic standard for every door and device. A data-center cage typically warrants multifactor entry, escort where policy requires, continuous monitoring, and strict accountability because compromise affects many systems. A public library self-checkout kiosk needs intentional but lighter controls that limit tampering, privilege escalation, and data exposure without blocking citizen use. Matching control strength to the asset is how municipalities spend scarce security resources where impact is highest.
Applying identical MFA turnstiles and mantraps to every kiosk and cage wastes budget and friction on low-sensitivity assets while implying that uniformity equals correctness. Leaving the data-center cage unlocked because the library already uses simple PINs underprotects critical infrastructure by anchoring to the weaker peer. Removing all access logs from both environments to save storage destroys accountability and detection for theft, tailgating, and kiosk abuse alike.
Exam caveat: risk-based control selection beats one-size-fits-all; CISSP expects proportionate protection. Operational check: classify cage vs kiosk assets, apply stronger auth/monitoring/escort to the cage, keep purposeful kiosk hardening without overbuilding, and retain access logs appropriate to each environment’s risk.