An auditor finds a stolen city badge can be paired with passwords written on sticky notes at workstations. What lesson about combined physical and logical controls applies?
Select an answer to reveal the explanation.
Short Explanation
A badge in a thief’s pocket plus a password on a sticky note is a two-piece skeleton key. Physical and logical controls only work when both stay clean—guard the badge and stop writing secrets on monitors. Night locks alone, “messy handwriting,” or quieter SIEM alerts do not fix layered failure.
Full Explanation
Physical and logical access controls are complementary layers; attackers commonly combine a stolen badge or facility credential with an exposed password or weak logical secret to defeat the whole set. Both layers must be enforced and protected—badge issuance hygiene, rapid loss reporting and revocation, and secret protection including MFA—so compromising one factor does not trivially unlock systems and spaces. Sticky-note passwords at workstations turn a stolen badge into a ready-made skeleton key for city systems.
Treating physical badges as making logical passwords unnecessary when doors lock at night ignores daytime workstation access, residual logical sessions, and after-hours remote paths. Accepting sticky-note passwords because handwriting is “hard to read” still leaves secrets in the clear for anyone nearby. Treating stolen badges as harmless when the SIEM severity is dialed to informational only delays response and undervalues physical credential compromise as an identity event.
Exam caveat: layered controls fail when either layer is neglected; exam answers usually require protecting both physical and logical factors. Operational check: enforce badge reporting/revocation SLAs, ban written passwords, deploy MFA where feasible, correlate badge loss with logical risk, and ensure SIEM/alerting treats credential theft as actionable.