An auditor finds that a branch office's database server sits in an unlocked supply closet. Anyone in the building can walk in, unplug the server, attach a USB device, or carry the chassis away. Which control most directly addresses the risk the auditor described?
Select an answer to reveal the explanation.
Short Explanation
You can put the best lock in the world on the front door of your app, but if the server's sitting in an open closet, anybody can just pick it up and walk out. This is a physical problem, so you fix it with a physical control: a locked room and an access log. Encryption is nice, but it doesn't stop someone yanking the power cord.
Full Explanation
Physical security protects the hardware itself: who can touch, power off, connect devices to, or remove the server. The auditor's findings are all physical actions, so the direct control is to relocate the server into a secured space, such as a locked server room or data center, with controlled entry like badge readers and an access record showing who entered and when, and ideally camera coverage. Encryption at rest is a valuable complementary control because it protects the data on stolen disks, but it does nothing to stop someone unplugging the server, interrupting availability, or attaching a device to the running host. A host firewall restricts which network sources can reach the database port; it is a logical network control and offers no protection against a person standing in front of the machine. Multifactor authentication strengthens logical sign-in for administrators, but physical attacks do not need to sign in; pulling power or removing drives bypasses authentication entirely. Exam caveat: on DataSys+, physical security is its own category alongside logical controls, and the best answer matches the category of the risk described. Operational check: confirm the room locks, that only authorized staff hold access, and that the access log for the room can be reviewed during audits.