Which of the following lists are common physical security controls to protect information assets?

• A. Access control, badge readers, mantraps, surveillance cameras, secure desks/rooms, secure disposal, environmental controls; awareness of tailgating
• B. Smart cards, security cameras, and password policies.
• C. Firewall and network segmentation.
• D. Data backup and encryption.

Answer: (A)

Protecting information assets physically means restricting access, monitoring activity, and safeguarding the environment where those assets reside. The listed items illustrate a broad range of physical security controls: access control measures and badge readers regulate who can enter secure areas; mantraps enforce one-person-at-a-time entry to prevent unauthorized access; surveillance cameras deter wrongdoing and provide evidence when needed; securing desks and rooms reduces the chance of data exposure from casual access or tampering; secure disposal prevents remnants of data from being recovered; environmental controls protect hardware from damage due to fire, flood, or extreme conditions; and training to recognize tailgating helps people act as a first line of defense against social-engineering breaches.

The other options mix in controls that are not primarily physical. Password policies are administrative in nature and not about physical access to spaces or equipment, even though some elements like cameras may appear physical. Firewall and network segmentation address network security, not the physical protection of assets. Data backup and encryption protect data but don’t by themselves prevent physical access or damage to the devices that store or process it.