Examius

🇬🇧 CISMP (Certificate in Information Security Management Principles) · subject

CISMP (Certificate in Information Security Management Principles) Physical, Environmental and Operational Security Syllabus

The Physical, Environmental and Operational Security syllabus for CISMP (Certificate in Information Security Management Principles) in full: 3 chapters, 10 topics and 14 sub-topics, every one listed below, plus 51 Physical, Environmental and Operational Security flashcards with answers.

3Chapters
10Topics
14Sub-topics
51Flashcards

Physical, Environmental and Operational Security syllabus: all 3 chapters

Expand any chapter to see its topics and sub-topics.

  1. Physical and Environmental Security

     3 topics
    • Secure areas and perimeters
      • Physical entry controls
      • Secure zones and clear desk policy
    • Equipment security
      • Siting and protection of equipment
      • Secure disposal and reuse of media
    • Environmental controls
      • Power, fire and climate protection

  2. Operational Security and Asset Management

     4 topics
    • Asset management and classification
      • Asset inventory and ownership
      • Information classification and labelling
    • Operational procedures and responsibilities
      • Documented operating procedures
      • Capacity and segregation of environments
    • Backup and resilience
      • Backup strategies and testing
    • Media handling
      • Secure transport and storage

  3. Security Monitoring and Vulnerability Management

     3 topics
    • Security testing
      • Vulnerability scanning
      • Penetration testing
    • Technical compliance checking
    • Event and log monitoring
      • Collecting and correlating events

CISMP (Certificate in Information Security Management Principles) Physical, Environmental and Operational Security flashcards — 51 questions with answers

  1. In physical security, what is the purpose of defining a 'security perimeter' for a secure area?

    A security perimeter is a defined barrier (e.g. wall, fence, manned reception, card-controlled door) that establishes the boundary of an area containing information or information-processing facilities, so that access can be controlled and the contents protected.

  2. What is 'defence in depth' (layered security) in the context of physical site protection?

    The use of multiple, successive rings of physical controls (e.g. site perimeter, building, secure room, locked cabinet) so that defeating one layer still leaves further barriers — no single point of failure protects the asset.

  3. Define 'tailgating' (piggybacking) as a physical security threat.

    An unauthorised person follows an authorised person through a controlled access point (e.g. a card-controlled door) without presenting their own credentials, defeating the access control.

  4. What is a 'mantrap' (access control vestibule / airlock) and what threat does it counter?

    A small space with two interlocking doors where the second door cannot open until the first has closed, allowing only one person through at a time. It counters tailgating/piggybacking and enforces single-person authenticated entry.

  5. What is a 'clear desk and clear screen' policy?

    A policy requiring that papers, removable media and other sensitive information are locked away when not in use, and that screens are locked/logged off when unattended, to reduce unauthorised access, loss and damage during and outside working hours.

  6. Why should delivery and loading areas be controlled and ideally isolated from information-processing facilities?

    To prevent unauthorised persons gaining entry through goods-handling points; incoming and outgoing material should be inspected and registered, and external delivery staff kept separate from secure processing areas.

  7. Name three common physical intrusion-detection or deterrent controls for secure areas.

    Examples include intruder alarms/motion detectors, CCTV surveillance, security lighting, guards/patrols, fences and gates, and door/window contact sensors.

  8. What is the security concern with placing critical equipment near windows or in ground-floor/public-facing rooms?

    It increases exposure to theft, vandalism, eavesdropping/shoulder-surfing, and environmental threats; sensitive equipment should be sited to reduce the risk of unauthorised viewing and physical attack.

  9. In equipment security, what is the difference between protecting against 'theft' and protecting against 'interruption of service'?

    Anti-theft controls (locks, cable tethers, asset tags, secure cabinets) protect confidentiality and asset value; service-continuity controls (UPS, redundant power, environmental controls) protect availability by keeping equipment operating.

  10. What does a UPS provide and what is its primary security objective?

    An Uninterruptible Power Supply provides short-term battery power during a mains failure, primarily to support availability — allowing equipment to keep running or to shut down gracefully without data loss until generators or mains are restored.

  11. What is the role of a standby generator versus a UPS in power resilience?

    A UPS bridges the gap for seconds to minutes during outages and conditions power, while a generator supplies sustained power for longer outages. They are typically used together: UPS covers the start-up delay until the generator comes online.

  12. What is 'cable security' and why does it matter?

    Protecting power and telecommunications cabling from interception, interference and damage — e.g. using conduit, avoiding public routes, segregating power and data cables, and shielding to prevent eavesdropping and accidental/deliberate disruption.

  13. Why must equipment removed from site or used off-premises still be protected, and what is the main risk?

    Off-site equipment (laptops, mobile devices) leaves the protection of the secure perimeter and is exposed to theft and loss; the main risk is exposure of data, so encryption, authentication and physical care are required.

  14. What environmental conditions must data-centre controls typically manage?

    Temperature and humidity (via HVAC/air conditioning), dust/contaminants, fire, water/flood, and power quality — to keep equipment within safe operating ranges and prevent damage or failure.

  15. Why is humidity control important in equipment rooms, considering both extremes?

    Too low humidity increases the risk of static electricity (ESD) damaging components; too high humidity promotes condensation and corrosion. Humidity is kept within a controlled band to protect equipment.

  16. What is the preferred type of fire-suppression system for a server room and why?

    A gaseous (inert/clean-agent) suppression system (e.g. inert gas or chemical agents that displace oxygen or interrupt combustion) is preferred because it extinguishes fire without the water damage that sprinklers would cause to electronics.

  17. What is the difference between 'detective' and 'suppressive' fire controls?

    Detective controls (smoke/heat detectors, VESDA aspirating detection) sense a fire and raise the alarm; suppressive controls (gas systems, sprinklers, extinguishers) act to put the fire out.

  18. Define 'asset' in the context of information security asset management.

    Anything of value to the organisation that needs protection — including information, software, physical equipment, services, people and intangibles such as reputation.

  19. What is the purpose of maintaining an asset inventory/register?

    To identify and record all assets, their owners and their value so that appropriate protection can be assigned and accountability maintained throughout the asset's lifecycle.

  20. What is the role of an 'asset owner' (information owner)?

    The individual or role accountable for an asset throughout its lifecycle — responsible for its classification, defining and reviewing access restrictions, and ensuring it is appropriately protected (though day-to-day handling may be delegated).

Show the other 31 Physical, Environmental and Operational Security flashcards

  1. What is the purpose of an information classification scheme?

    To indicate the value, sensitivity and criticality of information so that a consistent, proportionate level of protection (handling, storage, transmission, disposal) can be applied according to the level assigned.

  2. What are the four labels commonly used in a UK government-style information classification model?

    In the current UK scheme: OFFICIAL, SECRET and TOP SECRET (with OFFICIAL-SENSITIVE as a handling caveat). Many commercial schemes instead use Public, Internal, Confidential and Restricted/Highly Confidential.

  3. On what three security properties is information typically classified for impact?

    Confidentiality, Integrity and Availability — the potential business impact of a breach of each property determines the appropriate classification level.

  4. What is the difference between 'classification' and 'labelling' of information?

    Classification is the process of determining the sensitivity level of information; labelling is marking the asset (physically or in metadata) with that classification so handlers know how to treat it.

  5. What are 'standard operating procedures' (operating procedures) and why should they be documented?

    Documented step-by-step instructions for routine operational activities (e.g. start-up/shutdown, backup, system handling). Documenting them ensures consistency, reduces error, supports availability, and enables others to perform tasks correctly.

  6. Define 'segregation of duties' and the threat it mitigates.

    Dividing a sensitive task among multiple people so no single person controls it end-to-end. It mitigates fraud, error and abuse of privilege by ensuring no one individual can both perform and conceal a malicious or mistaken action.

  7. What is the security purpose of separating development, test and production (operational) environments?

    To prevent untested or unauthorised changes and development data/tools from affecting live systems, reduce the risk of accidental or malicious changes, and protect production data from exposure in less-controlled environments.

  8. What is 'change management' (change control) and why is it an operational security control?

    A formal process for requesting, assessing, approving, testing, implementing and reviewing changes to systems. It reduces the risk of changes causing security weaknesses, outages or unintended impacts on confidentiality, integrity or availability.

  9. What is 'capacity management' in operational security and which CIA property does it support?

    Monitoring and planning the use of resources (storage, processing, bandwidth) so future capacity meets demand. It primarily supports availability by preventing resource exhaustion and performance failures.

  10. What is the difference between a backup and an archive?

    A backup is a copy of current data taken for recovery after loss or corruption; an archive is the long-term retention of data that is no longer in active use, kept for legal, regulatory or historical reasons.

  11. State the '3-2-1' backup rule.

    Keep at least 3 copies of data, on 2 different types of media, with 1 copy held off-site (offline/immutable copies further protect against ransomware).

  12. Compare full, incremental and differential backups.

    A full backup copies all selected data. An incremental copies only data changed since the last backup of any type (fast to back up, slower to restore — needs the chain). A differential copies all data changed since the last full backup (larger each day, but restore needs only the full plus the latest differential).

  13. Define RPO (Recovery Point Objective).

    The maximum acceptable amount of data loss measured in time — i.e. how far back in time recovery can be, which dictates how frequently backups/replication must occur.

  14. Define RTO (Recovery Time Objective).

    The maximum acceptable length of time to restore a system or process after a disruption before the impact becomes unacceptable to the business.

  15. If a system performs backups every 24 hours, what is its RPO, and why is it important to test restores?

    The RPO is up to 24 hours (the worst-case data loss equals the time since the last backup). Restores must be tested because a backup is only valuable if it can actually be recovered — untested backups may be corrupt, incomplete or unreadable.

  16. What is the difference between resilience and recovery?

    Resilience is the ability of a system to keep operating (or degrade gracefully) despite faults — built in through redundancy and fault tolerance; recovery is restoring service after a failure has occurred (e.g. from backups or a DR site).

  17. What does the RAID acronym stand for and what is its general purpose?

    Redundant Array of Independent (originally Inexpensive) Disks — combining multiple physical disks to provide fault tolerance and/or performance, so that data availability is maintained despite a disk failure.

  18. Contrast RAID 1 and RAID 5 in terms of redundancy.

    RAID 1 mirrors data identically across two disks (full duplicate, survives one disk failure). RAID 5 stripes data with distributed parity across three or more disks, surviving a single disk failure with less storage overhead than mirroring.

  19. Is RAID a substitute for backups? Explain.

    No. RAID protects against hardware (disk) failure to maintain availability, but it does not protect against accidental deletion, corruption, ransomware or site loss — those changes are written across the array, so backups are still required.

  20. What is the difference between a 'hot', 'warm' and 'cold' standby/recovery site?

    A hot site is fully equipped and continuously synchronised for near-immediate switchover; a warm site has hardware and connectivity but needs data/configuration loading before use; a cold site provides only space and basic infrastructure, requiring equipment and data to be installed before recovery.

  21. What are the main risks associated with removable media (USB drives, optical disks, tapes)?

    Loss or theft leading to data disclosure, introduction of malware to systems, uncontrolled data exfiltration, and inadequate destruction of data when the media is disposed of.

  22. What controls reduce the risk of removable media?

    Encryption of data at rest, registration/management of authorised devices, disabling unauthorised ports/endpoint controls (DLP), scanning media for malware, and secure storage, transport and disposal procedures.

  23. What is the difference between deleting, erasing/wiping, and physically destroying media?

    Deleting only removes the file pointer (data is recoverable); erasing/wiping (secure overwrite or degaussing) renders data unrecoverable; physical destruction (shredding, incineration, crushing) destroys the media itself. The method must match the data's classification.

  24. What is 'degaussing' and which media does it apply to?

    Degaussing uses a strong magnetic field to scramble/erase data on magnetic media such as hard disk drives and tapes, rendering it unrecoverable. It does not work on solid-state (flash/SSD) media, which require secure erase or destruction.

  25. How should media be protected during physical transport off-site?

    Use reliable/authorised couriers, encrypt the data, use tamper-evident or secure packaging, maintain a register/log and chain of custody, and limit and verify who receives it.

  26. What is the purpose of security testing such as penetration testing and vulnerability scanning?

    To proactively identify security weaknesses in systems before attackers exploit them, verify that controls are effective, and provide assurance that the system meets its security requirements.

  27. Compare a vulnerability scan with a penetration test.

    A vulnerability scan is an automated, broad check that identifies and reports known weaknesses without exploiting them; a penetration test is a deeper, often manual exercise that actively attempts to exploit weaknesses to demonstrate real-world impact and chained attack paths.

  28. Contrast black-box, white-box and grey-box security testing.

    Black-box testing is done with no prior knowledge of the system (simulating an external attacker); white-box testing is done with full knowledge (design, code, credentials); grey-box testing is done with partial knowledge, such as a standard user account.

  29. Why must penetration testing be formally authorised and scoped before it begins?

    Because the activities (e.g. exploiting systems) could otherwise be illegal under computer-misuse law and may disrupt services; written authorisation, a defined scope, and rules of engagement protect both tester and organisation and prevent unintended damage.

  30. What is 'technical compliance checking' and how does it differ from an audit?

    Technical compliance checking verifies that systems are configured in accordance with security standards/policies and hardening baselines — often using automated tools. It is a technical conformance check, whereas an audit is a broader, independent assessment of controls, processes and governance.

  31. What is the purpose of event logging and log monitoring in operational security?

    To record security-relevant events (logins, access, changes, errors) so that incidents can be detected, investigated and reconstructed, accountability is supported, and compliance and forensic evidence requirements are met. A SIEM is commonly used to centralise, correlate and alert on logs.

CISMP (Certificate in Information Security Management Principles) Physical, Environmental and Operational Security FAQ

What is in the CISMP (Certificate in Information Security Management Principles) Physical, Environmental and Operational Security syllabus?

CISMP (Certificate in Information Security Management Principles) Physical, Environmental and Operational Security is split into 3 chapters: Physical and Environmental Security, Operational Security and Asset Management and Security Monitoring and Vulnerability Management. Together they contain 10 topics and 14 sub-topics.

How many chapters are in CISMP (Certificate in Information Security Management Principles) Physical, Environmental and Operational Security?

3 chapters, containing 10 topics and 14 sub-topics. The largest chapter is Operational Security and Asset Management, with 4 topics.

Are there flashcards for CISMP (Certificate in Information Security Management Principles) Physical, Environmental and Operational Security?

Yes — a 51-card Physical, Environmental and Operational Security deck, printed in full in the flashcards section of this page and available in the Examius app with spaced repetition. The free plan covers one exam of your choice, including its flashcards; Examius Pro, a one-time purchase, unlocks every other exam and deck.