AP Cybersecurity Drill 8: Defense in Depth for a New Facility

Question 1. What does the planner's defense-in-depth principle mean for this building?

• A) One very strong and expensive lock on the front door is by itself sufficient protection for the building
• B) Only the inner server closet genuinely needs protecting, since that closet is exactly where the member data is stored
• C) Strong encryption on the member records by itself makes all of the physical entry controls unnecessary
• D) Several independent layers protect the records, so defeating any one control still leaves others in place ✓

Explanation: Choice D is correct. Defense in depth means stacking independent safeguards so that breaching any one of them still leaves additional controls protecting the member records. Choice A is incorrect. Relying on a single strong lock is the opposite of layering and creates one point of failure. Choice B is incorrect. Protecting only the server closet ignores the lobby, doors, and data layers that defense in depth requires. Choice C is incorrect. Encryption is one valuable layer, but it does not remove the need for physical and access controls.

Question 2. A visitor in the public lobby should be able to use the computer lab but never reach the staff offices. Which control most directly enforces that separation?

• A) Install noticeably brighter overhead lighting throughout the building's public lobby area
• B) Put badge readers on the office doors so they admit only authorized staff, not visitors ✓
• C) Build a considerably taller security fence around the entire perimeter of the property
• D) Provide a larger and more detailed visitor sign-in sheet at the staffed front desk area

Explanation: Choice B is correct. Badge readers on the office doors let only staff badges open them, directly stopping a lobby visitor from entering the offices while still allowing lab use. Choice A is incorrect. Lighting may deter some activity but does not control who can open the office doors. Choice C is incorrect. A perimeter fence governs the outside grounds, not movement between interior rooms. Choice D is incorrect. A sign-in sheet records names but does not physically prevent entry to the offices.

Question 3. The server closet already has a badge reader, a locked rack, and an entry log. Which addition best continues the layered approach for the data itself rather than duplicating a physical layer?

• A) Add a second badge reader on the same server-closet door so there is redundancy on that one entry point
• B) Install a heavier and more solidly constructed physical door on the front of the server closet itself
• C) Keep member records encrypted and require a second authentication factor for accounts that read them ✓
• D) Add one more padlock onto the existing locked equipment rack that sits inside the server closet already

Explanation: Choice C is correct. Encrypting the records and requiring a second authentication factor protects the data layer itself, extending defense in depth beyond the physical controls already present. Choice A is incorrect. A second badge reader duplicates an existing physical layer rather than protecting the data. Choice B is incorrect. A heavier door is another physical barrier, not a safeguard on the records themselves. Choice D is incorrect. Another rack lock repeats a physical control and does nothing for the data if someone reaches it.

Question 4. Which control in the plan is primarily a detection measure rather than a prevention measure?

• A) The server-closet entry log, which records exactly who entered the closet and at what time ✓
• B) The badge readers on the doors, which decide in real time which people are allowed to pass
• C) The strong encryption applied to the member records that are stored on the closet's server
• D) The locked equipment rack inside the closet, which physically secures the server hardware

Explanation: Choice A is correct. The entry log records who went in and when, which is how misuse is noticed after the fact, making it a detection control. Choice B is incorrect. Badge readers decide who may pass, which prevents entry rather than detecting it. Choice C is incorrect. Encryption prevents unauthorized reading of data; it does not record events for review. Choice D is incorrect. A locked rack physically prevents access and does not detect anything.

Question 5. If the planner could add only one more safeguard, which best fills the remaining gap between a lobby visitor and the member records?

• A) Install a second perimeter security fence running around the outside of the building's parking lot
• B) Mount several pieces of additional exterior lighting near the building's main public entrance doors
• C) Provide a noticeably larger front-desk sign-in book with more room for recording visitor details
• D) Add an access control vestibule between the public area and the staff-only corridor at the back ✓

Explanation: Choice D is correct. An access control vestibule between the public and staff areas admits one verified person at a time, closing the path a lobby visitor would use to reach the back areas and the records. Choice A is incorrect. A parking-lot fence addresses the outer perimeter, not the interior path to the records. Choice B is incorrect. More entrance lighting does not control interior movement. Choice C is incorrect. A bigger sign-in book records visitors but does not physically separate them from staff areas.