Domain 5 · Objective reference 5.1 · Chapter 32 of 62
Control access to physical and logical assets
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: A door badge and a system permission protect different boundaries.
Explore the anchors
Control access to spaces and equipment.
Concept matching activity
Match this task or description to its concept:
Control identities sessions and permissions.
Choose a concept before checking the explanation.
Access-decision sandbox
Try to edit a fictional record as a reader. Then change one condition and evaluate again. This simplified policy requires authentication, object scope and action permission; real policies have more conditions.
Change the request, then evaluate it.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
Access control binds a subject’s permitted action to an object or resource. Physical access can expose equipment, media or a session already logged in, while logical access can disclose or alter data remotely. Identity proofing, authentication and authorization answer different questions. An authorized visitor is not necessarily authorized to use a server, and a valid account is not necessarily authorized for every record.
Design, evidence and tradeoffs
Identify information, systems, devices, facilities, applications and services in scope. Use least privilege, appropriate separation of duties and accountable temporary access. Evaluate direct and inherited rights and both permitted and denied actions. Physical and technical controls should support one another without assuming either is complete. Emergency access requires protected custody and review, not an undocumented permanent bypass.
Worked example
A contractor has an approved building badge but no production-console permission. The controls preserve that distinction.
Check your understanding
Why should physical entry approval not imply administrative system access?
Show explanation
The purposes, resources, authority and consequences differ; each access decision needs its own appropriate authorization.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.