SY0-701 Question 113
Single answerPhysical attacks: Brute force , Radio frequency identification (RFID) cloning , EnvironmentalA company experiences two physical security incidents in the same month. First, an attacker was seen repeatedly trying keypad combinations at a side-door entry system after business hours. Second, security footage shows a different individual briefly holding a handheld device near an employee’s proximity badge in a crowded lobby; a few days later, logs show that badge ID accessing a restricted lab at 2:00 a.m. The security manager wants a control that would BEST reduce the risk of both keypad brute-force attempts and RFID badge cloning for entry into sensitive areas. Which of the following should the company implement?
- A
Replace the keypad-only and badge-only doors with a mantrap that requires both a smart card using mutual authentication and a PIN, with lockout and alerting after repeated failed attempts
- B
Increase the badge reading range so employees do not need to present cards as closely to readers, reducing congestion in the lobby
- C
Post a guard near the side door during business hours and keep the current low-frequency proximity badges in service
- D
Add environmental monitoring sensors in the lab to detect temperature and humidity changes
Show answer and explanation
Correct answer: A
Explanation
The best answer is the layered access-control upgrade in Option 1 because it directly addresses both physical attack techniques in the scenario: brute force against a keypad and RFID cloning of a badge. In Security+ terms, this is a practical application of defense in depth for physical access control. Older proximity card technologies, especially legacy low-frequency RFID systems, are widely known to be susceptible to cloning because they often lack strong cryptographic protections. Moving to smart cards that support cryptographic authentication significantly improves resistance to badge-copying attacks. Adding a PIN creates multifactor access for the door, so possession of the card alone is not enough. Implementing lockout thresholds and alerting is a standard best practice to counter repeated guessing attempts against PIN-based entry systems. A mantrap is also appropriate for sensitive areas because it provides stronger controlled access and can reduce piggybacking or tailgating. Environmental controls, while important in physical security programs, apply to threats such as fire, HVAC failure, humidity, and flooding rather than credential cloning or brute-force entry attempts. These recommendations align with common guidance from NIST physical access control and identity management best practices, including layered controls, stronger authenticators, and monitoring/alerting for repeated failed authentication attempts.
- A. Correct.
Correct. This option addresses both attack paths with layered physical access controls. Requiring a smart card with cryptographic challenge-response or mutual authentication helps mitigate RFID cloning risks compared with older low-frequency proximity cards that can often be copied. Requiring a PIN adds a second factor for door access, so a cloned badge alone is insufficient. Lockout and alerting after repeated failed PIN attempts directly reduce keypad brute-force attacks by slowing or stopping repeated guessing and generating a response opportunity. A mantrap further strengthens protection for sensitive areas by enforcing controlled entry and reducing tailgating.
- B. Incorrect.
Incorrect. Increasing RFID read range generally makes skimming and unauthorized reads easier, not harder, because attackers can interact with badges from farther away. This does nothing to mitigate keypad brute-force attacks and can worsen the RFID exposure. Someone might choose this because it appears to improve convenience, but convenience in this case conflicts with security.
- C. Incorrect.
Incorrect. A guard posted only during business hours does not address after-hours keypad brute-force attempts effectively, and retaining older low-frequency proximity badges leaves the organization exposed to cloning attacks. While guards can be part of compensating physical security, this option does not materially solve the root problems described. The misconception is assuming visible personnel presence alone is sufficient without upgrading weak authentication mechanisms.
- D. Incorrect.
Incorrect. Environmental monitoring is important for detecting conditions such as overheating, humidity issues, water leaks, or fire suppression problems, but it is unrelated to preventing keypad brute-force attempts or RFID cloning. This is a plausible distractor because environmental controls are part of physical security broadly, but they do not mitigate the specific access-control attacks in the scenario.