712-50 Question 254
Single answerA newly appointed CISO is reviewing access controls after a security incident in which an attacker used a stolen employee ID badge to enter a regional office and then accessed a sensitive internal application from an unattended workstation. The organization operates office locations, a data center, and several cloud-based business applications used remotely by employees and contractors. The CEO wants a single strategy that materially reduces the risk of unauthorized access across both physical and logical environments without creating unnecessary operational complexity. Which of the following is the MOST appropriate recommendation?
- A
Retain ID badges for building entry, add biometric verification only for the data center, and require multi-factor authentication for remote access and sensitive business applications
- B
Replace all ID badges with biometric readers in every office and remove passwords for cloud applications to simplify user access
- C
Use ID badges as the primary control for all facilities and internal systems, because a centrally managed badge system provides consistent identity assurance
- D
Require multi-factor authentication only for privileged administrators, since standard users present lower risk and biometrics are too costly for most environments
Show answer and explanation
Correct answer: A
Explanation
The best answer is the risk-based, layered approach in Option 1. A CISO should match access control mechanisms to the environment and the sensitivity of the asset. For physical access, ID cards are efficient and scalable for general office access, but they are vulnerable to theft, loss, sharing, and cloning. For higher-security locations such as data centers or restricted zones, adding biometrics strengthens assurance by verifying something the user is, rather than only something the user has. For logical access, especially remote access and sensitive business applications, MFA is a critical control because passwords alone are vulnerable to phishing, credential stuffing, and reuse attacks.
This approach is consistent with widely accepted practices in standards and guidance such as NIST SP 800-63 Digital Identity Guidelines, which emphasize authentication assurance levels and the use of multiple factors where risk warrants it, and NIST SP 800-53 controls related to identification and authentication and physical access control. It also aligns with Zero Trust principles that recommend strong, context-aware authentication for access to enterprise resources. From a CCISO perspective, the key is governance and proportionality: deploy stronger controls where they reduce risk most effectively, rather than applying a single mechanism everywhere or reserving MFA only for administrators.
- A. Correct.
Correct. This option applies layered, risk-based access controls across different environments. ID badges remain practical for general physical access, while stronger controls such as biometrics are used for higher-security physical areas like the data center. Requiring multi-factor authentication (MFA) for remote access and sensitive applications addresses the separate risk of compromised credentials and session misuse in logical environments. This aligns with common best practices: use the right control for the asset and threat level, and implement MFA where credential theft is a realistic threat.
- B. Incorrect.
Incorrect. Replacing all badges with biometrics everywhere is often operationally excessive, costly, and may introduce privacy, enrollment, and fallback challenges. Removing passwords for cloud applications in this context is also not the best framing; strong authentication should be enhanced, not weakened. Passwordless methods can be valid when properly implemented, but the option suggests simplification without addressing assurance, lifecycle management, or practical deployment considerations across contractors and remote users.
- C. Incorrect.
Incorrect. An ID badge is generally a possession factor appropriate for physical entry, but it should not be treated as sufficient for internal systems. A stolen or cloned badge does not provide strong identity assurance for logical access. This option reflects a common misconception that one credential type can be uniformly extended across all environments without considering the difference between physical and digital threat models.
- D. Incorrect.
Incorrect. Limiting MFA to privileged administrators leaves a significant attack surface unaddressed, especially for standard users accessing cloud applications remotely. Many real-world breaches begin with compromised non-privileged accounts, then escalate. While biometrics may not be necessary in every environment, dismissing broader MFA adoption conflicts with modern security guidance for remote access and sensitive systems.