Physical Controls
Tangible mechanisms that prevent, detect, or deter unauthorized physical access to facilities, systems, and assets. These controls protect the physical environment where information systems operate.
Understanding Physical Controls
Physical controls are tangible barriers and mechanisms that protect the physical environment. If you can touch it, walk through it, or it exists in physical space to block or monitor access, it's a physical control.
This is the most intuitive control category—a locked door is obviously physical. But the exam tests edge cases where physical controls overlap with other categories. A security camera is physical hardware, but the software analyzing the video feed is technical. A security guard is a person (which might suggest operational), but guards are classified as physical controls because they physically protect a location.
The key concept: physical controls protect the physical layer of security. Every technical control runs on hardware that sits in a physical location. If an attacker can physically access your server room, your firewall rules don't matter.
Why This Matters for the Exam
Physical controls appear throughout the Security+ exam, not just in control classification questions. You'll see them in:
- •Defense in depth scenarios (physical layer of the security model)
- •Data center security questions
- •Social engineering scenarios (tailgating, piggybacking)
- •Environmental threat questions (fire, flood, HVAC failure)
- •Objective 1.2 questions about physical security mechanisms
The exam expects you to identify physical controls quickly, but also to understand their limitations and how they integrate with other control types. A badge reader on a door is physical—but the access control system deciding who gets in involves technical controls too.
Deep Dive
Common Physical Controls on the Exam
Barriers and Entry Controls
- •Fences — Perimeter boundary (height affects security level)
- •Bollards — Posts preventing vehicle access
- •Locks — Key, combination, or electronic
- •Mantraps/Access Control Vestibules — Two-door entry preventing tailgating
- •Turnstiles — One-person-at-a-time entry control
- •Gates — Controlled vehicle entry points
Surveillance and Detection
- •CCTV/Security cameras — Visual monitoring and recording
- •Motion sensors — Detect movement in secured areas
- •Infrared sensors — Detect body heat
- •Pressure sensors — Detect weight on floors or fences
Access Authentication
- •Badge readers — Card-based entry systems
- •Biometric scanners — Fingerprint, retina, facial recognition hardware
- •Key management systems — Physical key storage and tracking
Environmental Controls
- •HVAC systems — Temperature and humidity control for equipment
- •Fire suppression — Sprinklers, gas-based suppression, fire extinguishers
- •Water detection — Sensors for leaks and flooding
- •EMI shielding — Protection against electromagnetic interference
- •Faraday cages — Block wireless signals
Personnel
- •Security guards — Physical presence monitoring and response
- •Reception desks — Visitor management and access control
- •K-9 units — Detection of explosives, drugs, or intruders
The Physical-Technical Overlap
Many physical controls have technical components. The exam may ask you to identify which part is which:
| System | Physical Component | Technical Component |
|---|---|---|
| Badge access | Card reader, door lock | Access control software, database |
| Camera system | Camera hardware, cables | Video analytics, motion detection software |
| Biometric scanner | Scanner hardware | Pattern matching algorithm |
| Alarm system | Sensors, sirens | Monitoring software, notification system |
When the question focuses on the hardware or physical mechanism, it's physical. When it focuses on the software or automated decision-making, it's technical.
Physical Controls by Type
Physical controls can serve any control function:
• Preventive: Locks, fences, bollards (stop access before it happens) • Detective: Cameras, motion sensors (identify unauthorized access) • Deterrent: Visible cameras, warning signs, guards (discourage attempts) • Corrective: Fire suppression systems (mitigate damage after an event) • Compensating: Guards when badge system is down (substitute control)
How CompTIA Tests This
Example Analysis
Scenario: A data center implements a two-door entry system where visitors must badge into the first door, wait for it to close, then badge into the second door. If both badges don't match the same authorized person, the second door won't open and security is alerted.
Analysis: This describes a mantrap (or access control vestibule), which is a physical control because: • It's a tangible barrier (doors, walls, physical space) • It physically prevents tailgating • It controls physical access to a location
The technical components: The badge readers, the software comparing badge data, and the alert system are technical controls that work with the physical mantrap. But when the question describes the physical structure and its purpose of preventing unauthorized physical access, the answer is physical control.
Control types: This mantrap is: • Preventive — Stops tailgating before it succeeds • Detective — Identifies when badge mismatches occur
Key Terms to Know
Common Mistakes to Avoid
Exam Tips
Memory Trick
"Physical controls exist in PHYSICAL SPACE."
- •Ask yourself: "Does this exist in the real world as a tangible thing protecting a physical location?"
- •Yes → Physical control
- •No → One of the other categories
- •The Touch Test:
- •Can you physically touch it or walk into it?
- •Lock, fence, camera, sensor, guard → Physical
- •Policy document → Managerial
- •Software running on a server → Technical
- •Person reviewing logs → Operational
Environment = Physical: If it protects against fire, flood, heat, cold, or electromagnetic interference, it's physical. Environmental controls protect the physical environment.
Guard Exception: Guards are physical even though they're people. Think of guards as "human barriers" providing physical security presence. Don't confuse them with analysts or admins who are operational.
Test Your Knowledge
Q1.A company installs concrete posts around the building entrance to prevent vehicles from driving into the lobby. What type of control are these posts?
Q2.A security camera records activity in a parking lot. Software analyzes the footage in real-time to detect unauthorized vehicles and alerts security personnel. Which statement correctly identifies the control types?
Q3.During a power outage, the data center's HVAC system fails. Which type of control has failed?
Want more practice with instant AI feedback?
Practice with AIContinue Learning
Ready to test your knowledge?
Practice questions on physical controls and other Objective 1.1 concepts.