Access Control — Entry Points
Perimeter Security
Surveillance & Monitoring
Secure Data Disposal
Physical security isn't just about keeping people out — it's also about ensuring data cannot be recovered from decommissioned hardware. The exam tests specific disposal methods for different media types.
| Method | How It Works | Media Type | Recovery Possible? |
|---|---|---|---|
| Degaussing | Exposes magnetic media to a powerful magnetic field that randomises magnetic domains, erasing all data | HDDs, magnetic tape only — does NOT work on SSDs or optical media | No — permanently destroys data and renders the drive unusable |
| Shredding | Physical destruction — cuts media into small pieces. Industrial shredders handle HDDs, SSDs, optical discs, paper | All media types, paper, credit cards | No — most secure method when done to a fine enough particle size |
| Incineration | Burns media to ash — highest assurance of destruction | All media types | No — complete destruction |
| Secure erase / Wiping | Overwrites all sectors with random data (multiple passes). NIST 800-88 guidelines define standards. DoD 5220.22-M is a common standard. | HDDs (effective). SSDs (less reliable due to wear levelling — physical destruction preferred) | Effectively no for HDDs with proper passes — SSDs may retain data in inaccessible sectors |
| Cryptographic erase | Destroys the encryption key used to encrypt the drive — data becomes permanently inaccessible even though it technically still exists | Self-encrypting drives (SEDs), SSDs with hardware encryption | No — without the key the data is unreadable |
Degaussing only works on magnetic media — HDDs and tape drives. It does NOT work on SSDs, USB drives, CDs/DVDs, or any flash/optical media because those don't use magnetic storage. The exam will try to trick you into choosing degaussing for an SSD — the correct answer for SSD disposal is physical destruction (shredding) or cryptographic erase.
Physical security is most effective when layered — no single control is sufficient. A well-designed facility uses: perimeter controls (fencing, bollards, lighting) → building entry (guards, badge readers, mantrap) → internal zones (additional badge readers, biometrics for server rooms) → detection (cameras, motion sensors, access logs) → response (alarms, guards, incident procedures).
The exam may present a scenario and ask which additional control is most appropriate — think about which layer of defence is weakest and pick the control that fills that gap.
Exam Scenarios
Ready to pass Security+?
See the best courses, practice exams, and study guides for SY0-701.
Layered Physical Security — Defence in Depth Applied to Space
Physical security follows the same defence-in-depth principle as cybersecurity — multiple overlapping controls so that an attacker who defeats one layer still faces additional barriers. A well-designed physical security architecture has concentric rings: perimeter security (fencing, vehicle barriers, lighting), building access (badge readers, security guards, visitor logs), internal zones (separate badge access for different floors or departments), server room access (biometric + badge + PIN, mantrap entry), and equipment-level security (cable locks, rack locks, chassis intrusion detection). An attacker who tailgates through a door at the perimeter still needs to defeat building access, internal zone access, and server room access before reaching critical equipment.
The exam tests this layered approach primarily through scenario questions: a company wants to prevent unauthorised physical access to their server room. What controls should they implement? The answer typically involves multiple layers — not just one control. A badge reader alone is defeated by tailgating; adding a mantrap prevents tailgating by ensuring only one person can enter at a time.
Access Control Vestibules (Mantraps)
An access control vestibule (commonly called a mantrap) is a physical security control consisting of a small room with two interlocked doors — the first door must close and lock before the second door can open. This prevents tailgating (an unauthorised person following an authorised person through a secured door). Mantraps are used at the entrance to high-security areas like server rooms, datacenter floors, and secure research facilities. Some implementations include biometric verification in the vestibule itself, weighing the occupant to confirm only one person is present, or video monitoring with security guard oversight.
The distinction between tailgating and piggybacking: tailgating is when an unauthorised person follows an authorised person through a door without the authorised person's knowledge or consent. Piggybacking is when the authorised person knowingly holds the door open for or allows an unauthorised person to enter — effectively a social engineering attack that exploits courtesy and authority. Both are physical security violations; mantraps address tailgating mechanically but piggybacking requires security awareness training to address.
Data Destruction Methods — What the Exam Tests
Physical security extends to how data is destroyed when storage media is retired. CompTIA tests specific destruction methods and when each is appropriate. Shredding physically destroys the storage media (shredded hard drives, SSDs, optical discs) — appropriate for media that must be completely destroyed and cannot be reused. Degaussing exposes magnetic storage (HDDs, magnetic tape) to a powerful magnetic field that scrambles all data — effective for traditional hard drives but does not work on SSDs, USB drives, or optical media (which are not magnetic). This distinction is a common exam question.
Overwriting (wiping) writes patterns of data (zeros, ones, or random data) over all sectors of a drive. Multiple-pass overwriting (like the DoD 5220.22-M standard specifying 7 passes) is considered sufficient for most purposes. However, overwriting is not appropriate for highly classified or sensitive data — physical destruction is required. Also, overwriting HDDs with bad sectors may miss data in those sectors; again, physical destruction is the only guarantee. Incineration (burning) is the highest level of destruction, used for classified media that must be completely rendered unreadable under any circumstance.
On the exam: a company needs to dispose of old hard drives containing financial records. They want to reuse the drives. What method is appropriate? Overwriting (wiping). They don't want to reuse them and want complete assurance? Shredding or incineration. They have old magnetic tape backups? Degaussing. The method depends on media type, sensitivity level, and whether reuse is required.
Environmental Controls in Physical Security
Datacenters and server rooms require environmental controls that are themselves a form of physical security — protecting equipment from environmental threats. Temperature monitoring and cooling (HVAC) prevents hardware failure from overheating; most server equipment operates safely at 65–80°F (18–27°C). Humidity controls prevent static electricity buildup (too dry) and condensation damage (too humid); target range is 40–60% relative humidity. Fire suppression in server rooms uses clean agent systems (FM-200, Halon alternatives, NOVEC 1230) rather than water sprinklers — water destroys servers. Hot aisle/cold aisle rack arrangement directs cool air to server intake faces and exhausts hot air to the rear, dramatically improving cooling efficiency.
UPS (Uninterruptible Power Supply) protects against power loss and power quality issues. A UPS provides battery backup that keeps servers running during brief outages and filters power fluctuations (voltage sags, surges, spikes) that can damage hardware. Generator backup extends protection for longer outages. The exam tests UPS as a physical security and availability control — know that UPS prevents data corruption from sudden power loss and gives systems time to shut down gracefully.