Physical and logical controls lab

Match vestibule, bollards, password+TOTP MFA, and PAM/JIT to four security tickets; leave password+PIN and camera-only unused.

Match physical and logical controls to each ticket. Leave the two knowledge-factor and camera-only distractors unused.

Four tickets: clinic tailgating, vehicle ramming, SaaS MFA, and standing Domain Admin. Pick the CompTIA V15 control that fits each threat — factor types must differ for MFA, and cameras do not lock doors.

Clinic badge-door tailgate

Unauthorized visitor walks in behind a nurse through a single reader. Stop the follow-through.

Data-center lobby ram risk

Facilities wants to stop a car from driving through the glass facade — not a pedestrian policy.

SaaS HR login hardening

CEO password alone reached payroll from a coffee shop. Need real multifactor, not two knowledge secrets.

Standing Domain Admin habit

Help desk logs into every ticket as Domain Admin all day. Shrink standing privilege without removing break-glass.

Controls still on the bench

Access control vestibule (two-door airlock) — Inner door stays locked until the outer door closes and the occupant is authorized — defeats tailgating.
Bollards / engineered planters at the curb — Stops a vehicle from ramming the glass lobby; does nothing to a walker.
Password + authenticator-app TOTP (know + have) — Two different factor types. Password + PIN is still one knowledge factor.
PAM / just-in-time privileged role checkout — Time-boxes Domain Admin instead of a standing always-on admin logon.
Password plus mother's maiden name / PIN — Two knowledge factors — not MFA. The exam treats factor types, not 'two secrets.'
Lobby camera with no door interlock — Cameras record and deter; they do not lock the next person out after a badge open.