Data center physical security is built in layers. Which order runs from the outside in?

Perimeter fence and gate, building entry, data hall entry, cage or cabinet lock

Data hall, building entry, perimeter, cabinet

Cabinet lock, cage, lobby, perimeter

Lobby, perimeter, cabinet, data hall

What is a mantrap (access control vestibule) designed to prevent?

Tailgating and piggybacking, by letting only one authorized person through at a time

Fire and smoke spreading between rooms

Dust and contaminants entering the data hall

Unauthorized logins to the corporate network

A vendor technician arrives to service a CRAH but is not on the access list. What is the correct practice?

Verify the visit with the requester, check ID, log them in, badge them, and escort them throughout

Let them in, since they have a company uniform and a signed work order

Lend them a staff badge for the day so they can move around freely

Give them the door code and ask them to sign out when they finish

Which list matches the five AICPA Trust Services Criteria used in SOC 2 reports?

Security, availability, processing integrity, confidentiality, and privacy

Identify, protect, detect, respond, and recover

Confidentiality, integrity, availability, authentication, and authorization

Plan, do, check, act, and improve

Which statement about ISO/IEC 27001 is correct?

It is an international standard for an information security management system, and organizations can be certified against it

It is a U.S. federal law that protects health information

It is the AICPA standard for attestation reports

It rates data center redundancy from level 1 to level 4

In PCI DSS, what does Requirement 9 cover?

Restricting physical access to cardholder data

Encrypting cardholder data sent over public networks

Installing and maintaining network security controls such as firewalls

Running regular penetration tests

Which of these is a HIPAA Security Rule physical safeguard?

Facility access controls, workstation security, and device and media controls

A risk analysis and workforce security training

Encrypting data sent over the internet

Why do data centers run periodic access reviews?

To confirm each person's access is still needed and remove access for people who left or changed roles

To check that badge readers and door controllers have fresh batteries

To count how many visitors entered the building during the quarter

To give everyone the same access level so the system is simpler to run

A failed hard drive held customer data. What is the accepted way to handle it?

Keep it under chain of custody until it is sanitized or destroyed, with a destruction record

Put it in the regular e-waste bin with other failed parts

Reformat it and resell it through an IT asset reseller

Ship it back to the manufacturer under warranty without wiping it

When does EPA's SPCC rule (40 CFR Part 112) generally apply to a data center?

When aboveground oil storage exceeds 1,320 U.S. gallons and a spill could reach navigable waters or shorelines

Whenever the site has any generator, no matter how much fuel it stores

Only when the site stores refrigerant cylinders in a mechanical room

Only when the site sits directly on an ocean coastline

Quiz · Security & Compliance

Data Center Security & Compliance Quiz

Ten questions on how data centers control who gets in and how auditors check it, from mantraps to SOC 2 and PCI DSS. Each answer comes with a short explanation.

10 questions About 5 minutes Intermediate

Question 1Data center physical security is built in layers. Which order runs from the outside in? Data hall, building entry, perimeter, cabinet Perimeter fence and gate, building entry, data hall entry, cage or cabinet lock Cabinet lock, cage, lobby, perimeter Lobby, perimeter, cabinet, data hall

Show answer
Answer: perimeter, building, data hall, cabinet. Each layer delays and detects an intruder and needs its own authorization, so one failed control does not expose the equipment. Cameras, guards, and alarms back up every layer. Read the security and compliance guide.
Question 2What is a mantrap (access control vestibule) designed to prevent? Fire and smoke spreading between rooms Dust and contaminants entering the data hall Unauthorized logins to the corporate network Tailgating and piggybacking, by letting only one authorized person through at a time

Show answer
Answer: tailgating and piggybacking. A mantrap has two interlocked doors, and the second will not open until the first has closed. Many add a second factor such as biometrics, or sensors that detect more than one person inside. Access Control & Physical Security covers entry design.
Question 3A vendor technician arrives to service a CRAH but is not on the access list. What is the correct practice? Let them in, since they have a company uniform and a signed work order Lend them a staff badge for the day so they can move around freely Verify the visit with the requester, check ID, log them in, badge them, and escort them throughout Give them the door code and ask them to sign out when they finish

Show answer
Answer: verify, log, badge, and escort. Visitors are checked against a scheduled request, identified, logged, badged, and escorted at all times inside controlled areas. Sharing badges or codes breaks the audit trail that SOC 2, ISO/IEC 27001, and PCI DSS assessors look for. Data Center Physical Security and Access Control Training covers visitor handling.
Question 4Which list matches the five AICPA Trust Services Criteria used in SOC 2 reports? Security, availability, processing integrity, confidentiality, and privacy Identify, protect, detect, respond, and recover Confidentiality, integrity, availability, authentication, and authorization Plan, do, check, act, and improve

Show answer
Answer: security, availability, processing integrity, confidentiality, and privacy. Security is included in every SOC 2 report, and the other criteria are added when they fit the service; data centers often include availability. Option b lists functions from the NIST Cybersecurity Framework. Security & Compliance for Data Centers covers SOC 2 audits.
Question 5Which statement about ISO/IEC 27001 is correct? It is a U.S. federal law that protects health information It is the AICPA standard for attestation reports It rates data center redundancy from level 1 to level 4 It is an international standard for an information security management system, and organizations can be certified against it

Show answer
Answer: it is the international ISMS standard. Accredited certification bodies audit and certify organizations against ISO/IEC 27001. Its Annex A controls include physical security, such as secure perimeters, entry controls, equipment protection, and secure disposal. Security & Compliance for Data Centers compares the frameworks.
Question 6In PCI DSS, what does Requirement 9 cover? Encrypting cardholder data sent over public networks Restricting physical access to cardholder data Installing and maintaining network security controls such as firewalls Running regular penetration tests

Show answer
Answer: restricting physical access to cardholder data. Requirement 9 covers facility entry controls, visitor handling, and the protection and destruction of media. In a colocation facility, the provider often covers part of it for customers, which is documented in a responsibility matrix. Read the security and compliance guide.
Question 7Which of these is a HIPAA Security Rule physical safeguard? A risk analysis and workforce security training Unique user IDs and audit logs Facility access controls, workstation security, and device and media controls Encrypting data sent over the internet

Show answer
Answer: facility access, workstation, and device and media controls. Physical safeguards are listed in 45 CFR 164.310. Risk analysis and training are administrative safeguards, and user IDs, audit logs, and transmission security are technical safeguards. Security & Compliance for Data Centers covers HIPAA requirements.
Question 8Why do data centers run periodic access reviews? To confirm each person's access is still needed and remove access for people who left or changed roles To check that badge readers and door controllers have fresh batteries To count how many visitors entered the building during the quarter To give everyone the same access level so the system is simpler to run

Show answer
Answer: to remove access that is no longer needed. Reviews compare access lists against HR records and customer authorizations, and access for people who are no longer authorized is a classic audit finding. Terminations should be removed right away, not at the next review. Data Center Physical Security and Access Control Training covers access governance.
Question 9A failed hard drive held customer data. What is the accepted way to handle it? Put it in the regular e-waste bin with other failed parts Reformat it and resell it through an IT asset reseller Keep it under chain of custody until it is sanitized or destroyed, with a destruction record Ship it back to the manufacturer under warranty without wiping it

Show answer
Answer: chain of custody, then sanitize or destroy. NIST SP 800-88 describes clear, purge, and destroy methods, and degaussing works only on magnetic media, not SSDs. Many customers require that drives never leave the site intact. Security & Compliance for Data Centers covers media handling.
Question 10When does EPA's SPCC rule (40 CFR Part 112) generally apply to a data center? Whenever the site has any generator, no matter how much fuel it stores When aboveground oil storage exceeds 1,320 U.S. gallons and a spill could reach navigable waters or shorelines Only when the site stores refrigerant cylinders in a mechanical room Only when the site sits directly on an ocean coastline

Show answer
Answer: above 1,320 gallons aboveground, with a path to water. Bulk diesel tanks, generator day tanks, and oil-filled transformers of 55 gallons or more count toward capacity. The Spill Prevention, Control, and Countermeasure plan covers containment, inspections, training, and spill response. Facility Environmental Compliance covers SPCC plans.