Which measures protect against unauthorized access to network devices and services?

Which measures protect against unauthorized access to network devices and services?

• A. Biometric access controls only
• B. Controlled Areas, Entry Controlled Points, DD Form 2875 (SAAR)
• C. Public networks with strong passwords
• D. Password policies alone

Answer: (B)

Protecting access to network devices and services requires layered controls that address both physical and procedural aspects. Controlled areas and entry-controlled points physically restrict who can get near the equipment and the space housing networks, servers, and other critical devices, reducing the risk of tampering or theft. The DD Form 2875 (SAAR) formalizes who is allowed to access the systems, documenting authorization, roles, and security requirements so that access is granted through a verified process and can be reviewed. Together, these measures provide both a secure physical environment and a documented, controlled access process, which is essential for preventing unauthorized use or tampering. The other options fall short because they focus on a single aspect (biometrics, passwords) or on defenses that don’t address the need to control both the location of equipment and formal system access.

Protecting access to network devices and services requires layered controls that address both physical and procedural aspects. Controlled areas and entry-controlled points physically restrict who can get near the equipment and the space housing networks, servers, and other critical devices, reducing the risk of tampering or theft. The DD Form 2875 (SAAR) formalizes who is allowed to access the systems, documenting authorization, roles, and security requirements so that access is granted through a verified process and can be reviewed.

Together, these measures provide both a secure physical environment and a documented, controlled access process, which is essential for preventing unauthorized use or tampering. The other options fall short because they focus on a single aspect (biometrics, passwords) or on defenses that don’t address the need to control both the location of equipment and formal system access.