Which statement best defines access control and its three categories?

• A. A device that detects intrusions automatically.
• B. A system to grant/deny entry; administrative (policies), procedural (work practices), physical (locks, barriers).
• C. A security protocol for data encryption.
• D. A process for monitoring staff attendance.

Answer: (B)

Access control is about regulating who can access resources and under what circumstances. The best statement captures this by describing a system to grant or deny entry and by breaking it into three areas: administrative, procedural, and physical. Administrative controls set the rules—policies, roles, and permissions that determine who should have access to which resources. Procedural controls put those rules into practice through day-to-day work practices and processes that enforce access decisions. Physical controls are the tangible barriers and devices that enforce access in the real world, such as locks, barriers, and access systems. The other options describe functions that aren’t about controlling entry to resources: intrusion detectors focus on detecting breaches, encryption protocols secure data rather than control access, and attendance monitoring tracks people rather than managing who may access resources.