Detecting Physical Attacks
Prevention buys time; detection catches what slips through. Step into the operations center: place the sensors, read the logs, verify the alerts, and reconstruct a breach from the evidence it leaves behind.
No defense is perfect — so a security team also needs to know when something has gone wrong. Detection controls watch the physical space, raise alerts, and leave a record that defenders can use to verify what happened and track an adversary's path.
But detection only works if it's placed and tuned well. A camera nobody monitors, or a motion sensor in a busy lobby, generates noise instead of signal. This topic is about putting the right control in the right place — and turning its output into a confident answer.
Sense the Space
Cameras, motion sensors, door contacts, alarms, and alert people watch for activity that shouldn't be there.
2.4.A · DetectVerify & Respond
An alert is a question, not an answer. Pair sensors with cameras to confirm a real event before dispatching a response.
2.4.B · PlacementInvestigate
Logs and footage are evidence. Combine sources to reconstruct an incident and trace the adversary's path.
2.4.C · ApplyXtensr Labs is standing up a physical security operations center. As the monitoring lead, you'll decide where cameras and sensors go, how to tell a real alert from noise, and how to turn camera footage and badge logs into a defensible account of what happened during an incident.
AP Learning Objectives
- 2.4.AIdentify ways security controls can detect physical attacks.
- 2.4.BDetermine effective placement of security controls for detecting physical attacks.
- 2.4.CApply detection techniques to identify physical attacks.
Detection is a loop, not a single device: sense an event, raise an alert, verify it with another source, respond, and record the evidence. A control's value depends as much on where it sits and whether anyone is watching as on the hardware itself.
What you'll be able to do: match a detection control to what it detects, place cameras to cover every entry and exit, tune motion sensors to avoid false alarms, read a badge log for signs of tailgating, sort real alerts from noise, and reconstruct a breach timeline from mixed evidence.
The Detection Loop & Smart Placement
Detection isn't passive recording. It's a cycle, and every control in it has a best — and a worst — place to sit.
A camera that only records still helps after an incident, but for the strongest effect a feed should be recorded and monitored. The same idea runs through every control: detection works when an event is sensed, raised as an alert, verified, responded to, and recorded as evidence — then the loop repeats.
Placement decides whether that loop produces signal or noise. Motion sensors belong where traffic is unexpected — a server room or a vault — not a busy lobby, where constant false alarms train people to ignore them. Cameras belong at points of ingress and egress, angled for coverage and mounted out of an adversary's reach. And the best detection pairs sources: a motion alert means little until a camera confirms it.
Diagram · Physical detection loop
Diagram · Sensor placement map
Motion / Contact Sensor Placement Simulator
Lab · Placement (2.4.B)Select a location, then drop it where its best detection control belongs. Watch out — motion sensors in busy areas create false alarms.
Motion sensor
Low-traffic, sensitive areas
Door contact sensor
Entries to protected areas
Avoid motion sensor
High traffic → false alarms
Concept Check
30 secA camera at Xtensr Labs records continuously, but no one ever watches the live feed. Is it useful?
The Detection Toolkit
Eight controls that watch a physical space — what each one detects, and the record it leaves.
| Control | What it detects / records |
|---|---|
| Cameras | Capture a visual record of activity; best when recorded and monitored. Footage tracks an adversary's path after a breach. |
| Motion sensors | Alert security to movement, ideally in areas where motion is unexpected. |
| Door contact sensors | Detect when a door opens; can record how long it stays open. |
| Access logs | Record entry events to a space — who, where, and when. |
| Badge reader logs | Record badge use at each door; a door held open too long can signal tailgating. |
| Security guards | Monitor activity and respond to suspicious behavior once detected. |
| Alarm systems | Sound or signal when a sensor is triggered, prompting verification and response. |
| Visitor logs | Create a record of non-employees entering, useful for accountability and review. |
Detection Control Matcher
Lab · 7 casesFor each detection need at Xtensr Labs, choose the control that fits best.
What the Exam Rewards
This topic is Detect Attacks — skills 3.A (identify monitoring methods and explain how they detect) and 3.B (determine strategies and methods to detect attacks).
Skill 3.A. Name a detection method and explain how it detects — "a door contact sensor logs how long the door stays open, so an unusually long opening flags possible tailgating."
Skill 3.B. Strong answers address placement and pairing: motion sensors in low-traffic sensitive areas, cameras at ingress/egress, and sensors verified by camera before a response.
Common MCQ traps
"Put motion sensors everywhere for safety."
In high-traffic areas they fire constantly. Too many false alarms make staff ignore the real ones.
"A recorded camera is enough."
Recording aids investigation, but for the strongest effect a feed should also be monitored for real-time response.
"An alarm means an attack is confirmed."
An alert is a prompt to verify — pair it with a camera to confirm before dispatching a response.
Analyst note — Xtensr Labs: the badge log shows the Lab A door held open for 41 seconds, against a typical 3–4 seconds. That long opening is a classic indicator of piggybacking/tailgating — a second person slipping in behind a badged employee. Pull the camera at that door to confirm.
False Positive vs True Alert Sorter
Lab · TriageThe SOC queue is filling up. Select each alert and sort it. Placement and timing are your clues — and a credible alert should still be verified on camera.
Likely false alarm
Poor placement / expected traffic
Credible — investigate
Unexpected, then verify on camera
Reconstruct a Physical Breach
The operations center's hardest skill: take scattered evidence and rebuild what happened, in order. This is detection applied (2.4.C).
Diagram · Evidence-to-incident timeline
Physical Breach Timeline Investigator
Lab · Apply (2.4.C)Five pieces of evidence from last night's incident are out of order. Click them in the sequence they logically occurred, then check your reconstruction.
Evidence pool
Reconstructed timeline
Misconceptions That Cost Points
Each is a planted wrong answer. Learn to see the trap.
"More sensors always means better detection."
Bad placement floods the team with false alarms, so real alerts get ignored. Placement beats quantity.
"Cameras prevent attacks."
Cameras are a detective control — they record and reveal activity. Prevention is locks, vestibules, and the like.
"One source is enough to confirm a breach."
Detection is strongest when sources are combined — a motion alert verified by a camera, supported by badge logs.
"Put cameras deep inside, away from doors."
Cameras belong at points of ingress and egress, angled for coverage and mounted out of an adversary's reach.
"A short door-open time is suspicious."
It's the opposite — a door held open far longer than normal is the tailgating signal in entry logs.
"Patrolling guards beat stationary ones everywhere."
It depends on placement: stationary guards suit traffic funnels (entrances, lobbies); patrols suit perimeters.
Placement Rules & Live Tools
Your placement quick-reference, plus two operations-center labs to put it into practice.
| Control | Best placement |
|---|---|
| Cameras | Points of ingress and egress; angled for coverage; mounted out of reach to resist tampering. |
| Motion sensors | Areas with unexpected traffic (server rooms, vaults). Avoid high-traffic areas — false alarms. |
| Door contact sensors | Entries to sensitive areas and emergency exits; flag long or off-hours openings. |
| Stationary guards | Traffic funnels — entry gates, main lobbies, entrances to secure areas. |
| Patrolling guards | Perimeters and exterior areas; harder for an adversary to plan around. |
| Motion + camera pairing | Together — the alert prompts a look, the camera verifies the event. |
Camera Placement Map
Lab · MapPlace cameras to cover every entry and exit plus the server room — without wasting them on blind interior spots. Click a marker on the plan or its label, then evaluate.
Badge Access Log Analyzer
Lab · AnalyzeHere's last night's door log. Read the question, then click the row that answers it.
| # | Time | Badge | Door | Open | Result |
|---|---|---|---|---|---|
| 1 | 08:02 | B-1043 | Lobby | 3s | Granted |
| 2 | 09:15 | B-2210 | Lab A | 4s | Granted |
| 3 | 03:12 | B-1043 | Server room | 5s | Granted |
| 4 | 13:30 | B-3387 | Lab A | 41s | Granted |
| 5 | 13:31 | B-0000 | Lab A | — | Denied |
| 6 | 17:45 | B-2210 | Lobby | 3s | Granted |
Prove the Monitoring Plan
Five AP-style questions with instant feedback, then a snapshot to close out Unit 2.
Mini AP-Style Quiz
Lab · 5 questionsChoose one answer per question, then submit for scored feedback with explanations.
Five Takeaways
Detection is a loop. Sense → alert → verify → respond → record, repeating — not a single device.
Record and monitor. A camera feed should be recorded and watched for the strongest effect.
Placement is everything. Cameras at ingress/egress; motion sensors in low-traffic sensitive areas to avoid false alarms.
Verify, then respond. Pair sensors with cameras; an alert is a question until confirmed.
Logs are evidence. A door open far longer than normal flags tailgating; combine sources to rebuild the timeline.
Final AP exam tip: when asked how a control detects an attack, name the control, say what it senses or records, and explain how that reveals the attack. For placement questions, justify the spot — ingress/egress for cameras, low-traffic sensitive areas for motion sensors — and mention verifying alerts with a second source.
One mistake to avoid: don't treat an alarm as proof. Detection's job is to surface something worth checking; confirming it takes a second source — usually a camera — before anyone responds.
Practice — attempt these now.
AP-style assessments aligned to this lesson. Time them.