Which of the following questions is less likely to help in assessing physical access controls?

A.
Does management regularly review the list of persons with physical access to sensitive
facilities?

B.
Is the operating system configured to prevent circumvention of the security software and
application controls?

C.
Are keys or other access devices needed to enter the computer room and media library?

D.
Are visitors to sensitive areas signed in and escorted?