Which control is NOT listed as part of monitoring and controls for infrastructure?

• A. Regular software patching of endpoint devices
• B. Video surveillance
• C. Electronic access control
• D. Retention of video and logs for forensics

Answer: (A)

Monitoring and controls for infrastructure focus on physical security and the ability to observe and investigate activity around facilities. Video surveillance provides visibility of what’s happening in and around infrastructure. Electronic access control determines who can reach sensitive areas, helping prevent unauthorized entry. Retaining video and logs supports forensic investigations by preserving evidence of incidents. Regular software patching of endpoint devices, while essential for maintaining IT security and reducing vulnerabilities, is a software maintenance activity aimed at endpoint systems rather than a monitoring or control measure for physical infrastructure. It targets the IT layer, not the physical monitoring and access controls of infrastructure.