Comprehensive and Detailed Step-by-Step Explanation with all IIA References:

Understanding Physical Security Controls:

Physical security controls are measures that protect physical assets from unauthorized access, theft, or damage.

These include locks, security cameras, guards, and restricted access areas.

Why Secured Servers with Locks is Correct:

Locking system servers ensures that only authorized personnel can physically access them, protecting data from theft or tampering.

This aligns with best practices in IT security by safeguarding critical infrastructure.

Why Other Options Are Incorrect:

A. Transaction logs → This is a logical security control, not a physical one.

B. Strong passwords and access controls → These are technical security controls, not physical.

C. Failed login attempt analysis → This is an audit/logging control, which helps detect incidents but does not physically protect assets.

IIA Standards and References:

IIA GTAG on Information Security (2016): Recommends physical access controls for IT assets.

IIA Standard 2110 – Governance: Ensures IT security includes physical protections.

NIST Cybersecurity Framework: Identifies physical access control as a key protection measure.

Thus, the correct answer is D: System servers are secured by locking mechanisms with access granted to specific individuals.