Which of the following is not one of the rules for working in secure areas?

• A. Unsupervised work in secure areas should be avoided.
• B. When no one is in a secure area, it should be locked and verified periodically.
• C. No one should be allowed to work in secure areas for more than four hours in a row.
• D. Electronic devices that can record or copy mass amounts of information should be forbidden in secure areas.

Answer: (C)

The main idea here is physical security in secure areas: you control who enters, monitor activity, and prevent sensitive information from being exposed or copied. In practice, the rules focus on ensuring someone is always accountable, the area isn’t left unattended, and devices that could copy or leak data aren’t allowed inside.

The statement about not allowing anyone to work in secure areas for more than four hours in a row is not a typical security control. Security policies usually address who can access the area, what happens when no one is present (lock and verify), and what kinds of devices are permitted or forbidden to prevent data leakage. They don’t usually prescribe a fixed time limit for how long someone can stay in a secure area—that kind duration rule is more about labor or fatigue management than securing the area itself.

Why the other rules fit: avoiding unsupervised work reduces the chance of improper actions going unnoticed; locking the area when no one is present and performing periodic checks helps maintain control and detect any tampering; forbidding recording or copying devices minimizes the risk of mass data exfiltration. So the four-hour limit isn’t drops in line with these typical protective measures, making it the not-a-rule in this context.