Which layer is specifically labeled as the 'Human' or Physical Layer?

Which layer is specifically labeled as the 'Human' or Physical Layer?

• A. Layer 1 - Mission Critical Assets/User Access Management
• B. Layer 4 - Endpoint Security
• C. Layer 7 - The 'Human' or Physical Layer
• D. Layer 2 - Data Security

Answer: (C)

The main idea here is recognizing how this particular security model assigns responsibilities across layers, with human and physical aspects treated as a distinct outer domain. Layer 7 is explicitly labeled as the “Human” or Physical Layer, so selecting that option shows you understand that this framework places people and physical access controls at the top layer of defense, bridging policy, behavior, and physical protections with the rest of the security stack. In concrete terms, this layer focuses on how human factors (awareness, training, policy adherence) and physical safeguards (facility access, hardware protection) interact with cyber defenses. That’s why the option describing Layer 7 as the Human/Physical Layer is the best choice. The other options describe different security domains (mission-critical assets/user access management, endpoint security, data security) which belong to other layers in the model and do not carry the Human/Physical label.

The main idea here is recognizing how this particular security model assigns responsibilities across layers, with human and physical aspects treated as a distinct outer domain. Layer 7 is explicitly labeled as the “Human” or Physical Layer, so selecting that option shows you understand that this framework places people and physical access controls at the top layer of defense, bridging policy, behavior, and physical protections with the rest of the security stack.

In concrete terms, this layer focuses on how human factors (awareness, training, policy adherence) and physical safeguards (facility access, hardware protection) interact with cyber defenses. That’s why the option describing Layer 7 as the Human/Physical Layer is the best choice. The other options describe different security domains (mission-critical assets/user access management, endpoint security, data security) which belong to other layers in the model and do not carry the Human/Physical label.