A biometric lock can support both physical and logical access control because biometric characteristics may be used to restrict entry to secure areas and authenticate users to information systems. Biometrics rely on something the person is, such as fingerprint, facial recognition, retina pattern, or hand geometry. An identification card primarily supports physical identification or card access and can be lost, shared, or stolen.
An electromechanical lock is mainly physical. A plenum is a building air-handling space and is not an access- control device. Internal auditors should evaluate biometric enrollment, template storage, false acceptance risk, privacy requirements, fallback procedures, and revocation controls. Because biometrics can control both facility and system access, Option B is correct.