nerdexam
EC-Council

312-50V11 · Question #584

A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company`s building dressed like an electrician and

The correct answer is B. Tailgating. The consultant physically followed an authorized employee through a secured access point without presenting his own credentials, which is the definition of tailgating.

Social Engineering

Question

A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company`s building dressed like an electrician and waits in the lobby for an employee to pass through the main access gate, then the consultant follows the employee behind to get into the restricted area. Which type of attack did the consultant perform?

Options

  • AMan trap
  • BTailgating
  • CShoulder surfing
  • DSocial engineering

How the community answered

(49 responses)
  • A
    2% (1)
  • B
    90% (44)
  • C
    2% (1)
  • D
    6% (3)

Why each option

The consultant physically followed an authorized employee through a secured access point without presenting his own credentials, which is the definition of tailgating.

AMan trap

A man trap is a physical security control consisting of two interlocked doors that allow only one person through at a time - it is a countermeasure against tailgating, not an attack technique.

BTailgatingCorrect

Tailgating (also called piggybacking) is a physical intrusion technique where an unauthorized person exploits the courtesy or inattention of an authorized user to pass through a secured door immediately behind them without using any credential. In this scenario the consultant deliberately positioned himself behind the employee and entered the restricted area by following closely through the access gate, matching the textbook definition of this attack.

CShoulder surfing

Shoulder surfing involves covertly observing a target's screen, keyboard, or PIN pad to steal sensitive information, not physically following someone through a secured doorway.

DSocial engineering

Social engineering is a broad umbrella term covering many manipulation techniques; tailgating is the specific physical attack demonstrated here and is the more precise and correct answer.

Concept tested: Physical security attack - tailgating and piggybacking

Source: https://csrc.nist.gov/glossary/term/tailgating

Topics

#tailgating#physical penetration testing#social engineering#access control

Community Discussion

No community discussion yet for this question.

Full 312-50V11 Practice