312-50V11 · Question #584
A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company`s building dressed like an electrician and
The correct answer is B. Tailgating. The consultant physically followed an authorized employee through a secured access point without presenting his own credentials, which is the definition of tailgating.
Question
A consultant is hired to do physical penetration testing at a large financial company. In the first day of his assessment, the consultant goes to the company`s building dressed like an electrician and waits in the lobby for an employee to pass through the main access gate, then the consultant follows the employee behind to get into the restricted area. Which type of attack did the consultant perform?
Options
- AMan trap
- BTailgating
- CShoulder surfing
- DSocial engineering
How the community answered
(49 responses)- A2% (1)
- B90% (44)
- C2% (1)
- D6% (3)
Why each option
The consultant physically followed an authorized employee through a secured access point without presenting his own credentials, which is the definition of tailgating.
A man trap is a physical security control consisting of two interlocked doors that allow only one person through at a time - it is a countermeasure against tailgating, not an attack technique.
Tailgating (also called piggybacking) is a physical intrusion technique where an unauthorized person exploits the courtesy or inattention of an authorized user to pass through a secured door immediately behind them without using any credential. In this scenario the consultant deliberately positioned himself behind the employee and entered the restricted area by following closely through the access gate, matching the textbook definition of this attack.
Shoulder surfing involves covertly observing a target's screen, keyboard, or PIN pad to steal sensitive information, not physically following someone through a secured doorway.
Social engineering is a broad umbrella term covering many manipulation techniques; tailgating is the specific physical attack demonstrated here and is the more precise and correct answer.
Concept tested: Physical security attack - tailgating and piggybacking
Source: https://csrc.nist.gov/glossary/term/tailgating
Topics
Community Discussion
No community discussion yet for this question.