Which of the following can be used to physically restrict employees from accessing a datacenter?

An access badge is a physical token that must be presented to a card reader to unlock a door, directly restricting which employees can enter a datacenter. It operates as both a physical and logical control - without the badge in hand, entry is denied. This makes it the most direct answer for physically restricting access.

A password is a knowledge-based logical control that authenticates users in software systems, not a mechanism that physically blocks entry to a space.

A mantrap is a physical access control structure (a double-door vestibule), but it is a facility design element that enforces restriction rather than a credential used to restrict employees - it works in conjunction with badges.

A PIN is a knowledge-based credential that can be entered by anyone who knows it, making it a logical control rather than a physical one tied to a specific individual.