A physical penetration tester needs to get inside an organization's office and collect sensitive information without acting suspiciously or being noticed by the security guards. The tester has observe

Shoulder surfing is an information gathering technique, not a method for gaining physical access to a building.

Call spoofing is a social engineering method conducted over the phone, unrelated to gaining physical entry into an office.

Employees leaving their badges on the table provides an opportunity for badge stealing. A stolen badge can then be used to bypass physical access controls like ticket gates, especially if the gate primarily relies on visual verification or allows tailgating.

Tailgating (or piggybacking) involves following an authorized individual through a secure entry point without using one's own credentials. Since the ticket gate does not scan badges, a tester can easily walk in behind an employee who has legitimately entered, making it a very low-risk method for gaining physical access.

Dumpster diving is an information gathering technique involving searching through trash, not a method for directly gaining physical access.

Email phishing is a social engineering method conducted via email, unrelated to gaining physical entry into an office.