CompTIA PenTest+ (PT0-003)Vulnerability Discovery and AnalysisEasy
During an on-site physical security assessment, a tester follows closely behind an employee who badges into a secured server room, entering without presenting their own credentials or being challenged. Which social engineering technique does this describe?
- AVishing
- BDumpster diving
- CShoulder surfing
- DTailgating
Show answer & explanationAnswer & explanation
Correct answer: D. Tailgating
Tailgating (also called piggybacking) is the act of following an authorized person through a secured entry point without independently authenticating. Vishing is voice-based phishing, dumpster diving is searching discarded trash for sensitive information, and shoulder surfing is observing someone entering credentials.
Why the other options are wrong
- A. Vishing involves phone-based social engineering, not physical entry.
- B. Dumpster diving involves searching trash for information, unrelated to this scenario.
- C. Shoulder surfing involves observing input like PINs or passwords, not following through a door.
Tailgating (Piggybacking)
A physical social engineering technique where an unauthorized person follows an authorized individual through a secured access point without independently authenticating.
- Also called piggybacking
- Exploits courtesy/social norms (holding doors)
- Mitigated by mantraps and badge enforcement policies
Memory trick: Tail the badge, Clone the badge, Pick the lock, Dive the trash, Peek the screen