220-1102 Question 437
Single answerTailgatingA technician arrives at a company office and uses her badge to enter a secure server room. As the door closes, a person wearing business-casual clothes and carrying a laptop says, "My badge isn't working today-can you hold the door for me?" The technician does not recognize the person, and company policy requires individual badge access for the server room. What should the technician do FIRST?
- A
Hold the door open because the person appears to be an employee and is carrying company equipment
- B
Allow the person in if they can state the name of their manager and department
- C
Politely refuse entry, ask the person to use their own badge or contact security, and report the incident according to policy
- D
Let the person enter, but stay with them the entire time so they are not unattended
Show answer and explanation
Correct answer: C
Explanation
This scenario tests recognition and response to tailgating, a physical security and social engineering threat covered in A+ Core 2 security objectives. Tailgating happens when one person follows an authorized individual into a restricted area without completing the required authentication step. Best practice is to enforce physical access controls consistently: each person must badge in individually, and suspicious or noncompliant attempts should be directed to security or the approved identity verification process. In real environments, organizations commonly document these requirements in physical security policies, visitor management procedures, and access control standards. The key applied concept is that convenience, familiarity, or informal verbal verification should not override badge-based access controls for sensitive spaces such as server rooms.
- A. Incorrect.
This is incorrect because appearance and possession of equipment are not valid authentication methods for a restricted area. Tailgating occurs when an unauthorized person gains physical access by following an authorized user through a secured entrance. Assuming legitimacy based on appearance is a common social engineering mistake.
- B. Incorrect.
This is incorrect because verbal claims such as a manager's name or department do not satisfy physical access control requirements. Someone attempting unauthorized entry could easily obtain or guess this information. Secure areas that require badge access should enforce that control consistently.
- C. Correct.
This is correct because the safest and policy-aligned response is to prevent tailgating by requiring the individual to authenticate with their own badge or go through the proper access recovery process, such as contacting security or the front desk. Reporting the incident is also appropriate because attempted policy bypasses in secure areas should be documented and handled through established procedures.
- D. Incorrect.
This is incorrect because escorting someone into a restricted area without proper authentication still bypasses the access control system. Even if the technician remains present, the person has entered without authorization. This weakens physical security and can violate company policy and audit requirements.