N10-009 Question 269
Single answerSocial engineering: Phishing, Dumpster diving, Shoulder surfing, TailgatingA network administrator notices several unusual events in one week: a visitor followed an employee through a badge-controlled door without scanning a card, a printed spreadsheet containing user phone numbers was found in an unlocked recycling bin, and an employee reported seeing someone glance repeatedly at their screen while they entered VPN credentials in the lobby. Which incident is the clearest example of tailgating?
- A
A visitor entering a secured area by walking in behind an employee who opened the door with a badge
- B
A printed spreadsheet with sensitive information being recovered from an unlocked recycling bin
- C
An attacker watching an employee type VPN credentials on a laptop in a public area
- D
An employee receiving an email that appears to be from IT asking them to verify their password
Show answer and explanation
Correct answer: A
Explanation
The key distinction in this scenario is the method used by the attacker. Tailgating is a physical security breach in which an unauthorized person enters a restricted area by closely following someone with legitimate access. Dumpster diving involves retrieving sensitive information from discarded materials, shoulder surfing involves visually observing confidential information, and phishing relies on deceptive electronic communication. Network+ objectives commonly expect candidates to differentiate among social engineering techniques and identify the most appropriate term based on a practical scenario. Security best practices from common organizational security policies and guidance such as NIST awareness training recommendations emphasize preventing tailgating through badge enforcement, visitor escort requirements, employee awareness, and physical access controls.
- A. Correct.
Correct. Tailgating occurs when an unauthorized person gains physical access to a restricted area by following an authorized user through a secured entrance. This is a common physical social engineering technique that relies on politeness, distraction, or inattention rather than technical exploitation.
- B. Incorrect.
Incorrect. This describes dumpster diving, not tailgating. Dumpster diving involves searching discarded materials for useful or sensitive information such as phone lists, diagrams, account details, or internal documents. A candidate might choose this if they are focusing on the exposed information rather than the access method.
- C. Incorrect.
Incorrect. This is shoulder surfing. Shoulder surfing involves observing someone as they enter credentials or access sensitive data, often in public or semi-public places. It is a social engineering risk, but it does not involve unauthorized entry through a physical access control point.
- D. Incorrect.
Incorrect. This describes phishing. Phishing uses fraudulent messages, commonly email, to trick users into revealing credentials, opening malicious links, or downloading malware. It is a social engineering attack, but it is not related to bypassing a locked entrance.