AP Cybersecurity Drill 5: Physical Security Observations

Question 1. At 08:05, a person enters behind a badged employee without badging. What is this behavior called?

• A) Tailgating ✓
• B) Phishing
• C) Shoulder surfing
• D) Spoofing

Explanation: Choice A is correct. Following a badged person through a door without badging in is tailgating. Choice B is incorrect. Phishing is a deceptive message that tricks a user, not a physical entry behavior. Choice C is incorrect. Shoulder surfing is watching someone enter secret information, which is the 08:20 event, not this one. Choice D is incorrect. Spoofing is faking an identity or address electronically, not walking in behind someone.

Question 2. The 08:20 observation, in which a visitor watches an employee type the door PIN and repeats it aloud, is an example of which weakness?

• A) Tailgating through a controlled door
• B) A denial-of-service condition affecting the door entry system
• C) Shoulder surfing of an entered credential ✓
• D) A buffer overflow in the door system

Explanation: Choice C is correct. Watching someone enter a secret such as a PIN and capturing it is shoulder surfing. Choice A is incorrect. Tailgating is following someone through a door, which is the 08:05 event. Choice B is incorrect. A denial-of-service condition blocks a service's availability and has nothing to do with watching a PIN. Choice D is incorrect. A buffer overflow is a software memory attack, unrelated to observing a PIN entry.

Question 3. Which single observation most clearly defeats the purpose of the badge reader for the longest period of time?

• A) The visitor at 08:20 watching the employee and then repeating the door PIN code aloud
• B) The door left propped open with a chair, unattended, for about 30 minutes at 08:41 ✓
• C) The person at 08:05 tailgating in closely behind a badged employee without badging in
• D) The delivery driver at 09:10 who was buzzed in by staff after showing only a clipboard

Explanation: Choice B is correct. A door propped open for about 30 minutes lets anyone enter unbadged for that whole window, defeating the badge reader far longer than the brief, single-person events. Choice A is incorrect. Shoulder surfing the PIN is serious but is a momentary observation, not a sustained open door. Choice C is incorrect. Tailgating admits one extra person once, not a 30-minute gap. Choice D is incorrect. Buzzing in a driver is a single supervised entry, not a prolonged bypass.

Question 4. Why is the 08:41 propped-open door a serious risk even though every employee at the lab has a valid badge?

• A) The propped door means entries during that window are not recorded, but the only harm is to the log
• B) A propped-open door is really only a concern after hours at night, not during busy business hours
• C) Once the door is propped, anyone entering still has to badge in at a second interior door anyway
• D) An open door lets unauthorized people enter with no record, removing access control for that time ✓

Explanation: Choice D is correct. While the door is propped, anyone can walk in without badging and without being recorded, so access control is effectively removed for that period regardless of employee badges. Choice A is incorrect. The harm is unauthorized physical entry, not merely a gap in the log. Choice B is incorrect. An open door is a risk whenever it is open, including busy daytime hours. Choice C is incorrect. The stimulus describes one controlled door, not a second interior checkpoint that would contain the risk.

Question 5. Which control would most directly address the tailgating seen at 08:05?

• A) Install an access control vestibule or turnstile that admits only one badged person at a time ✓
• B) Require noticeably longer and more complex passwords for all of the employees' computer accounts
• C) Add a separate guest Wi-Fi network in the lobby for visitors who are waiting to be escorted inside the lab
• D) Encrypt the files stored on the lab's internal servers

Explanation: Choice A is correct. An access control vestibule or turnstile physically admits one badged person per entry, which directly stops a second person from slipping in behind. Choice B is incorrect. Longer passwords address account security, not physical tailgating. Choice C is incorrect. A guest Wi-Fi network does nothing about who walks through the door. Choice D is incorrect. Encrypting server files protects data at rest, not the entrance.