220-1102 Security Practice Question
An employee is working at their desk when a person wearing a visitor badge and carrying boxes asks the employee to hold the door open so they can enter the secured office area. The employee complies. Which type of security breach has occurred?
⚠ Common exam trap
Test-takers frequently confuse tailgating with shoulder surfing because both involve physical proximity, but tailgating is specifically about unauthorized physical entry by following an authorized person, not about observing information.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tailgating
Tailgating (also called piggybacking) is a physical security breach where an unauthorized person follows an authorized person into a restricted area without proper authentication. In this scenario, the employee holding the door for the person with a visitor badge allows them to bypass the access control system (e.g., a badge reader or PIN pad) that would otherwise require independent verification. This violates the principle of least privilege and the security policy that mandates each individual must authenticate separately.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Shoulder surfing
Why it's wrong here
Shoulder surfing is a form of visual eavesdropping where the attacker observes someone entering passwords, PINs, or other sensitive data by looking over their shoulder or using cameras/mirrors. It does not involve physically following an employee through a controlled door, nor does it grant the attacker any physical access to a restricted area—it only harvests information that may later be used in a separate attack.
- ✓
Tailgating
Why this is correct
Tailgating is a physical social-engineering attack in which an unauthorized person gains entry to a secured facility by closely following an authorized employee through a badge-controlled door, elevator, or turnstile. The attacker exploits common courtesy (holding the door open), distraction, or the employee's assumption that the person behind them is also authorized, thereby bypassing electronic access controls without using their own credentials.
- ✗
Phishing
Why it's wrong here
Phishing is a social-engineering technique that uses deceptive emails, text messages, or fake websites to trick users into revealing credentials, clicking malicious links, or downloading malware. Unlike tailgating, phishing is electronic and typically remote—there is no physical proximity, no following through a doorway, and no direct attempt to bypass a building's physical access control system; its goal is data theft or system compromise, not walking past a badge reader.
- ✗
Dumpster diving
Why it's wrong here
Dumpster diving is the practice of retrieving discarded documents, storage media, or hardware from trash bins to find sensitive information such as account numbers, usernames, or corporate data. It is a physical form of information gathering, but it does not involve trailing an employee into a restricted area in real time; the attacker obtains data offline and must separately use it to attempt unauthorized access, whereas tailgating directly achieves physical entry by following an authorized person.
Go deeper
Related to this question
Learn chapter
Principle of Least Privilege
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 925 original 220-1102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1102 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1102 exam.