CEH Practice Question: Malware, Social Engineering and Network Attacks

An attacker gains physical access to a building by following an authorized employee through a secure door without using a badge. Which social engineering technique is being used?

⚠ Common exam trap

Many exam-takers confuse tailgating with pretexting, as both involve deception, but tailgating is specifically about physical proximity and following someone through a secured entry point without authentication.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Tailgating

Tailgating (also known as piggybacking) is a physical social engineering attack where an unauthorized person follows an authorized individual into a restricted area without presenting their own credentials. The attacker exploits the authorized person's trust or politeness to bypass access control systems such as badge readers or biometric locks. This technique relies on the human factor rather than technical vulnerabilities.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Pretexting
Why it's wrong here
Pretexting invents a fabricated scenario to extract information, usually through conversation or impersonation. Here the attacker simply walks in behind an employee, which is tailgating, requiring no invented story. Pretexting would be correct if the attacker posed as a courier to talk their way past reception.
✓
Tailgating
Why this is correct
Tailgating is following an authorised person through a secured door without presenting credentials, exploiting the person's legitimate badge access. The scenario describes exactly this physical intrusion, where the attacker bypasses the access control by proximity rather than force.
✗
Baiting
Why it's wrong here
Baiting lures a victim with a promised item, such as an infected USB drive left in a car park. Tailgating is the technique here: the attacker follows an authorised employee through the secure door without badging in. Baiting would be correct only if the attacker exploited curiosity about a found device.
✗
Quid pro quo
Why it's wrong here
Quid pro quo offers a service or benefit in exchange for information or access, typically via phone support scams. The scenario describes tailgating: physical entry by following an authorised employee through a door without a badge. Quid pro quo would fit if the attacker traded something, such as fake IT help, for credentials.

Go deeper

CEH Practice Question: Malware, Social Engineering and Network Attacks

Why each option matters

Option-by-option breakdown

Related to this question