Vulnerability Discovery and Analysis · Topic 5 of 5
Physical Security Concepts
Understand physical security concepts the PenTest+ exam names: tailgating, site surveys, USB drops, badge cloning and lock picking, with their defences.
- 4 min
- A site survey is observation of entrances, cameras, guards and badge readers before entry.
- Tailgating follows an authorised person through a door, and a vestibule is the main control.
- Lock picking and bypass need explicit written permission.
What it is
Physical security is about controlling who can reach equipment, media and people in person. A tester who can walk into a building, plug in a device or read a badge can bypass most network controls, so the exam includes a short set of physical concepts.
This page explains the named concepts, what a tester would look for, and the controls that stop each one. Any physical activity needs explicit approval in the rules of engagement because it carries legal and safety risk.
How it works
Site surveys
A site survey is structured observation of a location before any entry attempt. The tester notes entrances and exits, camera positions, guard patrols, badge readers, fence lines and where wireless signals reach outside the building.
The survey builds a picture of weak points, much as passive reconnaissance does online. It is low risk because it involves watching rather than acting, but it should still stay within the agreed scope and respect privacy.
Entry techniques
| Concept | Idea | Control |
|---|---|---|
| Tailgating (piggybacking) | Following an authorised person through a secured door without using a credential | Access control vestibule, single-person entry, staff awareness |
| Lock picking or bypass | Opening a mechanical lock or defeating a latch without the key | Higher-grade locks, electronic access, alarms, guards |
| Badge cloning | Copying a radio-frequency identification (RFID) or proximity credential, which is easiest on older low-frequency cards | Encrypted higher-frequency cards, shielding sleeves, prompt revocation |
Lock picking and similar bypass methods need specific written permission, because they can damage property and may be illegal without it. Badge cloning shows why proximity credentials should use modern, encrypted cards rather than simple low-frequency ones.
USB drops
A universal serial bus (USB) drop leaves unattended USB devices where staff will find them, relying on curiosity to make someone plug one in. It tests both human behaviour and technical device controls.
The defences are a mix of training and technology: teach staff never to connect found devices, disable automatic running of inserted media, restrict or block USB ports through endpoint policy, and allow only approved devices.
Linking physical and digital
Physical access often leads straight to a network foothold, a cloned badge, a recorded password or a planted device. For that reason physical findings belong in the same report, with the same severity reasoning, as technical ones. The defences combine barriers, detection such as video surveillance, and trained people.
Physical testing can lead to confrontation with staff or police, so carry the authorisation letter and emergency contact at all times and stop if anyone is at risk.
What to remember for the exam
- A site survey is observation of entrances, cameras, guards and badge readers before entry.
- Tailgating follows an authorised person through a door, and a vestibule is the main control.
- Lock picking and bypass need explicit written permission.
- Badge cloning copies proximity credentials, easiest on low-frequency cards.
- USB drops test curiosity, countered by training, disabled autorun and port control.
- Physical access can bypass strong network controls.
- Video surveillance and guards are detective physical controls.
- All physical activity requires authorisation and an authorisation letter on site.
Common mistakes
Treating physical findings as out of scope for the report. They lead to digital compromise and deserve the same reporting.
Assuming all badges are equal. Older low-frequency proximity cards are far easier to clone than modern encrypted ones.
Forgetting autorun and port policy. A USB drop succeeds far more often when endpoints run inserted media automatically.
Picking locks without permission. This can be illegal and cause damage, so it needs explicit sign-off.
Skipping the site survey. Acting without observation raises the chance of detection and mistakes.
Check yourself
What is a site survey?
Structured observation of a location, such as entrances, cameras, guards and badge readers, before any entry attempt.
Which control best counters tailgating?
An access control vestibule that allows one person through at a time, with staff awareness.
Why are some proximity badges easy to clone?
Older low-frequency cards transmit a simple identifier without encryption, so it can be copied.
Topic 5 of 5 in Vulnerability Discovery and Analysis
Test yourself on Vulnerability Discovery and Analysis
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.