Physical Security
113 cards · 8 sections
Sections▾
Physical Security (OBJ 1.2 & 2.4)
Physical Security
Measures taken to protect tangible assets — buildings, equipment, and people — from harm or unauthorized access. Complements logical/digital security; an attacker who gains physical access can bypass many technical controls entirely.
Bollard
A short, sturdy vertical post designed to control or prevent vehicle access to an area or structure. Used as a perimeter control to stop ramming attacks against building entrances.
Fence
A barrier made of posts and wire or boards erected to enclose a space or separate areas. First line of perimeter defence — delays and deters unauthorized entry on foot.
Surveillance System
An organized strategy or setup designed to observe and report activities within a given area. Components: video surveillance (CCTV), security guards, lighting, and sensors.
Access Control Vestibule (Mantrap)
A double-door system where two electronically controlled doors ensure only one can be open at a time. Prevents piggybacking and tailgating by forcing one-person-at-a-time entry into a secure area.
Piggybacking
Two people working together — one with legitimate access intentionally allows another without access to enter a secure area with them. Consent is given by the authorized party. Distinguished from tailgating by the element of consent.
Tailgating
An unauthorized person follows closely behind an authorized person through an access control vestibule without their knowledge or consent. No cooperation from the authorized party — purely opportunistic physical intrusion.
Flipper Zero
A portable multi-tool for physical penetration testing. Can clone RFID and NFC access badges used in electronic access control systems, enabling an attacker to gain unauthorized entry using a replicated credential.
RFID / NFC Access Badge
Radio Frequency Identification (RFID) and Near-Field Communication (NFC) based credentials used in modern electronic access control systems. Vulnerable to cloning attacks using tools like the Flipper Zero without physical theft of the badge.
Exam Objectives Covered — Domain 1 and Domain 2
This section maps to two specific objectives:
- Obj 1.2 — Summarise fundamental security concepts: physical security controls and tools
- Obj 2.4 — Given a scenario, analyze indicators of malicious activities: physical attacks against security controls
4 Physical Brute Force Attack Types
The exam tests recognition of physical brute force attack methods — know all four:
- Forcible entry — breaking through doors, windows, or barriers using physical force
- Tampering with security devices — disabling or manipulating cameras, sensors, or locks
- Confronting security personnel — directly engaging or overpowering guards
- Ramming a barrier with a vehicle — using a vehicle to breach perimeter controls (countered by bollards)
Physical Security — Outside-In Defence Model
Defence is layered from the perimeter inward. Exam scenarios may describe which layer was breached:
- Perimeter — fencing, bollards, lighting
- Building entry — access control vestibules, door locks, security guards
- Internal access — badge systems, biometric locks, cipher locks
- Data/equipment — logical controls, server room physical locks
Piggybacking vs Tailgating — The Key Difference
Piggybacking = authorized person knowingly lets someone in (consent present). Tailgating = unauthorized person slips through without the authorized person's knowledge (no consent). The access control vestibule mitigates both by enforcing one-person-at-a-time entry.
Piggybacking vs Tailgating — consent is the exam discriminator
Scenario: 'an employee held the door open for a visitor who didn't badge in' → Piggybacking (consent given). Scenario: 'an attacker slipped through behind an employee before the door closed' → Tailgating (no consent). Both are defeated by an access control vestibule (mantrap).
Bollard = vehicle ramming countermeasure
If the scenario describes a physical perimeter control specifically designed to stop vehicle-based attacks → Bollard. Do not confuse with fencing, which stops foot traffic but not vehicles.
Access control vestibule = mantrap — same thing
The exam may use either term. Both refer to the double-door airlock system that allows only one person at a time. Primary purpose: prevent piggybacking and tailgating.
Badge cloning ≠ badge theft
RFID/NFC cloning duplicates the credential without stealing the physical card — the legitimate user still has their badge. If a scenario describes an attacker gaining access using a duplicated credential while the real badge is still with its owner → badge cloning attack.
Fencing & Bollards
Fence (Physical Security)
A structure enclosing an area using interconnected panels or posts. Materials range from wire mesh and chain link to steel and concrete. Purposes: visual deterrent, physical barrier, and intruder delay — buying time for security personnel to respond.
Bollard (Physical Security)
A short, robust vertical post made of steel or concrete that manages or redirects vehicular traffic. Can be permanent or temporary. Primary use: prevent vehicle-based attacks (ramming, IED delivery) against buildings and pedestrian areas.
Ram Raiding
A physical attack where a criminal drives a vehicle directly through a storefront or building entrance to enable rapid theft and escape. Countered by bollards placed in front of the target.
ASTM F2656-07 M30 P1
A bollard crash-resistance rating standard. M30 P1 means the bollard can stop a 15,000-pound vehicle travelling at 30 mph and prevent it from advancing more than one metre past the bollard after impact.
3 Security Functions of Fencing
The exam may ask what purpose a fence serves — know all three:
- Visual deterrent — defines a boundary that unauthorized personnel should not cross
- Physical barrier — prevents or significantly impedes unauthorized entry
- Intruder delay — slows attackers, giving security personnel time to respond
Fence Attack Vectors and Countermeasures
Three ways attackers defeat fences, and the fix for each:
- Climbing over — counter with increased height, electrification, or razor/barbed wire on top
- Cutting through — counter with more robust materials (steel, concrete) or monitoring systems
- Digging under — counter by extending the fence underground or burying mesh wire along the fence line
Fence vs Bollard — Different Threats, Different Controls
The exam tests which control addresses which threat type — they are not interchangeable:
- Fence — protects large perimeters; counters unauthorized foot traffic and trespassing
- Bollard — counters vehicular threats in a specific area; stops ramming and IED delivery vehicles
Bollard Attack Vectors and Countermeasures
Two ways attackers defeat bollards:
- Direct vehicle impact — counter with bollards rated to appropriate ASTM crash standards (e.g. M30 P1)
- Tampering or removal — counter by using permanent fixed installations rather than temporary/removable designs
Fence = people threat; Bollard = vehicle threat
The single most-tested distinction: fences stop foot traffic, bollards stop vehicles. Scenario: 'what control prevents a vehicle from driving into a building entrance?' → Bollard, not fence.
Bollard placement purpose = keep vehicles outside blast radius
In anti-terrorism scenarios, bollards are placed to ensure a vehicle-borne IED cannot get close enough to cause structural damage. The goal is distance, not just blocking entry. If a scenario mentions IED or vehicle bomb risk → Bollard is the answer.
Fence delay value = time for security to respond
The exam may ask why a fence is valuable even if it can eventually be defeated. The answer is delay — every extra minute the attacker spends defeating the fence is time for security personnel to detect and respond to the intrusion.
Decorative bollards are still bollards
Exam scenarios may describe planters, decorative balls, or architectural features in front of buildings. If they are described as preventing vehicle access, they are functioning as bollards regardless of appearance. Recognise function, not form.
Attacking with Brute Force (OBJ 2.4)
Brute Force (Physical Security)
A direct, often violent attack method that gains access by physically overcoming barriers rather than bypassing them covertly. Covers forcible entry, tampering with security devices, confronting security personnel, and vehicle ramming.
Forcible Entry
Gaining unauthorized access by physically breaking or bypassing barriers — windows, doors, or fences. Methods include shattering glass, glass cutting, kicking in doors, battering rams, or breaking locks.
Glass Cutting
An advanced forcible entry technique where an attacker cuts a large opening in a window pane to create a walk-through entry point, avoiding the noise of shattering glass. Countered by reinforced or laminated glass.
4 Physical Brute Force Attack Types
The exam lists all four — know each type, its method, and its countermeasure:
- Forcible Entry — breaking windows, doors, or fences to gain access
- Tampering with Security Devices — forcing gates open, blinding cameras, smashing sensors/alarms
- Confronting Security Personnel — distraction, assault, or weapons to overpower guards
- Ramming a Barrier with a Vehicle — using a car or truck to breach fences, gates, or building walls
Forcible Entry — Targets and Countermeasures
Three common targets and their specific countermeasures:
- Windows — use reinforced or laminated glass to resist shattering and glass cutting
- Doors — weakest point is the lock; use deadbolt locks, solid core doors, and metal frames
- Fences — susceptible to climbing, cutting, or ramming; use robust materials, electrification, buried mesh, or barbed wire
Tampering with Security Devices — Methods and Countermeasure
Three tampering methods and the one overarching defence:
- Gates forced open — wedged or held open with an object to bypass access control
- Cameras/sensors blinded — paint sprayed on lens, bright lights, or mirrors redirecting the field of view
- Alarms/sensors smashed — physically destroyed to disable detection
- Countermeasure: redundancy — multiple overlapping layers so compromising one does not disable all detection
Confronting Security Personnel — Countermeasures
Two core mitigations:
- Rigorous training in conflict resolution and self-defence
- Rapid communication capability — radio or panic button to call for backup and alert others of a breach
The weakest point of a door is its lock — not the door itself
Exam may ask where forcible entry attacks focus on doors. The answer is the lock — most brute force door attacks break or remove the lock rather than destroying the door. Countermeasure: deadbolt lock + solid core door + metal frame (all three together).
Redundancy = the countermeasure for tampered security devices
When the scenario describes an attacker disabling a camera or alarm before breaching, the control that would have detected or prevented this is redundant/overlapping security layers. If one device is disabled, another still covers the area.
Vehicle ramming countermeasure = bollards, not fencing
Fences can be rammed down by vehicles. The specific countermeasure for vehicle-based brute force attacks is bollards — designed to absorb and dissipate vehicle impact energy. Scenario: 'truck drove through the perimeter fence' → bollards should have been in place, not a stronger fence.
Brute force in physical security ≠ brute force in cybersecurity
In cybersecurity, brute force = trying all password combinations. In physical security, brute force = direct physical force to overcome barriers. The exam may test both contexts — identify which domain the scenario is describing before selecting an answer.
Surveillance Systems (OBJ 1.2)
CCTV — Closed Circuit Television
The standard term for video surveillance systems. Classified as a detective control. Available in wired (physically cabled to monitoring station) and wireless (Wi-Fi signal) versions, and as indoor or outdoor models.
PTZ — Pan-Tilt-Zoom
A camera feature that allows an operator at a monitoring station to remotely move the camera left/right (pan), up/down (tilt), and adjust magnification (zoom). Used in manned monitoring environments where a guard actively watches and directs the camera.
Infrared Sensor
Detects changes in infrared radiation emitted by warm bodies (humans, animals). Triggers when a person enters the detection zone. Most effective in low-light or dark conditions where visual detection is difficult.
Pressure Sensor
Activates when a specified amount of weight is detected on a floor-embedded sensor or mat. Used to detect unauthorized entry into restricted areas or to alert when someone enters a space.
Microwave Sensor
Emits microwave pulses and measures their reflection off moving objects to detect movement. Can cover large areas but is prone to false alarms due to high sensitivity settings.
Ultrasonic Sensor
Measures the reflection of ultrasonic waves off moving objects — operates similarly to bat echolocation. Commonly used in automated doors and indoor movement detection systems.
4 Categories of Surveillance Systems
The exam tests all four components — know each and what it provides:
- Video Surveillance (CCTV) — real-time visual monitoring and recorded footage for post-incident review; detective control
- Security Guards — flexible, can respond immediately, make judgment calls, and provide a visual deterrent
- Lighting — enhances video quality, eliminates hiding spots, and deters attackers; motion-activated lighting serves as both deterrent and alert
- Sensors — automated detection devices covering areas cameras and guards cannot continuously monitor
4 Sensor Types — Detection Method and Use Case
Know how each sensor detects and where it is best applied:
- Infrared — detects body heat; best for low-light/dark environments
- Pressure — detects weight on floor/mat; best for restricted access points
- Microwave — detects movement via pulse reflection; covers large areas; high false alarm risk
- Ultrasonic — detects movement via sound wave reflection; used in automated doors and indoor environments
Wired vs Wireless CCTV — Security Trade-off
Wired: physically cabled — more reliable, cannot be jammed. Wireless: Wi-Fi signal — easier to install but vulnerable to wireless interference and deliberate jamming attacks during physical intrusions.
Camera Placement Priorities
Always cover entrances and exits to critical infrastructure first:
- Data centres — primary target for physical intrusion
- Communications closets — network infrastructure access points
- Building entrances and exits — lobbies, back doors, loading docks
CCTV = Detective Control
Cameras detect and record — they do not prevent entry. They support post-incident investigation and provide real-time alerting when integrated with motion detection or AI analysis. The exam classifies CCTV explicitly as a detective control, not a preventive one.
CCTV = detective control, NOT preventive
If the exam asks which control type surveillance cameras represent → Detective. Cameras observe and record; they do not stop an attacker from entering. To prevent entry, use access control vestibules, locks, or guards — not cameras.
Wireless cameras can be jammed — wired cannot
Scenario: 'an attacker used a signal jammer to disable the security cameras before breaching the perimeter' → wireless CCTV vulnerability. Wired CCTV is immune to wireless jamming. If physical security must be tamper-resistant, wired is the more secure choice.
Infrared sensor = low-light detection; Microwave = large area but false alarms
Exam scenario matching: 'sensor that detects intruders in complete darkness' → Infrared. 'Sensor covering a wide open area but triggers frequently without cause' → Microwave. Know the weakness of each sensor type, not just its function.
PTZ = manned monitoring station; fixed camera = unmanned/recorded
PTZ cameras require a human operator to direct them in real time. Fixed cameras record autonomously. If a scenario describes a guard actively controlling camera angles → PTZ. If the scenario describes reviewing recorded footage → fixed CCTV.
Bypassing Surveillance Systems (OBJ 1.2)
Visual Obstruction
Blocking a camera's line of sight to prevent it from recording. Methods include spray painting or foaming over the lens, placing stickers or tape on the lens, or positioning objects (balloons, umbrellas) in front of the camera.
Electromagnetic Interference (EMI)
Jamming the radio frequency signals that wireless surveillance systems use to communicate. EMI generators or jammers can take down an entire wireless surveillance setup. Wired systems are immune to EMI attacks.
Tamper Alarm
A countermeasure built into surveillance cameras that alerts security personnel when someone physically interferes with or attempts to disable the camera. Detects obstruction, repositioning, or physical damage.
Uninterruptible Power Supply (UPS)
Backup power system that keeps surveillance equipment operational during a power-based attack. Counters attacks that target the main power supply — unplugging devices, tampering with power boxes, or sabotaging local transformers.
Frequency Hopping
An encrypted signal technique where surveillance systems rapidly switch between radio frequencies. Guards against jamming and eavesdropping attacks by making it difficult for an attacker to target a fixed frequency.
5 Methods Attackers Use to Bypass Surveillance
The exam tests attack types against physical security controls — know all five:
- Visual obstruction — spray paint, foam, stickers, tape, or objects placed in front of the camera lens
- Blinding sensors and cameras — high-powered flashlights or lasers aimed at the lens; heating a room to blind infrared sensors
- Interfering with acoustics — loud music/sounds to drown out audio cues; jamming devices to disrupt microphone frequencies; white noise machines to mask sounds
- Interfering with electromagnetics (EMI) — jamming wireless surveillance signals; targeting specific frequency bands (e.g. Wi-Fi); effective only against wireless systems
- Attacking the physical environment — temperature manipulation to trick infrared sensors; cutting power (unplugging, tampering with power boxes, sabotaging transformers); physical wire cutting; arson (extreme, classified as criminal)
3 Countermeasures Against Surveillance Bypass
Modern systems include these protective measures — know what each counters:
- Tamper alarms — alert security when cameras are physically interfered with
- Backup power / UPS — counters power-based attacks that attempt to cut surveillance offline
- Encrypted frequency hopping — counters jamming and eavesdropping on wireless surveillance signals
Acoustic vs EMI Attacks — Different Targets
Acoustic attacks target sound-based sensors (microphones, acoustic detectors) using noise, jammers, or white noise. EMI attacks target wireless communication signals between cameras and monitoring stations. Confusing the two will cost marks.
EMI jamming = wireless camera attack; wired cameras are immune
Scenario: 'an attacker used an EMI generator before entering the building and all cameras went offline' → wireless CCTV was in use. If the scenario asks which camera type is resistant to EMI → wired CCTV. EMI cannot affect physically cabled systems.
Heating a room = infrared sensor bypass
Scenario: 'an attacker raised the ambient temperature of the room before breaching to avoid triggering sensors' → infrared sensor bypass. Infrared detects body heat relative to ambient temperature — if the room is as warm as the body, the sensor cannot distinguish the intruder.
Power attack countermeasure = UPS
Scenario: 'what control prevents an attacker from disabling surveillance by cutting power to the building?' → UPS / backup power supply. Tamper alarms detect physical camera interference; UPS counters power-based attacks.
Frequency hopping = anti-jamming countermeasure
Scenario: 'which technology prevents an attacker from jamming wireless surveillance signals?' → Encrypted frequency hopping. This is the specific countermeasure for EMI/jamming attacks against wireless systems — not encryption alone, not wired — frequency hopping.
Physical wire cutting = requires proximity — high risk for attacker
Wire cutting and physical device disabling are effective but require the attacker to be close to the device, increasing their exposure. The exam may use this to contrast with EMI jamming, which can be done from a distance.
Access Control Vestibules (OBJ 1.2 & 2.4)
Access Control Vestibule
A double-door system where two electronically controlled doors ensure only one can open at a time. The space between the doors serves as a controlled checkpoint where identity is verified before entry to the secure area is granted.
Piggybacking
An authorized individual intentionally allows an unauthorized person to enter a secure area with them — often through social engineering or impersonation (e.g., posing as a delivery driver). Involves complicity or negligence by the authorized person.
Tailgating
An unauthorized person covertly follows an authorized individual through an access control point without their knowledge or consent. Opportunistic and does not require the cooperation of the authorized person. Also called piggybacking in some contexts — the exam distinguishes them.
Access Badge
An electronic credential that authenticates the holder's identity and validates their access privileges for a specific area. Embedded with RFID, NFC, or magnetic strip technology to communicate with badge readers.
RFID — Radio Frequency Identification
A contactless technology embedded in access badges that communicates with readers when held close. Eliminates the need to swipe — the badge is read when in proximity to the reader.
NFC — Near-Field Communication
A short-range contactless technology used in modern access badges. Operates similarly to RFID but at a shorter range. Often used in smartphones for tap-to-pay — the same principle applies to badge readers.
How an Access Control Vestibule Works — Step by Step
Process the exam may test as a scenario:
- Person approaches and enters through the outer door
- Outer door locks behind them — person is now trapped in the intermediate space
- Identity or credentials are verified (badge, biometric, PIN, guard check)
- If verification succeeds — inner door unlocks and access is granted
- If verification fails — person remains in vestibule until security personnel intervene
Piggybacking vs Tailgating — Key Distinction
Both result in unauthorized access but differ in intent and awareness:
- Piggybacking — authorized person knowingly (or negligently) allows the attacker in; involves social engineering or impersonation
- Tailgating — authorized person is unaware; attacker sneaks through behind them without consent
- Access control vestibules prevent both by physically allowing only one person at a time
3 Access Badge Technologies — Old to New
Know the three credential types embedded in access badges:
- Magnetic strip — legacy; must be swiped through a reader; same technology as credit card backs
- RFID — contactless; held near the reader; longer read range than NFC
- NFC — contactless; very short range tap; used in modern badges and smartphones
Role-Based Badge Access and Audit Trails
Access badges are programmed per role — an employee may access their department but not others, even within the same building. Every badge scan is logged, creating an audit trail reviewable after a security incident.
Multi-Layer Physical Security Model
Access control vestibules work best when combined with: access badges (automated authentication), security guards (visual deterrent, verification fallback, visitor management, immediate response). Each layer compensates for the other's gaps.
Piggybacking = attacker has help; Tailgating = attacker acts alone
The single most-tested distinction: piggybacking involves an authorized person who knowingly (or through negligence) allows entry — social engineering is the enabler. Tailgating is covert — the authorized person never knows. If the scenario mentions an employee holding the door open for someone → piggybacking, not tailgating.
Access control vestibule = preventive control against tailgating/piggybacking
Scenario: 'what physical control prevents an attacker from following an employee into a secure area?' → Access control vestibule (mantrap). Note: CCTV is detective; the vestibule is preventive. Correct control type is critical for multiple-choice elimination.
Mantrap is another name for access control vestibule
The exam uses both terms. 'Mantrap' is the older term; 'access control vestibule' is the current CompTIA-preferred term. If you see either on the exam, they refer to the same double-door controlled-entry system.
Access badge audit trail = accountability (the A in AAA)
Every badge scan is logged. This links access control vestibules to the Accounting/Accountability pillar of AAA. Scenario: 'what provides a record of who accessed the server room and when?' → Access badge logs / audit trail.
RFID/NFC badge cloning = physical security attack vector
RFID and NFC credentials can be cloned if an attacker gets close enough with a reader. This is a badge cloning attack (OBJ 2.4). The access control vestibule controls the door; badge cloning defeats the badge itself — two separate attack surfaces.
Door Locks (OBJ 1.2)
Door Lock
A physical security control that secures entryways by restricting access to a space. Acts as a primary barrier ensuring only individuals with the correct key, code, or access method can enter. Applied on building entrances, server room doors, and network closets.
Cipher Lock
A mechanical locking mechanism with numbered push buttons requiring the correct combination to open. No electronics — purely mechanical. Commonly used on server rooms, network closets, and high-security locations. Costs more than a standard lock but offers higher protection.
False Acceptance Rate (FAR)
The rate at which a biometric system incorrectly authenticates an unauthorized user as valid — grants access to someone who should be denied. To reduce FAR, increase scanner sensitivity.
False Rejection Rate (FRR)
The rate at which a biometric system incorrectly denies access to an authorized user. Increasing scanner sensitivity to reduce FAR will simultaneously increase FRR — the two rates have an inverse relationship.
Crossover Error Rate (CER) / Equal Error Rate (EER)
The point at which FAR equals FRR. Used as the standard measure of biometric system effectiveness — the lower the CER, the better the system. CER and EER are the same metric; both terms appear on the exam.
Biometrics
Authentication using a person's physical characteristics — fingerprint, retina, facial recognition, voice. Classified as the 'something you are' (inherence) factor in the five factors of authentication.
Door Lock Types — Weakest to Strongest
Know each type, its mechanism, and its defeat time:
- Padlock — pin and tumbler mechanism; defeated in ~15 seconds with a lock pick and tension wrench
- Basic interior lock (bedroom/bathroom) — defeated instantly with a slender rod through the hole
- Traditional key lock (front door) — defeated in 30–60 seconds using standard lock picking techniques
- Electronic PIN lock — 8-digit PIN = 1 in 100 million guessing odds; supports per-user logging for audit/accounting
- Wireless signal lock — NFC, Wi-Fi, Bluetooth, RFID; authentication via smartphone or access token
- Biometric lock — fingerprint, retina, facial recognition; 'something you are'; supports per-user audit trail
- Cipher lock — mechanical push-button combination; no electronics; high security; used in server rooms and network closets
FAR vs FRR — The Sensitivity Trade-off
Sensitivity and error rates move in opposite directions — always tested as a scenario:
- Increase sensitivity → FAR decreases (fewer unauthorized people get in) but FRR increases (more authorized people get locked out)
- Decrease sensitivity → FRR decreases (fewer authorized people rejected) but FAR increases (more unauthorized people accepted)
- Goal: find the Crossover Error Rate (CER) — the balance point where FAR = FRR
3 Biometric Types — Factor Classification
All three are 'something you are' (inherence factor) — not 'something you have' or 'something you know':
- Fingerprint — Touch ID on iPhone 5s through 8; embedded in laptops and door locks
- Facial recognition — Face ID on iPhone 10+; measures distances between facial features
- Retinal scan — used in high-security facilities; scans inside the eye
Multi-Factor Authentication on Door Locks
Electronic locks can combine factors for stronger access control:
- PIN + fingerprint = something you know + something you are
- Badge + PIN = something you have + something you know (standard turnstile/vestibule setup)
- Both combinations satisfy MFA requirements for physical access control
Electronic PIN Lock — Audit Trail
Each user is assigned their own unique PIN. Every entry and exit is logged with user identity and timestamp, creating an audit trail for accounting and access review purposes — same accountability principle as access badges.
CER / EER = same thing — lower is better
The exam uses both terms interchangeably. CER (Crossover Error Rate) and EER (Equal Error Rate) both refer to the point where FAR = FRR. If a scenario asks 'which biometric system is most effective?' → the one with the lowest CER. This is the single most-tested biometric metric.
Increasing sensitivity reduces FAR but raises FRR — inverse relationship
Scenario: 'after tuning the fingerprint scanner to maximum sensitivity, authorized employees are frequently denied entry' → FRR increased as a side effect of reducing FAR. The exam tests whether you understand this trade-off, not just the definition of each rate.
Biometrics = something you are (inherence) — not something you have
Common distractor: biometric devices are physical objects (a scanner), which might seem like 'something you have'. The answer is always 'something you are' because it is the biological characteristic being read, not the device doing the reading.
Cipher lock = mechanical, not electronic
Scenario: 'which door lock provides high security with no electronic components and no power dependency?' → Cipher lock. Do not confuse with electronic keypad locks which require power. Cipher locks are purely mechanical push-button combination locks.
Padlock = weakest control — 15 seconds to defeat
If the exam describes a network closet or filing cabinet secured with a padlock → flag it as a weak control. Padlocks use a basic pin and tumbler system that any skilled attacker can pick in under 15 seconds. Never use a padlock to protect sensitive equipment or classified information.
Door locks = preventive control (not detective)
Door locks prevent unauthorized entry — they are a preventive control. Cameras are detective. If a scenario asks 'which control prevents access to the server room?' → door lock (or access control vestibule). If it asks 'which control detects unauthorized entry?' → cameras or alarms.
Access Badge Cloning (OBJ 2.4)
Access Badge Cloning
Copying the data from an RFID or NFC access badge onto another card or device so it behaves identically to the original. The attacker never needs to keep the original badge — the clone is sufficient to bypass authentication.
Flipper Zero
A compact, multi-protocol pen testing tool commonly used for RFID and NFC badge cloning. Can scan, store multiple badge codes, and emulate them — more versatile than a single cloned card. Widely used in physical penetration testing.
RFID Shielding Wallet / Sleeve
A physical countermeasure that blocks RFID and NFC scanners from reading a badge while it is stored inside the wallet or sleeve. Prevents passive scanning attacks where the attacker reads the badge without physical contact.
4 Steps of Access Badge Cloning
The exam may test recognition of each step in the attack sequence:
- Scanning — attacker uses a portable RFID/NFC reader to capture badge data without physical contact; NFC range: 1–2 inches; RFID range: 2–10 inches
- Data extraction — attacker extracts the authentication credentials (unique identifier or encrypted data) from the captured data; can be done offline after scanning
- Writing to a new card or device — extracted data is transferred to a blank RFID/NFC card or stored on a device like a Flipper Zero for emulation
- Using the cloned badge — attacker presents the clone to the reader and gains access as if they were the authorized employee
6 Countermeasures Against Badge Cloning
Know all six — the exam tests both the attack and its mitigations:
- Advanced encryption — encrypt badge data with strong algorithms so captured data cannot be replicated without the key
- Multi-factor authentication (MFA) — combine badge with a PIN, password, or biometric; a cloned badge alone is not enough to gain access
- Regularly update security protocols — rotate encryption keys and authentication mechanisms to limit the usable lifespan of any cloned badge
- User education — train staff to guard badge proximity, report suspicious behavior, and be aware of where they store their cards
- RFID shielding wallets or sleeves — physical barrier that prevents passive scanning while the badge is stored
- Monitor and audit access logs — detect anomalies such as simultaneous access attempts from the same badge in different locations (impossible travel)
Impossible Travel — Anomaly Detection for Cloned Badges
If a cloned badge is used while the original badge holder is in a different location, access logs will show the same badge used in two places at once. This 'impossible travel' pattern is the primary detection method for active badge cloning in the wild.
RFID vs NFC — Cloning Range Comparison
Both are clonable but differ in proximity required:
- NFC — 1 to 2 inches standard range; up to ~4 inches with a stronger antenna
- RFID — 2 to 10 inches standard range; up to ~20 inches with a stronger antenna
- RFID is the higher risk for passive scanning attacks due to its longer read range
Badge cloning does not require possession of the original badge
Key distinction: the attacker scans the badge passively (no theft required) and discards the data after cloning. The victim never knows their badge was cloned. If the scenario says 'the attacker never stole the badge but gained access' → badge cloning.
MFA defeats badge cloning — badge alone is not enough
Scenario: 'what single control best prevents a cloned RFID badge from being used to enter the building?' → MFA (badge + PIN or badge + biometric). Encryption makes cloning harder; MFA makes a successful clone useless. Both are correct answers depending on the question — MFA is the stronger mitigation.
RFID shielding = preventive; access log monitoring = detective
Shielding wallets prevent the scan from occurring — preventive control. Auditing access logs to catch impossible travel detects a clone already in use — detective control. Know which control type each countermeasure represents.
Flipper Zero = RFID/NFC cloning tool for pen testing
If the exam describes a compact device that can read, store, and emulate multiple RFID or NFC badges → Flipper Zero. It is the reference tool for this attack vector. It is also used for other RF attacks (sub-GHz, infrared) but in physical security context, badge cloning is the primary association.
Badge cloning = OBJ 2.4 physical attack — not a network attack
Badge cloning is classified under physical attacks (OBJ 2.4), alongside tailgating and brute force. It does not involve network access or software exploitation. If a scenario describes bypassing a door reader without breaking it → badge cloning, not hacking.