Study guide
9.4 Physical Security Concepts for PenTests
CompTIA PenTest+ PT0-003
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
1.1 Current PT0-003 Exam Facts 1.2 Format, PBQs, Scoring, and Retake Policy 1.3 Recertification, CEUs, and Career Fit
2 Pre-Engagement Planning
2.1 Scope, Rules of Engagement, and Agreements 2.2 Target Selection and Assessment Types 2.3 Shared Responsibility, Legal Authorization, and Ethics
3 Collaboration, Frameworks, and Threat Modeling
3.1 Collaboration, Escalation, and Stakeholder Communication 3.2 Testing Frameworks and Methodologies 3.3 Threat Modeling: STRIDE, DREAD, and OCTAVE
4 Reporting and Remediation
4.1 Penetration Test Report Components 4.2 Findings Analysis and Remediation Recommendations
5 Information Gathering
5.1 Active vs Passive Reconnaissance 5.2 OSINT Sources and Techniques 5.3 DNS, Certificate Transparency, and Search Engine Enumeration 5.4 Network Recon, Protocol Scanning, Sniffing, and Banner Grabbing
6 Enumeration Techniques
6.1 OS Fingerprinting, Service Discovery, and Host Discovery 6.2 DNS, Directory, Share, and Account Enumeration 6.3 Secrets, Permissions, and Wireless Enumeration 6.4 WAF Enumeration, Web Crawling, and Attack Path Mapping
7 Recon Scripting and Tools
7.1 Modifying Bash, Python, and PowerShell for Recon 7.2 Recon and Enumeration Tools
8 Vulnerability Scan Types
8.1 Network, Host, Authenticated, and Wireless Scans 8.2 SAST, DAST, IAST, SCA, IaC, and Mobile Scans 8.3 Container, Secrets, and ICS Vulnerability Assessment 8.4 Core Vulnerability Scanners (Nessus, OpenVAS, Nikto)
9 Scan Analysis and Physical Security
9.1 Specialized Discovery Tools 9.2 Validating Scan, Recon, and Enumeration Results 9.3 Public Exploit Selection and Scripted Validation 9.4 Physical Security Concepts for PenTests
10 Attack Prioritization and Preparation
10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS 10.2 Exploit Selection, Customization, and Attack Documentation
11 Network Attacks
11.1 On-Path, VLAN Hopping, Relay, and Multihomed Hosts 11.2 Default Credentials, Misconfigured Services, Packet Crafting, and Certificate Services
12 Authentication Attacks
12.1 Pass-the-Hash, Pass-the-Ticket, Pass-the-Token, and Kerberos Attacks 12.2 Password Attacks, MFA Fatigue, LDAP Injection, OIDC, and SAML
13 Host-Based Attacks
13.1 Privilege Escalation and Credential Dumping 13.2 Process Injection, Security Bypass, and Host Attack Tools
14 Web Application Attacks
14.1 SQL, Command, XSS, and SSTI Injection 14.2 CSRF, SSRF, Deserialization, IDOR, and Directory Traversal 14.3 LFI/RFI, Web Shells, API Abuse, JWT, and Session Hijacking
15 Cloud Attacks
15.1 IAM Misconfiguration, Metadata Service, and Exposed Storage 15.2 Container Escape, Supply Chain, and Cloud Attack Tools
16 Wireless and Social Engineering
16.1 Wireless Attacks and Tools 16.2 Phishing, Spearphishing, Whaling, Vishing, and Smishing 16.3 Physical Social Engineering and SE Tools
17 Specialized Systems
17.1 Mobile Attacks and AI Prompt/Model Attacks 17.2 OT/ICS, NFC, RFID, and Bluetooth Attacks
18 Attack Scripting and BAS
18.1 PowerShell, Python, and Bash Attack Automation 18.2 Breach and Attack Simulation (Caldera, Infection Monkey, Atomic Red Team)
19 Persistence
19.1 Scheduled Tasks, Services, Accounts, and Shells 19.2 C2, Backdoors, Rootkits, and Security-Control Tampering
20 Lateral Movement
20.1 Pivoting, Relays, and Additional Credential Capture 20.2 Remote Services: SMB, RDP, WinRM, WMI, SSH, and Others 20.3 Lateral Movement Tools and LOLbins
21 Exfiltration and Cleanup
21.1 Staging and Exfiltration 21.2 Cleanup, Restoration, and Artifact Preservation
9.4 Physical Security Concepts for PenTests
Key Takeaways Explain This Topic AI
PT0-003 objective 3.3 still tests physical techniques: tailgating, site surveys, USB drops, badge cloning, and lock picking.
Tailgating is following an authorized person through a controlled door without that person’s cooperation; piggybacking is when the person knowingly holds the door.
A site survey happens before physical testing so cameras, doors, docks, and badge readers are known rather than improvised on the night.
USB drops, badge cloning, and lock picking require explicit physical-test scope; a USB drop without authorization is a crime, not a finding.
Network rules of engagement do not authorize walking into a building, cloning a prox card, or picking a server-cage lock.
Last updated: August 2026
Objective 3.3 Explain physical security concepts is short, still on the exam, and easy to skip because Domain 3 otherwise looks like Nessus and Kubernetes. CompTIA lists five bullets: tailgating , site surveys , USB drops , badge cloning , and lock picking . None of them is implied by a network CIDR in the SoW. They require explicit physical-test scope : named buildings, hours, whether law enforcement and facilities have been notified, and which of the five techniques are allowed. A tester who clones a badge during a purely remote web test has not found a vulnerability. They have committed a crime.
Physical work also has safety and legal risk for the tester: security officers, local trespass law, and possession rules for lock picks vary by jurisdiction. The authorization letter exists partly so you are not treated as a burglar when you are on the loading dock at 02:00.
Tailgating versus piggybacking
Tailgating is entering a controlled door or turnstile by following an authorized person who did not cooperate — the employee badges in, the tester slips through before the door latches, and the employee never held the door or agreed to escort a visitor. CompTIA’s listed term is tailgating. Stems that show an unaware staff member and a silent follower want that word.
Piggybacking is the cousin language: the authorized person knowingly holds the door (“you look like you belong, come on in”). Some vendors reverse the two words. On PT0-003, keep the distinction by consent . Unaware follow-through = tailgating. Knowing hold-the-door = piggybacking. An access-control vestibule (mantrap) is the usual architectural countermeasure; cameras and training are the operational pair. Those remediations live in objective 1.5. Here you only need to recognize the attack and that it is a physical test, not a phishing email.
Exam trap: calling every lobby conversation tailgating. If the tester talked past a receptionist with a fake visitor story, that is social engineering (objective 4.8). Tailgating is the body through the door.
Site surveys come first
A site survey is the authorized walk-through or observation pass before you try USB drops, clones, or picks. You record camera locations and blind spots, lighting, fence lines, badge-reader type, whether doors latch and alarm, visitor sign-in, loading docks, smoker’s doors that are propped, and whether a vestibule actually cycles one person at a time. The survey itself may be overt (escorted, white-box physical) or covert (from public sidewalks and lobbies the RoE named). It is still reconnaissance of physical controls, not a wireless site survey of SSIDs — that is a different 3.1 bullet.
Skipping the survey is how testers pick a camera-covered padlock at night, clone a card at a reader that already logs unique IDs to a SOC, or tailgate into a floor that was excluded because of safety. The survey also tells you which 3.3 techniques are even possible: a modern encrypted smart-card reader is a different badge problem than a legacy proximity reader.
USB drops are legal only when authorized
A USB drop plants removable media where a person will pick it up and plug it in: lobby, parking lot, restroom, mail stop. The stick may present as a human-interface device, carry a lure document, or rely on someone opening a file. Technical details are not the 3.3 point. The point is authorization .
A USB drop without authorization is a crime, not a finding. It can violate computer-crime statutes, the client’s acceptable-use policy, and the engagement contract. Labeling the stick “payroll bonus” does not make it a test. “The lobby is public” does not put USB media in scope. “Network testing was authorized” does not include planting malware on staff machines. If the RoE is silent on USB drops, the answer is do not drop . If USB drops are allowed, the RoE should say where, whether the payload may phone home, how you retrieve unplugged sticks, and how you avoid targeting visitors who are not in scope.
Exam trap: treating a successful unauthorized drop as evidence the client needs training. You do not get a finding from an illegal act. You may get a lawsuit.
Badge cloning and proximity cards
Badge cloning copies an access credential, most classically a low-frequency proximity (prox) card (for example 125 kHz HID Prox-style tokens) whose identifier can be read at a short distance and written to a spare card or emulator. The tester then presents the clone at a reader. Encrypted smart cards and phones in a secure wallet are harder; the exam still wants you to know cloning is the 3.3 technique against weak badge technology.
Cloning requires physical-test permission that names badges, readers, and whether you may stand near an employee turnstile with a reader. Stealing a badge from a purse is theft plus cloning, not “just 3.3.” Using a cloned badge on a building that was not listed is out of scope even if the card opened it.
Lock picking
Lock picking is opening a mechanical lock without the assigned key: pin tumblers on server cages, padlocks on docks, office doors, cabinets. Related skills (bump keys, shimming a padlock, bypassing a cheap privacy latch) sit in the same concept bucket on a multiple-choice item. Possession of picks can be restricted by local law. On the exam, the operational rule is the same as USB and cloning: only with written physical authorization , only on named locks, and usually after the site survey shows cameras and alarms.
Picking a lock to “save time” during a network test is not clever. It is unauthorized physical access. If the RoE allows a cage pick to plant a drop box, you still stop at the named cage. Adjacent offices are not a bonus round.
Technique What the tester does Authorization trap
Tailgating Follows through a controlled door without the employee’s cooperation Distinct from piggybacking (knowing hold-the-door) and from verbal pretexting
Site survey Maps cameras, doors, docks, readers, and latching before other physical tests Not the same as a wireless SSID survey; do not skip it
- USB drop Plants media hoping someone will plug it in Unauthorized drop is a crime, not a finding
- Badge cloning Copies a prox/RFID badge and presents the clone Network SoW does not authorize cloning
- Lock picking Opens a named mechanical lock without the key Local law plus explicit RoE; survey first
- Worked authorization decision
The SoW authorizes 10.4.0.0/16 and the corporate web applications. It does not mention buildings. A tester who tailgates into HQ, clones a prox card at the garage reader, leaves USB sticks on the receptionist’s counter, and picks the server-cage lock has performed four 3.3 techniques without physical-test scope. None of that is a valid finding. The lawful path is: amend the RoE for a named street address and window, complete a site survey , then run only the techniques the client approved — perhaps tailgating and a camera-aware badge test, with USB drops forbidden. If USB is later approved, the drop is a controlled test with retrieval, not a surprise crime.
3.3 is explain-level: you must know the names, the consent language at the door, and that physical work is a scoped engagement of its own. Domain 4 will reuse some of these ideas under social engineering. Here, the scoring is whether you treat the body, the badge, the stick, and the lock as authorized physical tests or as improvisation.