Tailgating and Physical Penetration Testing

Tailgating and Impersonation

Subdomain 5.5 names physical penetration testing with the examples phishing, tailgating, and impersonation. Tailgating means following an authorized person through a secured door. Impersonation means pretending to belong. The outline asks entry-level staff to support these tests and to recognize the attack pattern.

Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 5.5, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.

Responding to a Finding

If a test shows tailgating, the response is a physical control and an awareness response: staff should challenge an unknown person, and the entry process should not rely on someone holding the door. Record the finding, apply the fix, and retest. A scenario that only says the door was propped is less useful than one that shows what staff did about it.

What the Outline Lists for This Section

The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:

• 5.5: Security readiness testing (e.g., blue teaming, purple teaming, red teaming)
• 5.5: Application testing (e.g., vulnerability scanning, static analysis, dynamic analysis, threat modeling)
• 5.5: Physical penetration testing (e.g., phishing, tailgating, impersonation)

Common Traps

A common trap is confusing testing approaches. Red teaming simulates an attacker, blue teaming defends and detects, purple teaming shares findings, and dynamic analysis is the method that runs the application.