Physical Security Social Engineering: Crutch Impersonation

PT0-003 By islever Editorial Last updated

Explain common attacks against specialized systems. Explain collaboration and communication activities.

Short answer

B The penetration tester is using crutches as a disguise to impersonate an injured person, leveraging social engineering pretexting to gain physical access.

Question

A penetration tester uses a pair of crutches to access a client's physical location. Which of the following is the tester most likely trying to do?
  1. Tailgating
  2. Impersonation Correct Answer
  3. Badge cloning
  4. Lock picking

Key Takeaways

The key distinction is that tailgating exploits courtesy/distraction, while impersonation involves adopting a false identity or condition (like injury) to deceive security personnel.

Learn why using crutches for physical entry is classified as impersonation rather than tailgating in PT0-003 exams, focusing on social engineering pretexting tactics.

Common mistake: Candidates often choose A. Tailgating because the tester enters by following someone, ignoring that the crutches represent a fabricated identity/pretext, which elevates the tactic to impersonation.

Expert Analysis

The Trap of Tailgating vs. Impersonation

The most attractive but incorrect answer is A. Tailgating. This option appeals because the tester physically follows someone through a door, which is the literal mechanism of entry. Comments frequently cite this, noting that "using crutches... to get someone to hold the door open" fits the definition of tailgating (or piggybacking). However, this reasoning focuses only on the result (entry) rather than the method (deception).

Why Impersonation is Correct

B. Impersonation is the correct classification in penetration testing doctrine. Tailgating relies on social pressure or distraction (e.g., carrying boxes, holding a heavy load) where the attacker blends in as a legitimate peer. In contrast, using crutches is a deliberate act of pretexting and disguise. The tester is adopting a false persona—an injured person—to elicit sympathy and lower security vigilance. By pretending to have a disability they do not possess, the tester is impersonating a specific type of individual to bypass physical access controls. This falls squarely under social engineering techniques involving deception of identity or condition.

Vendor Doctrine Alignment

CompTIA PenTest+ objectives distinguish between simple following (tailgating) and assuming a false identity or role (impersonation/pretexting). Since the crutches are a prop used to construct a fake narrative about who the tester is, it constitutes impersonation. If the question intended tailgating, it would likely describe a scenario where the tester merely walks behind an employee without any deceptive props or false identities.

Exam Strategy

When analyzing physical security scenarios, distinguish between the mechanism of entry and the social engineering technique. If the attacker is merely blending in or distracting, it is tailgating. If they are wearing a uniform, carrying fake ID, or using props like crutches to assume a false role, it is impersonation or pretexting. Always look for evidence of identity fabrication.

Frequently Asked Questions

What is the difference between tailgating and piggybacking?

Tailgating is gaining unauthorized access by following someone without their knowledge or consent, often exploiting distraction. Piggybacking is when the authorized person knowingly allows the follower in, often due to a request for help or social pressure.

Is using crutches always considered impersonation?

In the context of penetration testing exams, yes. It is a deliberate use of a prop to create a false narrative (pretext) about the attacker's status, which constitutes impersonating an injured person to elicit sympathy and bypass security.

More PT0-003 FAQ →

Community Votes

A
50%
B
50%

50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 10 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 10

  1. LemonGremlin 👍 4 Answered B
    B. Impersonation The penetration tester is pretending to need crutches to exploit sympathy or reduce suspicion, thereby impersonating someone with a disability to gain access.
  2. moon54321 👍 3 Answered A
    ChatGPT: 🔹 The two possible interpretations: A. Tailgating Definition: Gaining entry by following someone through a secure door without using credentials. Motivation: Often relies on human kindness or distraction (e.g., someone holding the door open). Example: Using crutches or carrying boxes so people hold the door for you → tailgating. B. Impersonation Definition: Pretending to be someone specific or from a specific role (employee, delivery driver, technician, etc.) to gain trust or access. Usually involves a pretext with a fabricated identity or credentials. 🔹 Which is correct for the exam? ✅ Answer: A. Tailgating This logic is exactly what CompTIA expects: The tester isn’t pretending to be a specific employee or role. They’re exploiting courtesy (human nature) to be let in — that’s tailgating.
  3. TheRealWebs 👍 2 Answered A
    I, personally (removing AI input), actually believe this to be Tailgating. Here's why: Whether it is a box of donuts or crutches, you're still relying on human kindness to hold the door open which would be tailgating in either case, whether its sneaky or in plain sight. If there was any mention of an employee badge or the the tester claiming to be an employee or anything in that nature, then even with the crutches, I would say impersonation. While impersonating an injured person makes a little bit of sense, based on the question and the personal research conducted. I vote A.
  4. 56f412f 👍 2 Answered B
    🎯 Why B is Correct The tester is using crutches as a disguise/prop This is a social engineering tactic to appear as: An injured employee A visitor needing assistance Someone who appears non-threatening and legitimate 👉 This is classic impersonation (pretexting) ✔ Uses appearance/props to gain trust ✔ Attempts to bypass security through deception ✔ Relies on human behavior rather than technical attack 🔑 Trigger Keywords in Question Uses crutches Access physical location Social engineering context 👉 This maps to: ➡️ Impersonation / pretexting
  5. Sam_sgv 👍 2 Answered B
    Copilot The correct answer is B. Impersonation. ✔️ Why this is impersonation Using crutches to access a client’s physical location is a classic social-engineering tactic where the tester pretends to be someone they are not—usually: Someone injured or disabled Someone who appears to need assistance Someone who elicits sympathy, making others more likely to hold doors open or bypass badge checks This is impersonation, because the tester is adopting a false identity or condition to influence behavior and gain unauthorized access.
Show 5 more comments
  1. HeatSquad77 👍 2 Answered B
    ✅ B. Impersonation Why: Using a pair of crutches is a form of social engineering where the penetration tester adopts a believable persona or appearance to gain trust or avoid scrutiny while entering a facility. The tester is impersonating someone who uses crutches, potentially making employees more likely to assist them or less likely to question their presence.
  2. Flyentologist 👍 2 Answered A
    If the crutches are a distraction to get someone to hold the door open for you, that's tailgating. Impersonation requires posing as someone. Pretending to be injured isn't impersonation, it's just social engineering to facilitate the tailgating.
  3. datmatt 👍 2 Answered B
    Tailgating is sneaking in behind someone. If piggybacking was an option, then I could see that because you are relying on to hold the door open for you. So with that, I would go with B.
  4. 082c9f4 👍 2 Answered A
    The crutches are used as a distraction to get someone to hold the door open.
  5. sneeed 👍 1 Answered A
    A.) Tailgaiting The tester is trying to exploit someone's willingness to help to gain physical access. No where in the question did it allude that the tester is trying to impersonate an authorized person.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

User Enumeration When Legacy Services Fail

S-grade

Identifying the Penetration Testing Framework with 14 Components

S-grade

Most Efficient Sensitive-File Exfiltration Method

A-grade

Enumerating TLS Versions with Nmap

A-grade

Practice All PT0-003 Questions

Access 120 questions with complete answers and detailed explanations.

View Full PT0-003 Practice Test →

← Back to PT0-003 Study Guide