What does multiple badge entries in two minutes indicate?

SY0-701 By islever Editorial Last updated

Short answer

A RFID cloning

Question

A company’s gate access logs show multiple entries from an employee’s ID badge within a two-minute period. Which of the following is this an example of?
  1. RFID cloning Correct Answer
  2. Side-channel attack
  3. Shoulder surfing
  4. Tailgating

Key Takeaways

The exam tests your ability to distinguish between physical access control attacks based on log analysis, with the common trap being confusing badge cloning with tailgating.

Multiple rapid entries from the same ID badge within a short timeframe typically indicate RFID cloning, where an attacker duplicates credentials to gain unauthorized access. Community consensus strongly supports this interpretation over tailgating, as logs show repeated credential use rather than single-use piggybacking.

Common mistake: Many candidates choose D (Tailgating) because they associate physical security breaches with unauthorized entry, but tailgating produces only one log entry per badge scan, not multiple rapid entries from the same credential.

Expert Analysis

Why the Answer Is Correct

RFID cloning involves duplicating an employee's access badge credentials, allowing an attacker to use the cloned badge independently. The key evidence is multiple entries from the same badge within two minutes, which indicates the credential was scanned multiple times in rapid succession. This pattern is consistent with a cloned badge being used by different individuals or the same attacker making repeated access attempts. Physical access logs would show distinct timestamps for each scan, confirming credential reuse rather than a single authorized entry.

Why the Other Options Are Wrong

Tailgating (Option D) involves an unauthorized person following an authorized employee through a secured entry without scanning their own badge, which would produce only one log entry per incident. Side-channel attacks (Option B) involve extracting information through indirect means like power consumption or electromagnetic emissions, not physical access logs. Shoulder surfing (Option C) involves observing someone enter credentials or access codes, which wouldn't generate multiple badge scan entries in access logs. The question specifically references log entries showing repeated badge use, eliminating these alternatives.

Community Comment Notes

Comment [1] correctly identifies that tailgating would not produce multiple log entries from the same badge, as the unauthorized person doesn't use credentials. Comment [2] reinforces this by noting that multiple entries within two minutes indicate actual card usage, not following. Comment [3] represents the common misconception, incorrectly assuming tailgating could produce multiple entries, but fails to recognize that tailgating by definition bypasses credential requirements entirely.

Official Reference

https://csrc.nist.gov/publications/detail/sp/800-116/final

This link opens the official vendor documentation in a new tab.

Exam Strategy

When analyzing physical security scenarios, focus on what the evidence actually shows rather than what might have happened. Multiple credential scans indicate credential duplication or reuse, while single scans with unauthorized entry suggest tailgating or piggybacking.

Community Votes

A
80%
D
20%

80% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. PjoterK 👍 3 Answered A
    D. Tailgating: This refers to an unauthorized person physically following an authorized person through a secured entry point without using their own credentials. It would not produce multiple log entries from the same badge
  2. 1eccfc0 👍 1 Answered D
    The correct answer is D. Tailgating. Tailgating happens when an unauthorized person follows an authorized person into a secure area by closely following them through a door or gate without proper access. The multiple entries from an employee's ID badge within a short time period (two minutes) suggest that the employee may have entered and allowed someone else to follow them through, which is typical of tailgating. Here’s a quick rundown of the other options: A. RFID cloning: This would involve copying the RFID credentials (ID badge) and using them to gain unauthorized access. However, there’s no indication that the ID badge itself was cloned, only that multiple entries are logged in a short period.
  3. Nahidwin 👍 1 Answered A
    A is the correct answer because tailgaitng is just following the person without them knowing , and in the question the logs show that there are two entries within two minutes so a card was used

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide