Security cameras show a stranger lingering at the city garage badge reader with a handheld device, and the next morning an unused cloned badge opens the door. Which attack indicator is this?
Select an answer to reveal the explanation.
Short Explanation
Standing at the garage reader with a skimmer is old-school physical theft of the badge's radio handshake. That is RFID cloning—not a Wi-Fi man-in-the-middle or a web path trick.
Full Explanation
RFID badge cloning is a physical attack that captures or copies proximity credentials at or near an access reader so an attacker can present a working clone later. Camera evidence of lingering with a handheld device at the city garage reader, followed by an unused cloned badge opening the door, matches that physical credential-theft indicator. Municipal facilities that treat badge possession as identity must pair badges with PIN, biometrics, or monitoring to reduce clone usefulness.
On-path interception of TLS sessions on guest Wi-Fi is a network confidentiality/integrity attack on sessions, not garage door entry with a cloned badge. Cryptographic downgrade forcing weak ciphers on an appliance manipulates protocol negotiation, unrelated to physical badge radio cloning. Directory traversal against a document portal URL is a web application path-escape attack against files on a server, not physical access control.
Exam caveat: SY0-701 includes physical attacks alongside cyber ones. When the stem emphasizes a reader, handheld skimmer-like device, and a cloned badge, pick RFID cloning—even if other cyber options sound sophisticated. Do not force a network MITM answer onto a physical access scene.
Operational check: revoke and reissue potentially exposed badge populations, enable anti-cloning or challenge-response badge tech where budget allows, add CCTV/alerting at readers, require multi-factor physical entry for sensitive areas, and audit unusual first-use badges after suspicious loitering events.