A penetration tester enters an office building at the same time as a group of employees despite not having an access badge. Which of the following attack types is the penetration tester performing?

Tailgating is the act of an unauthorized person following an authorized person into a restricted area. In this scenario, the penetration tester is exploiting the authorized employees' entry to gain access without their own badge, which is a classic example of tailgating. Shoulder surfing involves observing someone's private information, like a password, by looking over their shoulder, which is not happening here. RFID cloning would involve duplicating an access card's signal, which isn't described. Forgery refers to creating false documents or signatures, which is also not relevant to this physical access scenario.