Which of the following security threats are MOST often delivered via email? (Select TWO).

Rootkits are malware that embed deeply in the OS; while they can be installed via many vectors, they are not primarily or definitively an email-delivered threat category.

Phishing is a social engineering attack delivered almost exclusively via email (or similar messaging), using deceptive messages to trick users into revealing credentials or clicking malicious links.

Shoulder surfing is a physical/in-person attack where someone visually observes a victim's screen or keyboard and has nothing to do with email.

Social engineering is a broad category of manipulation techniques that includes phishing but also encompasses phone calls (vishing), in-person deception, and other non-email vectors.

Spam is unsolicited bulk email and is by definition an email-based threat, often carrying phishing links, malware attachments, or fraudulent advertisements.