An administrative assistant receives a phone call from the IT department asking for personal information to update their records. One of the questions asked is the password to the company's…

Shoulder surfing involves physically observing someone's screen or keyboard to steal credentials and requires the attacker to be physically present.

Configuration management is an IT process for tracking and controlling changes to systems and software, not a security attack.

Helpdesk troubleshooting methodology refers to the structured process IT staff use to diagnose and resolve technical issues, which is a legitimate practice.

Social engineering manipulates people into voluntarily disclosing confidential information or performing actions that compromise security, by impersonating a trusted authority such as IT support. This specific technique - using phone calls to extract credentials - is a form of vishing (voice phishing). No legitimate IT department will ever ask for a user's password, making this a clear indicator of a social engineering attack.