nerdexam
(ISC)2

CAP · Question #152

Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the keyboar

The correct answer is B. Confidentiality. Shoulder surfing directly violates confidentiality by allowing an unauthorized party to observe private information such as passwords.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the keyboard of an employee's computer while he is typing in his password at any access point such as a terminal/Web site. Which of the following is violated in a shoulder surfing attack?

Options

  • AAuthenticity
  • BConfidentiality
  • CAvailability
  • DIntegrity

How the community answered

(39 responses)
  • B
    95% (37)
  • C
    3% (1)
  • D
    3% (1)

Why each option

Shoulder surfing directly violates confidentiality by allowing an unauthorized party to observe private information such as passwords.

AAuthenticity

Authenticity relates to verifying the identity of a user or system and is not directly violated by passively observing credentials being entered.

BConfidentialityCorrect

Confidentiality ensures that information is accessible only to those authorized to view it. In a shoulder surfing attack, an attacker visually observes sensitive credentials being entered, bypassing access controls and exposing private information to an unauthorized individual. This is a direct breach of the confidentiality principle within the CIA triad.

CAvailability

Availability concerns the accessibility of systems and data to authorized users and is not affected by an attacker merely observing a password.

DIntegrity

Integrity refers to the accuracy and completeness of data; shoulder surfing does not modify or corrupt any data.

Concept tested: CIA triad - confidentiality violation via shoulder surfing

Source: https://csrc.nist.gov/glossary/term/confidentiality

Topics

#Shoulder surfing#Confidentiality#In-person attacks#Security principles

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAP Practice