nerdexam
(ISC)2

CGRC · Question #375

Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the…

The correct answer is B. Confidentiality. Shoulder surfing is an attack where an unauthorized person observes sensitive information, such as passwords, thereby directly violating the confidentiality of that information.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the keyboard of an employee's computer while he is typing in his password at any access point such as a terminal/Web site. Which of the following is violated in a shoulder surfing attack? Response:

Options

  • AAuthenticity
  • BConfidentiality
  • CAvailability
  • DIntegrity

How the community answered

(32 responses)
  • A
    3% (1)
  • B
    94% (30)
  • D
    3% (1)

Why each option

Shoulder surfing is an attack where an unauthorized person observes sensitive information, such as passwords, thereby directly violating the confidentiality of that information.

AAuthenticity

Authenticity refers to verifying identity; while a successful shoulder surfing attack can lead to unauthorized access, the act itself is a breach of confidentiality, not authenticity.

BConfidentialityCorrect

Shoulder surfing is a direct threat to confidentiality because it allows an unauthorized individual to gain access to private or sensitive information, such as passwords or data on a screen, by simply looking over an authorized user's shoulder. This action exposes information that should remain secret.

CAvailability

Availability ensures information and systems are accessible when needed; shoulder surfing does not directly impact the availability of resources.

DIntegrity

Integrity ensures data is accurate and unaltered; shoulder surfing involves observing data without modifying it, thus not violating integrity.

Concept tested: CIA triad - Confidentiality violation

Source: https://learn.microsoft.com/en-us/security/cybersecurity-reference-architecture/cia-triad

Topics

#Shoulder Surfing#Confidentiality#Information Security Principles#Physical Security Attacks

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice