nerdexam
(ISC)2

CSSLP · Question #218

Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the…

The correct answer is C. Confidentiality. Shoulder surfing directly aims to steal sensitive information, like passwords, by observing an individual, thus violating the principle of confidentiality.

Secure Software Concepts

Question

Shoulder surfing is a type of in-person attack in which the attacker gathers information about the premises of an organization. This attack is often performed by looking surreptitiously at the keyboard of an employee's computer while he is typing in his password at any access point such as a terminal/Web site. Which of the following is violated in a shoulder surfing attack?

Options

  • AIntegrity
  • BAvailability
  • CConfidentiality
  • DAuthenticity

How the community answered

(36 responses)
  • A
    6% (2)
  • B
    3% (1)
  • C
    92% (33)

Why each option

Shoulder surfing directly aims to steal sensitive information, like passwords, by observing an individual, thus violating the principle of confidentiality.

AIntegrity

Integrity ensures that information is accurate and has not been altered without authorization, which is not directly violated by merely observing data.

BAvailability

Availability ensures that authorized users have access to information and systems when needed, which is not directly affected by shoulder surfing.

CConfidentialityCorrect

Confidentiality ensures that sensitive information is accessed only by authorized individuals. Shoulder surfing is an attack where an unauthorized person obtains sensitive information, such as passwords, by observing a user, directly compromising the confidentiality of that data.

DAuthenticity

Authenticity ensures that users are who they claim to be; however, shoulder surfing itself is about stealing credentials, not directly compromising the system's ability to authenticate before the credentials are used.

Concept tested: CIA Triad - Confidentiality violation

Source: https://learn.microsoft.com/en-us/azure/security/fundamentals/get-started-security-fundamentals#confidentiality-integrity-and-availability-the-cia-triad

Topics

#Shoulder surfing#Confidentiality#In-person attacks#Information gathering

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CSSLP Practice