Which of the following types of attacks is often performed by looking surreptitiously at the keyboard or monitor of an employee's computer?

A buffer-overflow attack exploits insufficient bounds checking in software memory allocation and has no physical observation component.

Shoulder surfing is a social engineering technique where an attacker physically positions themselves to observe a victim's keyboard input or monitor display without the victim's knowledge. It requires no technical exploit - it exploits physical proximity and lack of visual privacy controls. This directly matches the scenario of looking surreptitiously at a keyboard or monitor.

A man-in-the-middle attack intercepts network communications between two parties and operates at the network or protocol layer, not through physical observation.

A Denial-of-Service attack floods a target with traffic to exhaust its resources and does not involve observing an employee's physical workspace.