Which of the following types of attacks cannot be prevented by a firewall? Each correct answer represents a complete solution. Choose all that apply.

A ping flood is an ICMP-based volumetric network attack that firewalls can mitigate by blocking or rate-limiting ICMP echo-request traffic at the network perimeter.

Phishing exploits human psychology through deceptive emails or websites to steal credentials; because it targets users rather than network ports or protocols, a firewall has no mechanism to inspect or block this social engineering vector.

Shoulder surfing is a physical-world attack where an adversary visually observes a user entering sensitive information; no network security device can detect or prevent an attacker who is physically present.

URL obfuscation disguises malicious links to trick users into visiting harmful sites; while next-generation firewalls can perform some URL filtering, classic firewalls cannot analyze the semantic intent of URLs to detect obfuscation at the user-interaction layer.