Question 17

Shoulder surfing is an example of social engineering.

Shoulder surfing involves observing someone's private information, such as passwords or personal identification numbers, by looking over their shoulder. This tactic is a form of social engineering, as it exploits the human element of security rather than relying on technical vulnerabilities.

A) Zero-day

Zero-day threats refer to vulnerabilities that are exploited before a patch is available. These are not related to observing or deceiving individuals for information, which is the essence of shoulder surfing.

B) Evil twin

An evil twin attack involves setting up a fraudulent Wi-Fi network that mimics a legitimate one to intercept data. While it is a form of cyber threat, it does not involve the direct observation of individuals to obtain information, distinguishing it from shoulder surfing.

C) Social engineering

Social engineering involves manipulating individuals into divulging confidential information. Shoulder surfing is a prime example, as it relies on human interaction and observation to gain access to sensitive data without the target's consent.

D) Brute-force

Brute-force attacks are methods used to crack passwords by systematically trying all possible combinations. This technique does not involve any observation of the target but instead relies solely on computational power to break encryptions, making it unrelated to the concept of shoulder surfing.

Conclusion

Shoulder surfing is definitively categorized as social engineering because it directly involves manipulating the human aspect of security to acquire sensitive information through observation. In contrast, the other options focus on technical vulnerabilities or methods that do not require direct interaction with individuals to obtain data. This highlights the unique nature of shoulder surfing within the broader spectrum of cybersecurity threats.