What type of attack involves observing a user's actions to obtain sensitive information?

What type of attack involves observing a user's actions to obtain sensitive information?

• A. Phishing
• B. Shoulder surfing
• C. Social engineering
• D. SQL injection

Answer: (B)

Shoulder surfing is a form of attack where an attacker observes a user’s actions directly, typically in close proximity, to obtain sensitive information such as passwords, PINs, or other personal data. This method exploits the physical environment rather than network vulnerabilities, making it particularly insidious because it can occur in public spaces such as coffee shops, banks, or on public transport where the attacker can easily see the victim's screen or keyboard. In contrast, phishing involves tricking individuals into revealing sensitive information through deceptive emails or websites; social engineering encompasses a broader range of manipulative tactics to deceive individuals into divulging confidential information but doesn't specifically involve direct observation; and SQL injection refers to exploiting vulnerabilities in a database query to manipulate data, which doesn't relate to observing user actions. Thus, shoulder surfing is the only option that specifically involves direct observation to acquire sensitive information.

Shoulder surfing is a form of attack where an attacker observes a user’s actions directly, typically in close proximity, to obtain sensitive information such as passwords, PINs, or other personal data. This method exploits the physical environment rather than network vulnerabilities, making it particularly insidious because it can occur in public spaces such as coffee shops, banks, or on public transport where the attacker can easily see the victim's screen or keyboard.

In contrast, phishing involves tricking individuals into revealing sensitive information through deceptive emails or websites; social engineering encompasses a broader range of manipulative tactics to deceive individuals into divulging confidential information but doesn't specifically involve direct observation; and SQL injection refers to exploiting vulnerabilities in a database query to manipulate data, which doesn't relate to observing user actions. Thus, shoulder surfing is the only option that specifically involves direct observation to acquire sensitive information.