220-1102 Question 436
Single answerShoulder surfingA help desk technician is setting up temporary workstations for employees in a busy airport lounge after a regional office loses power. Several employees will need to access payroll and HR systems that display sensitive personal information. The lounge is crowded, and people are often standing close behind the users while they work. Which action would BEST reduce the risk of shoulder surfing while allowing employees to continue working?
- A
Install privacy screen filters on the laptops being used for payroll and HR access
- B
Require employees to use longer passwords before logging in to the systems
- C
Enable full-disk encryption on all temporary workstations
- D
Configure the laptops to lock automatically after 15 minutes of inactivity
Show answer and explanation
Correct answer: A
Explanation
Shoulder surfing is the act of obtaining sensitive information by watching a user’s screen or keyboard input, especially in public or high-traffic environments. For A+ Core 2, the best mitigation in this situation is a privacy screen filter because it directly reduces visual access to data displayed on the monitor without disrupting work. Other controls listed, such as stronger passwords, encryption, and automatic locking, are valid security measures but are aimed at different risks: authentication abuse, data-at-rest protection, and unattended device access. Best practices from general security awareness training and organizational endpoint security standards commonly recommend physical safeguards such as privacy filters, careful workstation positioning, and user awareness when handling confidential information in public spaces.
- A. Correct.
Correct. Privacy screen filters are specifically designed to narrow the viewing angle of a display so that only the person directly in front of the screen can read the content clearly. In a crowded public environment such as an airport lounge, this is the most direct control against shoulder surfing because it addresses visual exposure of sensitive information while users continue working.
- B. Incorrect.
Incorrect. Stronger or longer passwords improve authentication security, but they do not prevent nearby people from viewing sensitive data already displayed on the screen. A candidate might choose this because password policy is an important security control, but it does not specifically mitigate shoulder surfing of on-screen HR or payroll information.
- C. Incorrect.
Incorrect. Full-disk encryption protects data at rest, such as when a device is lost or stolen, but it does not protect information actively displayed on a screen in a public area. This is a plausible distractor because encryption is a core security best practice, yet it addresses a different threat than shoulder surfing.
- D. Incorrect.
Incorrect. Automatic screen locking is a useful control for unattended systems and helps reduce unauthorized access when a user walks away. However, it does not address the primary scenario of someone visually observing the screen while the employee is actively using the system. It is a good security setting, but not the best answer to this specific risk.