An information security policy stating that ‘the display of passwords must be masked or suppressed’
addresses which of the following attack methods?

A.
Piggybacking

B.
Dumpster diving

C.
Shoulder surfing

D.
Impersonation

Explanation:
If a password is displayed on a monitor, any person nearby could look over the shoulder of the user
to obtain the password. Piggybacking refers to unauthorized persons following, either physically or
virtually, authorized persons into restricted areas. Masking the display of passwords would not
prevent someone from tailgating an authorized person. This policy only refers to ‘the display of
passwords.’ If the policy referred to ‘the display and printing of passwords’ thenit would address
shoulder surfing and dumpster diving (looking through an organization’s trash for valuable
information), impersonation refers to someone acting as an employee in an attempt to retrieve
desired information.