Which type of social engineering attack involves looking over someone's shoulder to obtain sensitive information such as passwords or PINs?

Why D is correct

Shoulder surfing involves visually observing someone entering sensitive information - passwords, PINs, credit card numbers - by looking over their shoulder or using cameras. Privacy screens on laptops and awareness of surroundings when entering sensitive data are countermeasures.