This scenario best illustrates impersonation, which is a core social engineering technique emphasized in CEH under pretexting and physical security testing. Impersonation occurs when an attacker assumes a believable identity, such as an IT technician, vendor, maintenance worker, or delivery person, to gain trust and bypass access controls. In the prompt, the red team member adopts a third-party IT technician role and is granted entry because the receptionist assumes the visit is legitimate and does not verify credentials. That is the defining moment of impersonation: exploiting human trust and procedural gaps to obtain unauthorized physical access.
While the attacker later observes open terminals, unattended printouts, and sticky notes, those observations are opportunistic data collection that becomes possible only after successful impersonation. Shoulder surfing is specifically observing a user entering credentials or viewing a screen while standing nearby, typically during active use. Eavesdropping focuses on capturing spoken or transmitted information, such as listening to conversations or intercepting communications. Dumpster diving involves retrieving sensitive information from trash or discarded materials in waste bins, not simply seeing sticky notes left on desks.
CEH guidance highlights that impersonation often succeeds when organizations lack visitor verification, badge enforcement, escort policies, and security awareness training. Controls include validating work orders, requiring government-issued ID, issuing visitor badges, escorting visitors, enforcing clean desk practices, locking workstations, and secure printing to prevent exposure of credentials and sensitive data.

https://en.wikipedia.org/wiki/Residual_risk
The residual risk is the risk or danger of an action or an event, a method or a (technical) process that, although being abreast with science, still conceives these dangers, even if all theoretically possible safety measures would be applied (scientifically conceivable measures); in other words, the amount of risk left over after natural or inherent risks have been reduced by risk controls.
Residual risk = (Inherent risk) - (impact of risk controls)

Having access to both the original plaintext templates and their corresponding ciphertext allows the attacker to analyze patterns and potentially deduce keys or additional plaintext. This scenario is characteristic of a known-plaintext attack.

Infrastructure as a Service (IaaS) provides virtualized computing infrastructure over the internet. In this model:
The cloud provider supplies the hardware (servers, storage, networking).
The client (your organization) is responsible for installing and managing the OS, applications, and all configurations.
This aligns with the question, where the organization must take full responsibility for maintenance.
Incorrect Options:
A: PaaS offers managed OS, middleware, and runtime, reducing customer responsibilities.
B: SaaS provides fully managed applications-users only access features.
C: Functions as a Service (FaaS) offers event-driven computing without server management, used in serverless environments.
Reference - CEH v13 Official Courseware:
Module 19: Cloud Computing
Section: "Cloud Service Models"
Table: "Responsibilities in IaaS vs PaaS vs SaaS"