The most effective measure to mitigate the risk of shoulder surfing in the scenario described is to apply privacy screens on the laptop. Privacy screens limit the viewing angle of the screen, making it difficult for unauthorized individuals to see the content on the screen unless directly in front of it. The incorrect answers involve measures that are either less effective or not practical. Regular password changes do not protect against shoulder surfing because the threat involves directly observing information on the screen. Installing a firewall is a network security measure that does not address the threat of someone physically looking at the laptop screen. Facial recognition software enhances access security but does not prevent someone from seeing information on a screen once access is granted.