A library Windows host runs an outdated third-party kernel driver. Why should privilege-escalation enumeration include that class of software?
Select an answer to reveal the explanation.
Short Explanation
Third-party drivers sit down in the basement with the kernel—when they are old and buggy, the whole house shakes. Enumerators include them because elevated driver flaws are a real priv-esc class. Age is not just about nicer Wi-Fi bars.
Full Explanation
An outdated third-party kernel driver on a library Windows host belongs in privilege-escalation enumeration because elevated third-party drivers historically introduce local privilege-escalation vulnerability classes and expand kernel attack surface beyond inbox components.
Third-party drivers often run elevated and can affect privilege boundaries. Limiting concern to Microsoft-signed inbox drivers alone is incomplete. Driver age is not merely about Wi-Fi signal bars.
Exam caveat: prioritize drivers that are old, unnecessary, or reachable from low-privilege contexts; avoid unstable testing on production without approval.
Operational check: inventory third-party drivers and versions on library endpoints, flag end-of-life components, and recommend vendor updates or removal of unused elevated drivers. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.