A transit agency has a Samba share that allows guest write next to a Linux cron job that ingests that share as a privileged user. Which class of privilege-escalation risk does this multi-service layout best illustrate?
Select an answer to reveal the explanation.
Short Explanation
Picture a public drop box that a night-shift clerk empties into the vault every hour. If anyone can toss something in the box, the clerk's privileged routine becomes the escalator. Weak shares plus privileged consumers are a classic chain—not a single magic exploit.
Full Explanation
A transit Samba share allowing guest write next to a Linux cron job that ingests that share as a privileged user illustrates a multi-service privilege-escalation chain: weakly protected shared input is consumed by higher-privilege automation, turning file drop access into privileged execution influence.
You do not need to rewrite the Samba protocol before reviewing local trust boundaries. Guest write alone does not always grant interactive root without a consuming privileged process. Cron jobs absolutely can process untrusted files—that is why the chain matters.
Exam caveat: map who can write, who executes, and whether content is validated before privileged parse/execute.
Operational check: confirm guest-write share ACLs and identify privileged jobs reading those paths, document the chain, and recommend authenticated shares plus root-owned, integrity-checked intake for transit automation. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.