A parking-kiosk vendor plugs an unmanaged laptop into the city VLAN and wormable malware spreads. What introduced the attack?
Select an answer to reveal the explanation.
Short Explanation
The kiosk tech just docked a mystery laptop onto the city street. That unmanaged box is the front door—the worm did not need a parks website or a VPN spray to get in. Treat the vendor endpoint as the introduction vector.
Full Explanation
When a parking-kiosk vendor plugs an unmanaged laptop into the city VLAN and wormable malware spreads, the introduction vector is an untrusted vendor endpoint connected to the municipal LAN. The mystery laptop is the front door; civic network access for vendors without controls is a classic third-party introduction path. Classification should stay on that unmanaged connection rather than inventing unrelated web or VPN stories.
Calling it a watering-hole on the parks WordPress site fails by concept: no trusted website delivery is described. Calling it a password spray against the public-works SSL-VPN fails by concept: the stem shows a physical/network plug-in, not VPN authentication failures. Calling it a hidden mailbox forwarding rule on a court clerk fails by concept: email persistence is not how this worm entered.
Exam caveat: Vendor unmanaged endpoints on municipal LANs are a distinct introduction vector—do not relabel as phishing, watering-hole, or VPN spray without matching facts.
Operational check: Isolate the vendor laptop and affected VLAN segment, collect malware telemetry into ES, tighten vendor NAC/guest controls, and require managed jump hosts for kiosk maintenance going forward.