Security finds several unlabeled USB drives left in the visitor parking lot outside city hall, some labeled "Q4 budget draft." An employee plugs one into a clerk workstation and malware begins beaconing. Which threat vector is primarily illustrated?
Select an answer to reveal the explanation.
Short Explanation
Tempting USB sticks in the parking lot are the removable-media vector in action — curiosity plugs them in and malware hitchhikes. This is not a public cloud bucket or an XSS bug in a web form. Keep removable media policy and USB controls tight around civic workstations.
Full Explanation
Removable device and media vectors introduce malware when an employee inserts untrusted USB storage into a municipal workstation. Labeled bait such as "Q4 budget draft" weaponizes curiosity and helpfulness. Once mounted, autorun-like behavior, shortcut tricks, or user-opened files can install a beaconing implant. Security+ lists removable media alongside other physical and human-assisted delivery paths because policy and technical USB controls are primary mitigations.
Cloud misconfiguration that leaves an object storage bucket publicly readable exposes data through incorrect access controls in the cloud console—not through a parking-lot USB drop. No bucket ACL failure is described.
Cross-site scripting in a citizen comment form injects script into browsers viewing a web page. That is an application input/output flaw on a portal, unrelated to physical media left for staff to plug in.
A zero-day VPN flaw with no vendor patch yet is an unpatched software vulnerability class. The incident begins with physical media introduction and subsequent beaconing after a user action, not remote exploitation of an unpatched appliance.
Exam caveat: Do not confuse the delivery vector (USB/removable media) with the payload class (ransomware, RAT, cryptominer). The question asks which threat vector is illustrated by unlabeled drives and an employee plugging one in. Also distinguish intentional USB drops from lost/stolen authorized media—both are removable-media concerns, but baited drops emphasize social engineering plus physical access to the parking environment.
Operational check around city hall: enforce USB device control via endpoint agents or Group Policy, disable unused ports where feasible, require encrypted approved media only, and train staff never to mount found drives—route them to IT for forensic imaging in a sandbox. Pair awareness with technical blocks so civic curiosity cannot open the network.