Security finds several unlabeled USB drives left in the visitor parking lot outside city hall, some labeled "Q4 budget draft." An employee plugs one into a clerk workstation and malware begins beaconing. Which threat vector is primarily illustrated?
Select an answer to reveal the explanation.
Short Explanation
Tempting USB sticks in the parking lot are the removable-media vector in action — curiosity plugs them in and malware hitchhikes. This is not a public cloud bucket or an XSS bug in a web form. Keep removable media policy and USB controls tight around civic workstations.
Full Explanation
Removable devices are a listed attack surface: physical media can deliver malware when users insert unknown USB drives. Objective 2.2 calls out removable device vectors separately from web, cloud, or zero-day software flaws. Cloud public-bucket exposure, XSS, and unpatched VPN zero-days are different vulnerability or vector classes. Municipal controls typically include USB port restrictions, awareness training, and malware scanning for authorized media.