The DMV still runs public-facing Windows 7 kiosks that are joined to the staff network and no longer receive vendor security updates. Which attack-surface concern does this primarily represent?

Unsupported systems and applications that remain online without vendor patches permanently elevate attack surface. Windows 7 kiosks past end of support no longer receive security updates, so newly disclosed flaws accumulate. Joining those kiosks to the staff network extends that risk into identity and file resources used by employees. For public-facing DMV endpoints, the combination of citizen exposure plus lateral reach into staff LAN is especially severe.

A watering-hole attack targets a niche site staff already visit and compromises browsers that land there. The stem describes aging kiosk OS exposure, not a poisoned procurement forum.

Pretexting invents a fabricated scenario—such as a fake audit—to collect sensitive information like badge codes. That is a human social-engineering technique, not an unsupported-platform problem.

Image-based steganography or image-borne delivery hides or carries content inside image files. Nothing here points to map updates or media payloads; the concern is unpatchable OS instances still on the production network.

Exam caveat: Security+ groups end-of-life, legacy, and unsupported systems as an attack-surface category distinct from "we forgot one patch on a supported OS." Once vendor support ends, compensating controls (isolation, virtual patching, replacement) become mandatory because there is no normal patch path. Public kiosks amplify risk because untrusted users physically interact with them.

Operational check: inventory all Windows 7 and other EOS endpoints, remove them from staff VLANs immediately, place any interim kiosks on tightly filtered isolated segments with kiosk lockdown, and fund replacement to a supported OS. Treat "still works" as irrelevant when vendor patches have stopped.