Attackers breach the remote-support platform used by the city’s managed service provider and then reach multiple municipal endpoints through that trusted tooling. Which attack surface best describes this event?
Select an answer to reveal the explanation.
Short Explanation
When the MSP’s remote-support tools get owned, the city inherits a supply-chain problem — trust in the vendor channel becomes the attacker’s highway. That is different from SQLi in a permit app or a buffer overflow on a scanner box. Treat MSP access like privileged infrastructure and monitor it accordingly.
Full Explanation
Supply-chain compromise through a managed service provider or vendor support channel abuses established trust. Municipal endpoints often allow MSP remote-support agents, privileged accounts, and management tooling because day-to-day operations depend on that access. When attackers breach the MSP platform, they inherit a trusted highway into many customer networks at once—without needing to phish every clerk individually. Security+ frames third-party and MSP pathways as supply-chain attack surface, not merely "someone else’s problem."
SQL injection from concatenating user input into permit-database queries is an application vulnerability in the city’s own web tier. The incident path is remote-support tooling abuse after MSP compromise, not malicious SQL from a form field.
Jailbreaking city tablets sidesteps MDM on mobile devices. That is a mobile control-bypass theme and does not describe MSP tooling as the entry channel.
Buffer overflow memory corruption in a legacy scanning service is a memory-safety application flaw. It may enable local code execution on that service but is not the vector when the breach path is the provider’s remote-support platform.
Exam caveat: Supply chain here means trust in an external provider’s update, support, or management channel—not necessarily a poisoned software build (another supply-chain flavor). Map "MSP remote tools owned → city endpoints reached" to third-party/supply-chain surface. Do not confuse it with insider threat by city employees.
Operational check: treat MSP access as privileged infrastructure—dedicated accounts, MFA, just-in-time elevation, network allowlists, session recording, and continuous monitoring for anomalous support-tool behavior. Contractually require breach notification, least privilege, and segmentation so one provider compromise cannot freely traverse every municipal VLAN.