Transit GIS staff open a "map update" image that later appears to have delivered a malicious payload through embedded content rather than a normal office document. At Security+ depth, which threat vector should analysts primarily consider?
Select an answer to reveal the explanation.
Short Explanation
When the "map update" picture is the delivery truck, think image-based vector — malware or hidden content riding an image, not just a Word macro. Security+ expects awareness that images can be a channel alongside email attachments. Scan and sandbox unusual GIS media the same way you would shady documents.
Full Explanation
An image-based threat vector delivers malicious content through an image file or image-borne technique rather than a conventional office document macro. At Security+ depth, analysts should recognize that GIS "map update" pictures and similar media can carry steganographic payloads, exploit vulnerable image parsers, or otherwise abuse image handling pipelines. The key teaching point is that images are an in-scope delivery channel alongside email attachments and scripts.
Open RDP with factory-default credentials on a jump host is network exposure plus weak authentication. The GIS staff action centers on opening an image-delivered payload, not on an Internet RDP listener.
Pretexting a fake audit to collect badge codes is social engineering with a fabricated story over interpersonal channels. No audit pretext is described—media handling is.
Public cloud storage left world-readable is cloud misconfiguration exposing objects without auth. The vector here is content embedded in or delivered via an image opened by staff, not a public bucket ACL.
Exam caveat: Image-based vectors on SY0-701 are about awareness that pictures can be carriers or exploit triggers—not deep steganography tradecraft. Do not dismiss images as "always safe." Also avoid conflating this with phishing that merely displays a logo; the stem stresses delivery through embedded image content versus a normal document.
Operational check for transit GIS: treat unusual map media like untrusted documents—scan with updated AV/EDR, open in sandboxed viewers, restrict which groups can ingest third-party imagery, keep image libraries and codecs patched, and block automatic execution paths tied to media handlers on municipal workstations.