Clerk workstations still run an unpatched browser plugin that agentless network scans never inventory, and several drive-by attempts target that plugin. Which attack-surface issue is most directly highlighted?

Vulnerable client-based software expands workstation attack surface when unpatched browser plugins and similar local components remain installed. Agentless network scanners often miss software that does not advertise a network service, so drive-by attempts can still target the plugin on clerk PCs. Security+ emphasizes that client applications—not only servers and appliances—are part of municipal attack surface and need inventory, patching, or removal.

VM escape risk between co-hosted guest portal and finance VMs is a hypervisor isolation concern. The highlighted issue is an unpatched plugin on endpoints, not breakout from a virtual machine.

Firmware years out of date on building-badge door controllers is a hardware/firmware vulnerability class on facility devices. Clerk browser plugins are client software on PCs, a different asset tier.

Typosquatting used only to redirect a construction vendor payment is BEC/payment fraud via lookalike domains. Drive-by exploitation of a local plugin is malware/exploit surface, not remittance redirection.

Exam caveat: "Client-based" points to software running on user endpoints (browsers, plugins, thick clients). Distinguish from server vulnerabilities, firmware on appliances, and network misconfigurations. Also note discovery gaps: if your scanner is only network-service oriented, you will under-report client plugin risk.

Operational check: deploy agent-based inventory on clerk fleets, remove unnecessary browser plugins, enforce browser standardization, patch remaining components on the same cadence as OS updates, and validate that EDR sees local application versions network scanners never list. Shrink the municipal desktop attack surface deliberately.