The city’s edge firewall has reached vendor end-of-life and will receive no further security patches, yet it still terminates Internet traffic for several departments. Which vulnerability concern is most accurate?

End-of-life / legacy system vulnerability describes an appliance or platform that remains in production after the vendor stops security patches. An edge firewall past EOL still terminating Internet traffic for departments concentrates risk: new flaws will never receive official fixes, and the device sits on a critical trust boundary. Compensating controls or replacement become mandatory because normal patch management cannot close future CVEs.

Pretexting a fake physical-security audit to collect badge codes is social engineering. It does not address an unpatchable firewall remaining at the edge.

Stealing session cookies via reflected script on a comment page is XSS. That is an application output flaw, not EOL hardware/software lifecycle risk.

Bridging guest Wi-Fi into the staff VLAN without isolation is wireless/segmentation failure. The stem’s concern is vendor support ending on the edge firewall, not guest SSID design.

Exam caveat: EOL/legacy differs from "unpatched but still supported"—once support ends, the vulnerability concern is structural unpatchability. Edge placement amplifies severity versus an isolated lab box. Do not answer with a social-engineering technique when the stem is lifecycle status.

Operational check: track vendor EOL dates in an asset CMDB, budget replacements before support cliffs, avoid last-minute emergency buys, and if interim use is unavoidable apply strict network compensating controls, virtual patching where available, heightened monitoring, and minimized rule sets. Civic Internet edges should not depend on silent, unpatchable appliances.