CompTIA CySA+ (CS0-003)Vulnerability ManagementEasy
A security analyst is assessing the network for potential vulnerabilities. They notice that a number of end-of-life (EOL) operating systems are still running on several servers within the internal network. These servers are used for various non-critical internal functions and have no direct internet exposure. What is the primary concern from a vulnerability management perspective regarding these EOL systems?
- AThey consume excessive system resources compared to modern operating systems.
- BThey are likely to suffer from performance degradation due to lack of optimization.
- CThey are difficult to integrate with modern security tools and monitoring solutions.
- DThey are no longer receiving security patches, making them vulnerable to known exploits.
Show answer & explanationAnswer & explanation
Correct answer: D. They are no longer receiving security patches, making them vulnerable to known exploits.
The primary concern with end-of-life (EOL) operating systems from a vulnerability management perspective is that they no longer receive security patches or updates from the vendor. This means any newly discovered vulnerabilities, or even older ones, will remain unpatched and exploitable, posing a significant risk even if the systems are not directly exposed to the internet.
Why the other options are wrong
- A. Resource consumption is an operational concern, not a direct vulnerability management concern.
- B. Performance degradation is a possible operational issue but not the primary security concern.
- C. While integration difficulties can be a problem, the fundamental security risk is the unpatched vulnerabilities themselves.
End-of-Life (EOL) Systems
Software or hardware products that have reached the end of their support lifecycle from the vendor, meaning they no longer receive updates, security patches, or technical support.
- No longer receive security patches, leading to unpatched vulnerabilities.
- Increased risk of exploitation by known vulnerabilities.
- Often difficult to integrate with modern security solutions.
Memory trick: EOL means 'Exploitable, Old, and Lacking support'!