Part A — Multiple Choice
Q1
What is firmware, and why does it create a unique security challenge compared to traditional operating systems?
✅ Correct: B. Firmware is the embedded OS of a hardware device, and the key challenge is that only the manufacturer can patch it. A device owner who discovers a firmware vulnerability has no recourse except waiting for the vendor to release a fix. If the vendor is slow (like Trane's 12-month delay), unreachable, or at EOSL, the vulnerability remains permanently unaddressed.
Q2
A vendor sends a notice that a network appliance model will reach End of Life (EOL) in six months. What does this mean for the organization's security posture, and what is the correct response?
✅ Correct: C. EOL = no longer sold, but support may continue. The device is still patchable during the EOL phase. The correct action is to begin replacement planning — not emergency decommission. Option B describes EOSL, not EOL. This distinction is a frequently tested trap on Security+ exams.
Q3
An organization runs a critical industrial controller that has reached End of Service Life (EOSL). A new CVE is published for its firmware. What is the security implication?
✅ Correct: C. EOSL means the manufacturer will release no more patches — ever. A new CVE published after the EOSL date is a permanent vulnerability on that device. The organization must apply compensating controls (firewall rules, IPS signatures, segmentation) and prioritize replacement. No patch is coming.
Q4
A legacy server running an EOSL operating system must remain operational for 12 months until a replacement system is ready. Which combination of controls BEST manages the security risk during this period?
✅ Correct: B. The three-layer compensating control approach — firewall restriction, IPS signatures for the specific OS/firmware version, and network segmentation — directly addresses the risk of an EOSL device. Antivirus (A) and encryption (C) add protection but don't address the core risk of unpatched vulnerabilities. Third-party patching (D) does not exist for EOSL firmware; no legitimate third party can write firmware patches for a hardware device.
Q5
Why does connecting IoT devices to a corporate network expand the security attack surface?
✅ Correct: C. Each IoT device is a potential attack vector — a network-connected device running software that cannot be independently updated, receiving patches infrequently, and often deployed for years or decades. A compromised IoT device can be used to pivot into other network segments, exfiltrate data, or participate in attacks on other systems. The more IoT devices on the network, the more potential entry points for attackers.
Part B — Matching
Match each hardware lifecycle term to its correct definition.
TERM
Firmware
End of Life (EOL)
End of Service Life (EOSL)
Legacy Platform
DEFINITION
No longer sold; all support and security patches permanently ended — any new vulnerability will never be fixed by the vendor
A device or system still in use beyond its intended lifecycle, often running outdated OS or firmware that may be at or past EOSL
The embedded software inside a hardware device — its internal OS — which only the manufacturer can update or patch
No longer sold by the manufacturer; support including security patches may still be available — begin replacement planning
Part C — Analysis
Q6 — Analyze
An organization discovers that a smart HVAC controller on its network has a critical firmware vulnerability. The manufacturer was acquired by another company, which has declined to release a patch for the legacy device. The controller cannot be replaced for at least eight months due to a pending building renovation. Which approach BEST addresses this situation?
✅ Correct: B. Compensating controls at the network layer are the correct response when a firmware vulnerability cannot be patched and the device cannot be immediately replaced. Disconnecting entirely (A) may be operationally impossible if the HVAC system requires network connectivity for management. Third-party firmware (C) does not exist for legitimate hardware devices. Accepting the risk (D) ignores a known critical vulnerability. Option B addresses the risk without requiring immediate replacement.
Part D — Evaluation
Q7 — Evaluate
A facilities manager argues: "Our badge reader system reached EOSL two years ago, but it still works perfectly — hardware doesn't become insecure just because support ends. We should keep using it indefinitely and invest our budget elsewhere." Evaluate this reasoning.
✅ Correct: C. "Still works correctly" and "is secure" are not the same thing. The badge reader's functionality is unchanged, but its security posture has been deteriorating since EOSL. Every new CVE disclosed for its firmware version is a permanent, unpatched vulnerability. Internal devices like badge readers are also network-connected and can be used as pivot points if compromised. The facilities manager's reasoning conflates operational function with security — they are independent properties. Two years past EOSL, the accumulated unpatched vulnerabilities represent significant risk that grows with every new disclosure.
0/7
Questions Answered Correctly