Which of the following is the MOST likely attack type?

A security analyst is reviewing a penetration-testing report from a third-party contractor. The penetration testers used the organization’s new API to bypass a driver to perform privilege escalation on the organization’s web servers. Upon looking at the API, the security analyst realizes the particular API call was to a legacy system running an outdated OS.

Which of the following is the MOST likely attack type?
A . Request forgery
B . Session replay
C . DLL injection
D . Shimming

Answer: A