CompTIA Security+ SY0-701 (V7) Practice Question

The correct answer is that vendors can introduce vulnerabilities into systems that may be exploited for unauthorized access or other malicious activities. It is important for organizations to evaluate the security practices of their suppliers to protect against these risks. Unauthorized code in updates represents a situation where a vendor may unintentionally or maliciously include harmful code in a software update. While vendors can also be targets of social engineering and may suffer data breaches, these are not specific examples of how vendors would introduce vulnerabilities into an organization's systems. Incorrect patches are related but are a result of a vulnerability introduced rather than describing the risk associated with vendors.