A company hires a third-party firm to conduct an assessment of vulnerabilities exposed to the Internet. The firm informs the company that an exploit exists for an FTP server that had a version…

While default configurations can often introduce vulnerabilities, the primary reason for the vulnerability here is the system's age and lack of vendor support, not merely its initial setup.

An 'end-of-life' (EOL) system refers to software or hardware that the vendor no longer supports, meaning no further updates, patches, or security fixes will be released. The fact that the FTP server is 'eight years old' and 'no upgrade exists from the vendor' directly indicates it is an EOL system, making it inherently vulnerable to known exploits that will never be patched.

A weak cipher suite is a specific type of vulnerability related to cryptographic protocols, but the underlying problem described is the system's overall lack of security updates due to its age and unsupported status.

Zero-day threats refer to unknown vulnerabilities that attackers exploit before a vendor has a chance to create and release a patch; in this scenario, the vulnerability is known, and the vendor has simply ceased supporting the product.