A delivery method that is commonly used by threat actors but rarely in authorized assessments is:

Question

Options

• APhishing emails with malicious attachments
• BUse of known vulnerabilities
• CSocial engineering via phone calls
• DExploitation of zero-day vulnerabilities

• A
  9% (3)
• B
  3% (1)
• C
  6% (2)
• D
  82% (27)

Explanation

Zero-day vulnerabilities are correct (D) because they are unknown to vendors and have no available patches, making them extremely valuable and rare - threat actors hoard them for high-value attacks, while authorized penetration testers almost never have access to them and rely on known, reproducible techniques instead.

Why the distractors are wrong:

• A (Phishing emails): Phishing is a staple of authorized assessments (social engineering engagements) and is heavily tested in red team exercises.
• B (Known vulnerabilities): Exploiting CVEs with public exploits is the backbone of authorized pen testing - tools like Metasploit exist precisely for this.
• C (Phone-based social engineering / vishing): This is explicitly included in many authorized assessments, particularly those testing security awareness programs.

Memory tip: Think "zero-day = zero chance of being authorized." If a vulnerability has no patch and no public disclosure, a legitimate assessor can't responsibly weaponize it - but a threat actor has no such constraint. The rarity and legal/ethical risk of zero-days is what puts them squarely in the "threat actor only" category.

No community discussion yet for this question.