Which option is an attribute of a day-zero attack?

Question

Options

• AIt can be mitigated with content inspection that is based on static rulesets
• BIt can be prevented through RFC application-level compliance checks.
• CIt consists of a set of known threat vectors
• DIt can be mitigated through the external intelligence and contextual awareness

• A
  4% (1)
• B
  4% (1)
• C
  7% (2)
• D
  86% (24)

Explanation

D is correct because zero-day attacks exploit unknown vulnerabilities - no patch or signature exists yet - so traditional defenses are blind to them. External threat intelligence (real-time feeds, researcher disclosures) and contextual awareness (behavioral analysis, anomaly detection) are the only mechanisms that can detect unusual activity before a formal signature is available.

Why the distractors fail:

• A is wrong because static rulesets only catch known patterns; a zero-day, by definition, has no existing rule to match against.
• B is wrong because RFC compliance checks verify protocol-level formatting, not exploit content - a zero-day payload can arrive inside perfectly compliant traffic.
• C is the opposite of reality; zero-days involve unknown threat vectors, not known ones.

Memory tip: Think "zero = zero knowledge" - zero-day means zero prior signatures exist, so you need intelligence and context (what's abnormal?) rather than static rules (what's already known?).

No community discussion yet for this question.