nerdexam
(ISC)2

CSSLP · Question #145

An attacker exploits actual code of an application and uses a security hole to carry out an attack before the application vendor knows about the vulnerability. Which of the following types of attack i

The correct answer is B. Zero-day. A zero-day attack exploits a software vulnerability that is unknown to the vendor, allowing an attacker to compromise a system before a patch can be developed and released.

Secure Software Concepts

Question

An attacker exploits actual code of an application and uses a security hole to carry out an attack before the application vendor knows about the vulnerability. Which of the following types of attack is this?

Options

  • AReplay
  • BZero-day
  • CMan-in-the-middle
  • DDenial-of-Service

How the community answered

(49 responses)
  • A
    2% (1)
  • B
    90% (44)
  • C
    6% (3)
  • D
    2% (1)

Why each option

A zero-day attack exploits a software vulnerability that is unknown to the vendor, allowing an attacker to compromise a system before a patch can be developed and released.

AReplay

A replay attack involves capturing valid data transmissions and maliciously repeating them later to gain unauthorized access or achieve a fraudulent outcome.

BZero-dayCorrect

A zero-day attack refers to an exploit for a vulnerability that is unknown to the software vendor or public, meaning there has been "zero days" for the vendor to prepare a fix. Attackers leverage these undiscovered security holes to carry out their attacks before any patches are available.

CMan-in-the-middle

A Man-in-the-middle (MitM) attack occurs when an attacker intercepts communication between two parties, impersonating each to the other to eavesdrop or alter messages.

DDenial-of-Service

A Denial-of-Service (DoS) attack aims to make a machine or network resource unavailable to its intended users by flooding it with traffic or exploiting a vulnerability to crash it.

Concept tested: Zero-day vulnerability-attack

Source: https://learn.microsoft.com/en-us/security/zero-trust/deploy/threat-protection-overview#what-is-a-zero-day-exploit

Topics

#Zero-day attack#Vulnerability#Exploit

Community Discussion

No community discussion yet for this question.

Full CSSLP Practice