CSSLP · Question #145
An attacker exploits actual code of an application and uses a security hole to carry out an attack before the application vendor knows about the vulnerability. Which of the following types of attack i
The correct answer is B. Zero-day. A zero-day attack exploits a software vulnerability that is unknown to the vendor, allowing an attacker to compromise a system before a patch can be developed and released.
Question
An attacker exploits actual code of an application and uses a security hole to carry out an attack before the application vendor knows about the vulnerability. Which of the following types of attack is this?
Options
- AReplay
- BZero-day
- CMan-in-the-middle
- DDenial-of-Service
How the community answered
(49 responses)- A2% (1)
- B90% (44)
- C6% (3)
- D2% (1)
Why each option
A zero-day attack exploits a software vulnerability that is unknown to the vendor, allowing an attacker to compromise a system before a patch can be developed and released.
A replay attack involves capturing valid data transmissions and maliciously repeating them later to gain unauthorized access or achieve a fraudulent outcome.
A zero-day attack refers to an exploit for a vulnerability that is unknown to the software vendor or public, meaning there has been "zero days" for the vendor to prepare a fix. Attackers leverage these undiscovered security holes to carry out their attacks before any patches are available.
A Man-in-the-middle (MitM) attack occurs when an attacker intercepts communication between two parties, impersonating each to the other to eavesdrop or alter messages.
A Denial-of-Service (DoS) attack aims to make a machine or network resource unavailable to its intended users by flooding it with traffic or exploiting a vulnerability to crash it.
Concept tested: Zero-day vulnerability-attack
Source: https://learn.microsoft.com/en-us/security/zero-trust/deploy/threat-protection-overview#what-is-a-zero-day-exploit
Topics
Community Discussion
No community discussion yet for this question.