Which could be described as a Threat Vector?

The correct answer is A. A web server left6 unpatched and vulnerable to XSS. A threat vector is the method (crafted packet) that would be used to exercise a vulnerability (fragmentation to bypass IDS signature). An unpatched web server that is susceptible to XSS simply describes a vulnerability (unpatched) paired with a specific threat (XSS) and does…

Defense-in-Depth and Security Architecture

Question

Options

AA web server left6 unpatched and vulnerable to XSS
BA coding error allowing remote code execution
CA botnet that has infiltrated perimeter defenses
DA wireless network left open for anonymous use

How the community answered

(39 responses)

A
90% (35)
B
5% (2)
C
3% (1)
D
3% (1)

Explanation

A threat vector is the method (crafted packet) that would be used to exercise a vulnerability (fragmentation to bypass IDS signature). An unpatched web server that is susceptible to XSS simply describes a vulnerability (unpatched) paired with a specific threat (XSS) and does not touch on the method to activate the threat. Similarly, the coding error that allows remote code execution is simply describing the pairing of a vulnerability with a threat, respectively. The botnet is an unspecified threat; there is no indication of how the threat was activated (or it's intention/capabilities; the threat).

Topics

#threat vector#attack surface#vulnerability#web server security

Community Discussion

No community discussion yet for this question.

Full GCED Practice