nerdexam
GIAC

GSEC · Question #27

One of your Linux systems was compromised last night. According to change management history and a recent vulnerability scan, the system's patches were up-to-date at the time of the attack. Which of t

The correct answer is A. It was a zero-day exploit.. A fully patched system being compromised indicates exploitation of an unknown vulnerability with no available patch - the definition of a zero-day.

Incident Handling, Risk, and Governance

Question

One of your Linux systems was compromised last night. According to change management history and a recent vulnerability scan, the system's patches were up-to-date at the time of the attack. Which of the following statements is the Most Likely explanation?

Options

  • AIt was a zero-day exploit.
  • BIt was a Trojan Horse exploit.
  • CIt was a worm exploit.
  • DIt was a man-in-middle exploit.

How the community answered

(39 responses)
  • A
    74% (29)
  • B
    15% (6)
  • C
    3% (1)
  • D
    8% (3)

Why each option

A fully patched system being compromised indicates exploitation of an unknown vulnerability with no available patch - the definition of a zero-day.

AIt was a zero-day exploit.Correct

A zero-day exploit targets a security vulnerability that is unknown to the vendor and for which no patch exists at the time of attack. Because the system's patch state was confirmed current, all known, patchable vulnerabilities were remediated, and only an unknown zero-day vulnerability could explain the successful compromise. This attack type bypasses patch management controls entirely.

BIt was a Trojan Horse exploit.

A Trojan Horse requires a user to deliberately or unknowingly execute malicious code and does not inherently depend on unpatched system vulnerabilities, making it inconsistent with the patch-status evidence.

CIt was a worm exploit.

A worm propagates by exploiting known, documented network vulnerabilities, which an up-to-date patched system would typically be protected against.

DIt was a man-in-middle exploit.

A man-in-the-middle attack intercepts network communications in transit and does not exploit host-level vulnerabilities, making the system's patch status largely irrelevant.

Concept tested: Zero-day exploit identification from patch context

Source: https://csrc.nist.gov/glossary/term/zero_day_vulnerability

Topics

#zero-day exploit#patch management#vulnerability analysis#incident analysis

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GSEC Practice