ITPEC IP April 2024 Question 35

An attack exploiting a vulnerability before a countermeasure for it is made public — "zero day" is the number of days the defenders have had to fix it.

When a vulnerability is found in software, the vendor develops a security patch or workaround and makes it public. Day one is the day the fix appears. An attack that uses the vulnerability before that day, while it is unknown to the vendor or known but not yet fixed, is a zero-day attack. Applying patches cannot stop it, because no patch exists yet, so defences such as behaviour-based detection and limiting privileges matter.

Answer (c)

Why not others:

• •(a) — how soon the target system stops has nothing to do with the term; zero day refers to the fix, not to the damage
• •(b) — a virus that acts immediately without an incubation period describes the malware's behaviour, not a zero-day attack
• •(d) — obtaining confidential information by deceiving people or by eavesdropping is social engineering or wiretapping, not the exploitation of an unfixed software vulnerability

Key rule: A zero-day attack strikes in the window between the discovery of a vulnerability and the release of its fix, which is why prompt patching alone is not enough.

Security · AI-written, may contain errors