What is a zero-day vulnerability?

• A. A vulnerability that has been disclosed, but not yet patched
• B. A vulnerability that becomes known to the public after it has been exploited
• C. A previously unknown vulnerability that is exploited before being disclosed
• D. A vulnerability that exists without any public or private mitigation

Answer: (C)

A zero-day vulnerability refers specifically to a previously unknown security flaw in software or hardware that is targeted and exploited by attackers before the vendor has had the opportunity to develop and release a patch or fix. This scenario highlights the critical period during which attackers can exploit the vulnerability, as there is no defense in place because both the developers and the public are unaware of its existence.

The term "zero-day" signifies that the vulnerability has zero days of exposure, meaning it is not yet known or disclosed to those responsible for protecting systems, such as organizations and their security teams. This represents a significant security risk since there are no measures that can be taken to defend against an attack utilizing the zero-day vulnerability.

In contrast, vulnerabilities that are disclosed but not yet patched do not fit the criteria for zero-day vulnerabilities, as they are known and documented, even if they lack a fix. Moreover, a vulnerability that becomes public knowledge after it has been exploited indicates that the vulnerability was known only after the fact, rather than being an unknown entity until exploited. Similarly, a vulnerability without public or private mitigation suggests that while it may lack protection measures, it does not necessarily imply that it was previously unknown, which is central to the concept of a zero-day vulnerability.