What is a zero-day vulnerability?

• A. A security flaw known to the vendor with a patch available
• B. A security flaw that is unknown to the vendor and has no patch
• C. A vulnerability that is disclosed but not exploitable
• D. A flaw that only affects hardware systems

Answer: (B)

A zero-day vulnerability refers specifically to a security flaw that is unknown to the vendor or software developer at the time it is discovered and has no available patch or mitigation. This means that attackers can exploit this vulnerability without the vendor being aware of the issue or providing a remedy, thus leaving systems and users vulnerable until the flaw can be acknowledged, assessed, and patched.

The designation "zero-day" implies that the developers have zero days to fix the issue before it can be exploited in the wild. Security professionals and organizations must act quickly upon discovering such vulnerabilities because the window of opportunity for attackers could potentially lead to serious security breaches.

In contrast, the other options present scenarios that do not align with the definition of a zero-day vulnerability. For instance, if a flaw is known to the vendor and a patch is available, it would not be classified as a zero-day because there are measures in place to address the flaw. Similarly, a vulnerability that is disclosed but not exploitable does not fit the zero-day criteria, as it typically allows for some level of response or remediation. Finally, designating a flaw that only affects hardware systems does not capture the broader scope of zero-day vulnerabilities, which can exist in both software and hardware environments.