Chapter 39 · Quiz

Zero-Day Vulnerabilities Quiz

Seven questions covering the zero-day lifecycle, why defenses fail, CVE, real-world examples, and what actually works.

Q1. Which of the following BEST defines a zero-day vulnerability?

A. A vulnerability that has existed in software for zero days before being discovered B. A vulnerability that is unknown to the vendor, giving them zero days to prepare a patch C. A vulnerability that requires zero technical skill to exploit D. A vulnerability that is patched within zero days of being discovered by the vendor

Q2. A security analyst investigates an endpoint that is fully patched and running current antivirus software. The antivirus returns clean results, but the analyst observes a browser process spawning unexpected child processes and making outbound connections to an unknown IP address. Which of the following BEST explains the antivirus returning a clean result?

A. The antivirus engine is corrupted and needs to be reinstalled B. The endpoint has not yet downloaded the latest antivirus signature updates C. The attack may be a zero-day exploit with no known signature for the antivirus to match against D. The antivirus is scanning the wrong process and should be directed at the child process

Q3. In May 2023, Microsoft patched a zero-day vulnerability in which an attacker could run self-signed code during the UEFI boot process. Why is this class of vulnerability particularly dangerous compared to a vulnerability in a standard application?

A. UEFI vulnerabilities are harder to exploit because they require physical access to the target hardware B. Code executing at the UEFI level runs before the OS loads, making it invisible to OS-level security tools and allowing malware to persist even after the OS is reinstalled C. UEFI vulnerabilities only affect the boot speed of the system, not its security posture D. UEFI attacks are detected by standard antivirus because firmware changes trigger a signature match

Q4. An organization learns that a critical zero-day vulnerability in their web server software is being actively exploited in the wild, but the vendor has not yet released a patch. Which of the following represents the MOST appropriate immediate response?

A. Wait for the vendor to release a patch before taking any action, to avoid disrupting production systems B. Uninstall the web server software entirely and rebuild all servers from scratch C. Apply compensating controls: implement a WAF or network-layer restrictions to block known exploit patterns, segment the web servers from internal systems, and increase behavioral monitoring on those hosts D. Update antivirus signatures on all web servers — this will block the exploit once new signatures are available

Q5. A patch manager reviews a monthly security update containing 38 CVEs. One High-severity CVE is flagged as "actively exploited in the wild." Two Critical-severity CVEs are not flagged as actively exploited. In what order should these three CVEs be prioritized for patching?

A. Critical CVEs first (by severity score), then the High CVE B. The actively exploited High CVE first, then the two Critical CVEs C. All three should be patched simultaneously in a single maintenance window D. Severity score is the only relevant factor; patch in order Critical, Critical, High regardless of exploitation status

Q6. Which security control is MOST effective at detecting a zero-day attack in progress when no signature exists for the exploit?

A. Signature-based antivirus with automatically updated definitions B. A firewall with deep packet inspection rules for known attack patterns C. Endpoint detection and response (EDR) with behavioral monitoring D. Patch management with a 30-day SLA for critical vulnerabilities

Q7. Match each zero-day example to its primary technical characteristic.

Click each term on the left, then click its match on the right.

Match each item on the left with its correct characteristic on the right:

April 2023 Chrome zero-day

May 2023 Microsoft zero-day

May 2023 Apple iOS (one of three)

CVE system

A. Allowed self-signed code to run before the OS loads; enabled firmware rootkits that survive reinstallation

B. Memory corruption combined with sandbox escape; allowed code to break out of browser isolation to the OS

C. Public database at cve.mitre.org assigning unique identifiers to disclosed vulnerabilities for tracking and prioritization

D. Arbitrary code execution on mobile devices — allowed attacker-chosen code to run on iPhones and iPads

Click an item on the left to select it, then click its match on the right.