Free Vulnerability Types and Attack Surfaces practice questions

When a vendor has ended support and will ship no more fixes, the product is unsupported, and the real remedy is to upgrade or replace it, using compensating controls in the meantime. Applying the latest patches is the classic trap, because there are none to apply, and adding it to inventory or flipping a protocol does not restore vendor fixes.

A device whose old technology forces a legacy protocol on modern systems is obsolete, and its risk is judged by what it makes the rest of the network keep enabled, here SMBv1. Missing patches, inventory status, and the end-of-life date describe other conditions and miss the point that the scanner drags down systems around it.

A flaw with no fix yet, unknown to the vendor, is a zero-day, whereas an unpatched system has a fix that was released but never installed. The statements that equate the two, or that reverse which one has a patch, contradict the definitions, since the dividing line is whether a fix exists.

WannaCry struck systems two months after the fix shipped, showing that most exploitation falls in the patch lag between release and installation, which is why timely patching matters so much. It was not a zero-day, the hardest-hit machines were not all unsupported, and no default credential was involved in that flaw.

A system kept in service despite a known weakness needs a documented risk exception recording the controls, the owner who accepts the residual risk, and a review or expiry date, so a temporary exception does not quietly become permanent. Accepting it silently, removing monitoring, or trusting antivirus alone all leave the risk unmanaged.

Memory or storage handed to a new workload without being cleared, letting one tenant read another's leftover data, is resource reuse. VM escape crosses from a guest to the hypervisor, sprawl is forgotten unmanaged VMs, and guest privilege escalation stays within one VM, so none describes leftover data surfacing to a new owner.

Reverting to an old snapshot silently rolls back the patches, password changes, and account removals applied since it was taken, a snapshot-sprawl risk. VM escape and resource reuse involve crossing isolation boundaries between guest and host or between tenants, and a zero-day is an unpatched flaw, none of which is what reappeared here.

Containers share the host's single kernel, so a flaw in that kernel can let code break out of a container, which is weaker isolation than a VM with its own kernel. Containers can use network isolation and encryption, and they do not all run as root, so those statements are simply inaccurate.

Accepting an old protocol version and a weak cipher is a cryptographic vulnerability from leftover options, and the fix is to disable the old versions and suites, not merely prefer stronger ones, because leftover support is what a downgrade needs. The keys, the randomness, and the patch level are not what the scan flagged.

A signature value that must be fresh each time but was repeated let attackers derive the private key, which is weak randomness, since a predictable or reused value breaks even a sound algorithm. The algorithm itself was fine, the key was not mishandled in storage, and nothing was negotiated down, so the other classes do not fit.