Security+ topic 2.4
Vulnerabilities and Attack Surfaces
The attack surface is every place a system could be attacked, and each kind of system has its own weaknesses. Applications suffer buffer overflows, memory injection, and race conditions such as time-of-check to time-of-use (TOCTOU). Web apps face injection and cross-site scripting. Operating systems and firmware need patches, and end-of-life hardware stops getting them. Virtual machines can face VM escape, cloud systems are often exposed by misconfiguration such as public storage, and weak or outdated cryptography can be broken. Mobile devices face sideloading and jailbreaking. A zero-day is a flaw attackers use before the vendor has a fix, so layered defenses matter even when everything is patched.
Vulnerabilities and Attack Surfaces vocabulary
- Attack surface: All the points where an attacker could try to get into a system.
- Zero-day: A vulnerability that is exploited before the vendor has released a fix.
- Race condition: A flaw where the result depends on the timing of events, such as TOCTOU.
- VM escape: Breaking out of a virtual machine to reach the host or other virtual machines.
Exam-style practice questions
Try each one, then open the answer. To save your progress, take this quiz in the interactive course.
1. Attackers exploit a flaw in a VPN appliance before the vendor knows about it or has released a patch. Which of the following describes this vulnerability?
- (A) A misconfiguration
- (B) A zero-day
- (C) End-of-life hardware
- (D) A race condition
Show answer
(B) A zero-day A flaw exploited before a fix exists is a zero-day.
2. A cloud storage bucket containing customer records is accidentally set to allow public access. Which of the following vulnerability types is this?
- (A) Buffer overflow
- (B) Misconfiguration
- (C) Zero-day
- (D) Memory injection
Show answer
(B) Misconfiguration A wrong setting that exposes data is a misconfiguration.
3. A program checks that a user may open a file, but an attacker swaps the file between the check and the moment the program opens it. Which of the following is this?
- (A) Time-of-check to time-of-use
- (B) SQL injection
- (C) Directory traversal
- (D) Privilege creep
Show answer
(A) Time-of-check to time-of-use Changing a resource between the check and its use is a TOCTOU race condition.
4. A company's network switches reached end of life last year. Which of the following is the main security concern?
- (A) They will use more power
- (B) They no longer receive security patches
- (C) They cannot be encrypted
- (D) They are too fast for the firewall
Show answer
(B) They no longer receive security patches End-of-life devices stop getting fixes, so new vulnerabilities stay open.