Vulnerability Quiz: Zero-Day, Misconfig Or EOL?

1. A system administrator forgets to change default SSH passwords on new servers. What vulnerability type does this represent?

Zero-day vulnerability

Misconfiguration vulnerability

EOL system risk

Distributed denial-of-service attack

2. Vulnerability Types (Security+) include zero-days, misconfigurations, and EOL systems. Which is most preventable through proper administration?

Zero-day vulnerabilities

Misconfiguration vulnerabilities

All equally preventable

None can be prevented

3. A cloud service provider leaves S3 buckets publicly accessible. This misconfiguration allows:

Improved system performance

Unauthorized data exposure and potential data theft

Automatic encryption of stored data

Enhanced user authentication

4. The most effective defense strategy against all three vulnerability types (zero-day, misconfiguration, EOL) includes:

Relying solely on antivirus software

Defense-in-depth with monitoring, segmentation, and configuration reviews

Disconnecting all systems from the network

Only patching when vulnerabilities are discovered

5. When assessing vulnerability types, a security team discovers that a web application is running an outdated version with known exploits. This represents:

A zero-day vulnerability

A misconfiguration

A known vulnerability in EOL or unsupported software

A hardware failure

6. A vulnerability allowing unauthorized access due to missing input validation is classified as:

A zero-day vulnerability

A misconfiguration

An EOL issue

A physical vulnerability

7. An EOL system cannot receive security patches. The best long-term mitigation is to:

Accept the risk and monitor closely

Upgrade or retire the system

Disable all user accounts

Increase physical security around the device

8. Which of the following best describes the relationship between misconfigurations and security incidents?

Misconfigurations are rare and easily detected

Misconfigurations are a leading cause of breaches and often go unnoticed

Misconfigurations only affect small organizations

Misconfigurations cannot be exploited remotely

9. A zero-day vulnerability is typically disclosed to the public:

Immediately upon discovery

After the vendor releases a patch or a grace period expires

Never, for security reasons

Only to government agencies

10. Why is patch management critical for reducing EOL-related vulnerabilities?

Patches improve system performance

Regular patches address known vulnerabilities before exploitation

Patches prevent users from changing passwords

Patches eliminate the need for firewalls

11. A zero-day vulnerability is best defined as a security flaw that:

Has a known patch available but remains unpatched

Is unknown to the vendor and actively exploited before disclosure

Affects only legacy operating systems

Requires physical access to exploit

12. Which mitigation strategy is most effective against zero-day vulnerabilities?

Waiting for a patch to be released

Layered defense, network segmentation, and intrusion detection

Disabling all network access

Purchasing antivirus software

13. A database server is configured to accept connections from any IP address. This is an example of:

An EOL vulnerability

A zero-day exploit

A misconfiguration creating excessive exposure

A physical security breach

14. How do attackers typically discover zero-day vulnerabilities?

By reviewing public security advisories

Through independent research, reverse engineering, or bug bounty programs

By checking the vendor's website

They cannot be discovered before disclosure

15. An organization continues to run Windows Server 2003 for a critical application. What primary security risk does this pose?

The server will automatically shut down

No security updates are available, leaving it vulnerable to known exploits

The application will lose functionality

Users cannot access the network

16. Which vulnerability type is most likely to be discovered through security audits and configuration reviews?

Zero-day vulnerabilities

Misconfiguration vulnerabilities

Firmware bugs

Memory corruption flaws

17. Why are zero-day vulnerabilities particularly dangerous in enterprise environments?

They only affect Windows systems

No patch exists, making them extremely difficult to defend against

They require administrator privileges to exploit

They are automatically detected by antivirus software

18. A web server left with default credentials is an example of:

A zero-day exploit

A misconfiguration vulnerability

An EOL system issue

A privilege escalation attack

19. An end-of-life (EOL) operating system poses a security risk primarily because:

The vendor no longer releases security patches

It consumes too much disk space

It runs slower than newer versions

It prevents users from upgrading hardware

20. Which of the following is a common consequence of misconfigured firewall rules?

Unauthorized network access and data exposure

Automatic system patching

Increased encryption strength

Faster network performance

Vulnerability Quiz: Zero-Day, Misconfig or EOL?