2.3 - Vulnerability types
Security+ SY0-701 objective 2.3 covers the classes of weakness attackers exploit. A zero-day vulnerability is a flaw the vendor has no patch for and no prior public knowledge of, so it is especially dangerous. A buffer overflow writes past the bounds of an allocated memory region to corrupt adjacent data and can hijack execution. A race condition, including the time-of-check to time-of-use (TOCTOU) variant, happens when two processes check then use a shared resource with a timing gap. Other categories include memory injection, misconfiguration, weak or default credentials, unpatched legacy systems, and vulnerabilities in mobile, cloud, virtualisation and supply-chain components. You should recognise each from a short description. Expect scenario questions that describe how a flaw behaves and ask which vulnerability type it is, and sometimes which class of system is most exposed.
No patch, no prior knowledge = zero-day. Writing past allocated memory = buffer overflow. Check-then-use timing gap = race condition (TOCTOU). Also: misconfig, weak/default creds, unpatched legacy.
Practice questions
1. A software flaw with no vendor patch available yet is called a:
- A legacy configuration bug
- Zero-day vulnerability (correct answer)
- A scanner false positive
- A buffer overflow flaw
A zero-day has no patch yet, so signatures/defenses may not exist. Mitigate with layered defenses, monitoring and rapid patching once released.
2. Writing past the bounds of an allocated memory region to corrupt adjacent data is a:
- Cross-site request forgery
- Buffer overflow (correct answer)
- DNS cache poisoning
- Cross-site scripting
A buffer overflow writes beyond a buffer's bounds, corrupting memory or redirecting execution. Defenses: input/bounds checking, ASLR, DEP/NX, safe languages.
3. Two processes checking then using a shared resource with a timing gap creates which vulnerability?
- A cross-site scripting flaw
- A race condition (TOCTOU) (correct answer)
- A weak-cipher configuration
- An open-redirect flaw
A race condition (time-of-check to time-of-use) is exploited when state changes between the check and the use. Fixes: locking, atomic operations, proper synchronization.
4. Running an operating system past its end-of-life date is risky mainly because:
- It draws more electrical power at idle
- It no longer receives security patches (correct answer)
- It always runs noticeably faster
- It can no longer connect to any Wi-Fi
End-of-life/legacy systems stop getting security patches, so new vulnerabilities stay open. Isolate, compensate with controls, or upgrade/replace them.
5. A vendor's software update was tampered with before release, infecting all customers. This is a:
- An insider sabotage event
- A supply-chain attack (correct answer)
- A password-spray attack
- A directory-traversal attack
A supply-chain attack compromises a trusted vendor/component so the malware reaches many downstream customers. Mitigate with vendor vetting, code signing and SBOMs.
6. A scanner reports a flaw that manual testing proves is NOT actually exploitable. This result is a:
- A true positive finding
- A false positive result (correct answer)
- A false negative miss
- A zero-day discovery
A false positive is an alert for something not actually a threat. Validate scanner results, tune rules, and prioritize real (true positive) findings for remediation.