← Years 9–10 Digital Systems

Zero-day vulnerabilities

A vulnerability that attackers know about before the software maker has released a fix. With no patch available yet, defenders rely on workarounds and monitoring.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 43, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 31

Understanding Zero-day vulnerabilities in Years 9–10 Digital Systems

What it does: Switching off the vulnerable feature is a workaround. It does not fix the flaw but it removes the way in. Monitoring checks for suspicious activity and raises an alert, which helps defenders spot an attack even though no patch exists. The 'zero' refers to the zero days the software maker has had to fix the problem before attackers can use it. A zero-day by definition has no fix yet, so installing a patch is not an option until the maker releases one. Workarounds reduce risk while waiting for a fix. Doing nothing leaves the system exposed. A workaround limits the risk without fixing the flaw itself. The official patch is the actual fix and is not yet available in a zero-day.

Common mistakes: A zero-day has no patch available yet, so patch_ready should start as false. Setting it to true means the program no longer describes a zero-day. Monitoring should continue while there is no patch. The loop condition should be no_patch = true, otherwise the monitoring never runs.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Zero-day vulnerabilities to a class →

This module's key terms are also in a printable crossword (Modules 41–69) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What makes a vulnerability a zero-day?
Attackers know about it before the software maker has released a fixIt was found on the first day a program was released
Matches
if patch_available == False: status = "safe"
↓
With no patch available, the system is not safe. A zero-day stays exploitable until the maker releases a fix, so the status should be "at risk".
Applying
Meanings
Term
zero-day
Meaning
A vulnerability that attackers know about before the software maker has released a fix. With no patch available yet, defenders rely on workarounds and monitoring.
Practice
IF flaw_known AND patch_available = false THEN
Testing
Gaps
patched ←
Check Answer
Spots
1patch_ready ← true
2IF patch_ready = false THEN

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Scorpion' badge — Venom Debugger, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What makes a vulnerability a zero-day?
A. Attackers know about it before the software maker has released a fix ✓
B. It was found on the first day a program was released
The 'zero' refers to the zero days the software maker has had to fix the problem before attackers can use it.
2. A zero-day is discovered. Which statement is true?
A. A patch is already installed on every device
B. No patch is available yet ✓
A zero-day by definition has no fix yet, so installing a patch is not an option until the maker releases one.
3. Which is the best way to deal with a zero-day when no patch exists?
A. Wait and do nothing until the patch arrives
B. Use a workaround, like turning off the risky feature ✓
Workarounds reduce risk while waiting for a fix. Doing nothing leaves the system exposed.
4. Why do defenders monitor systems during a zero-day?
A. To spot signs of an attack that has no known fix ✓
B. To make the software maker release the patch faster
Monitoring helps defenders detect suspicious activity, such as odd logins or unusual traffic, while the hole is still open.
5. Which is an example of a workaround?
A. Blocking access to the affected service in the firewall ✓
B. Installing the official patch from the maker
A workaround limits the risk without fixing the flaw itself. The official patch is the actual fix and is not yet available in a zero-day.

Match the Pairs

zero-day → A vulnerability that attackers know about before the software maker has released a fix
patch_available = False → No fix exists yet, so the system stays exposed to a zero-day until the maker releases one
A workaround reduces risk while no patch exists, for example by turning off the risky feature → disable_feature("file_preview")
Monitoring watches for signs of a zero-day attack, such as unusual logins or traffic, so defenders can respond quickly → alert_if(logins > 100)
if patch_available == False: status = "safe" → With no patch available, the system is not safe. A zero-day stays exploitable until the maker releases a fix, so the status should be "at risk".
zero_day = known_and_patched_flaw → A zero-day is not a flaw that has already been patched. It is a flaw attackers know about before the maker has released a fix.

Key Term

zero-day
A vulnerability that attackers know about before the software maker has released a fix. With no patch available yet, defenders rely on workarounds and monitoring.

Fill in the Blanks

1. known ← true patched ← false zeroDay ← known AND NOT patched
Hint: Type the Boolean value that shows the software maker has not released a fix yet
2. IF patched = false THEN applyWorkaround() ENDIF
Hint: Type the operator that checks whether a value is equal to another value
3. IF zeroDay THEN monitorLogs() ENDIF
Hint: Type the keyword that closes the decision block
4. IF known AND NOT patched THEN zeroDay ← true ENDIF
Hint: Type the keyword that comes after the condition and begins the actions to run
5. known ← true patched ← false zeroDay ← known AND NOT patched
Hint: Type the logical operator that needs both conditions to be true

Spot the Error

Question 1
A patch_ready ← true
B IF patch_ready = false THEN
C use_workaround()
D END IF
Line A — A zero-day has no patch available yet, so patch_ready should start as false. Setting it to true means the program no longer describes a zero-day.
Question 2
A no_patch ← true
B WHILE no_patch = false DO
C check_logs()
D END WHILE
Line B — Monitoring should continue while there is no patch. The loop condition should be no_patch = true, otherwise the monitoring never runs.
Question 3
A no_patch ← true
B IF no_patch THEN
C install_patch()
D END IF
Line C — With a zero-day there is no patch to install yet. A workaround such as disable_feature() is the correct action until the maker releases a fix.
Question 4
A FOR EACH log IN logs DO
B IF log = 'odd login' THEN
C delete_log()
D END IF
E END FOR
Line C — Monitoring means spotting suspicious activity and raising an alert. Deleting the log would destroy the evidence of a possible zero-day attack. It should be raise_alert().
Question 5
A vendor_fix ← 'none'
B IF vendor_fix = 'ready' THEN
C OUTPUT 'Zero-day risk'
D END IF
Line B — The zero-day risk exists when the vendor has no fix yet. The condition should check for 'none', not 'ready', or the message never prints for an unpatched flaw.

Student with a class code? Join your class →