Zero-day vulnerabilities

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What makes a vulnerability a zero-day?

A Attackers know about it before the software maker has released a fix

B It was found on the first day a program was released

2. A zero-day is discovered. Which statement is true?

A A patch is already installed on every device

B No patch is available yet

3. Which is the best way to deal with a zero-day when no patch exists?

A Wait and do nothing until the patch arrives

B Use a workaround, like turning off the risky feature

4. Why do defenders monitor systems during a zero-day?

A To spot signs of an attack that has no known fix

B To make the software maker release the patch faster

5. Which is an example of a workaround?

A Blocking access to the affected service in the firewall

B Installing the official patch from the maker

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1zero-day		AWith no patch available, the system is not safe. A zero-day stays exploitable until the maker releases a fix, so the status should be "at risk".
2patch_available = False		Balert_if(logins > 100)
3A workaround reduces risk while no patch exists, for example by turning off the risky feature		CA vulnerability that attackers know about before the software maker has released a fix
4Monitoring watches for signs of a zero-day attack, such as unusual logins or traffic, so defenders can respond quickly		Ddisable_feature("file_preview")
5if patch_available == False: status = "safe"		ENo fix exists yet, so the system stays exposed to a zero-day until the maker releases one
6zero_day = known_and_patched_flaw		FA zero-day is not a flaw that has already been patched. It is a flaw attackers know about before the maker has released a fix.

Definitions

zero-day

Fill in the Blanks

Complete each line of code by filling in the missing parts.

known ← true patched ← _____ zeroDay ← known AND NOT patched

IF patched _ false THEN applyWorkaround() ENDIF

IF zeroDay THEN monitorLogs() _____

IF known AND NOT patched ____ zeroDay ← true ENDIF

known ← true patched ← false zeroDay ← known ___ NOT patched

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A patch_ready ← true

B IF patch_ready = false THEN

C use_workaround()

D END IF

Question 2

A no_patch ← true

B WHILE no_patch = false DO

C check_logs()

D END WHILE

Question 3

A no_patch ← true

B IF no_patch THEN

C install_patch()

D END IF

Question 4

A FOR EACH log IN logs DO

B IF log = 'odd login' THEN

C delete_log()

D END IF

E END FOR

Question 5

A vendor_fix ← 'none'

B IF vendor_fix = 'ready' THEN

C OUTPUT 'Zero-day risk'

D END IF

Answer Key

Zero-day vulnerabilities

Section A: Quick Questions

A — Attackers know about it before the software maker has released a fix

B — No patch is available yet

B — Use a workaround, like turning off the risky feature

A — To spot signs of an attack that has no known fix

A — Blocking access to the affected service in the firewall

Section B: Match the Pairs

zero-day → A vulnerability that attackers know about before the software maker has released a fix

patch_available = False → No fix exists yet, so the system stays exposed to a zero-day until the maker releases one

A workaround reduces risk while no patch exists, for example by turning off the risky feature → disable_feature("file_preview")

Monitoring watches for signs of a zero-day attack, such as unusual logins or traffic, so defenders can respond quickly → alert_if(logins > 100)

if patch_available == False: status = "safe" → With no patch available, the system is not safe. A zero-day stays exploitable until the maker releases a fix, so the status should be "at risk".

zero_day = known_and_patched_flaw → A zero-day is not a flaw that has already been patched. It is a flaw attackers know about before the maker has released a fix.

Section C: Definitions

zero-day — A vulnerability that attackers know about before the software maker has released a fix. With no patch available yet, defenders rely on workarounds and monitoring.

Section D: Fill in the Blanks

known ← true
patched ← false
zeroDay ← known AND NOT patched

IF patched = false THEN
  applyWorkaround()
ENDIF

IF zeroDay THEN
  monitorLogs()
ENDIF

IF known AND NOT patched THEN
  zeroDay ← true
ENDIF

known ← true
patched ← false
zeroDay ← known AND NOT patched

Section E: Spot the Error

A — A zero-day has no patch available yet, so patch_ready should start as false. Setting it to true means the program no longer describes a zero-day.

B — Monitoring should continue while there is no patch. The loop condition should be no_patch = true, otherwise the monitoring never runs.

C — With a zero-day there is no patch to install yet. A workaround such as disable_feature() is the correct action until the maker releases a fix.

C — Monitoring means spotting suspicious activity and raising an alert. Deleting the log would destroy the evidence of a possible zero-day attack. It should be raise_alert().

B — The zero-day risk exists when the vendor has no fix yet. The condition should check for 'none', not 'ready', or the message never prints for an unpatched flaw.