Zero-day vulnerability — SY0-701

WHAT IT IS

A zero-day attack is "an attack that exploits a previously unknown hardware, firmware, or software vulnerability" (CNSSI 4009-2015; NISTIR 8011 Vol. 3, via NIST CSRC Glossary). The defining word is previously unknown — meaning the vendor of the affected product has not yet identified the weakness, so no patch exists at the moment the attack occurs.

The underlying weakness is itself a vulnerability: a "weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source" (FIPS 200, adapted from CNSSI 4009, via NIST CSRC Glossary). A zero-day vulnerability is a vulnerability of this kind that has not yet been disclosed to or acknowledged by the vendor.

Mental model

Think of the lifecycle in four stages: the vulnerability exists in the software, an attacker discovers it before the vendor does, the attacker exploits it while no patch is available, and only later does the vendor learn of the flaw and release a fix. The "zero" refers to the number of days the vendor has had to respond — zero days of warning, zero days to patch.

The red stage is what makes a zero-day attack distinct: exploitation happens before disclosure, so normal patch management cannot prevent it.

When to use it

Scenario	Zero-day vulnerability	Known (n-day) vulnerability
Vendor awareness at time of attack	Vendor is unaware	Vendor has published an advisory
Patch availability at time of attack	No patch exists	A patch is available (or in progress)
Defender's primary response option	Detective and compensating controls (e.g., behavioral monitoring, network segmentation)	Patch management: "the systematic notification, identification, deployment, installation, and verification of operating system and application software code revisions" (CNSSI 4009-2015)
Risk driver	Lack of knowledge (unknown weakness)	Lack of action (known weakness, unpatched)

Use "zero-day" only when the vulnerability is previously unknown to the vendor at the time of exploitation. If a patch already exists, the attack exploits a known vulnerability, not a zero-day.

COMMON MISCONCEPTION

Candidates often treat "zero-day" as a synonym for "very new" or "very dangerous." The term is not about severity and not about how recently the vulnerability was introduced into the code. A vulnerability that has lived undetected in software for years is still a zero-day at the moment it is first exploited, because the vendor has had zero days to respond. Conversely, a critical vulnerability disclosed yesterday is no longer a zero-day once the vendor acknowledges it and issues an advisory — it becomes a known vulnerability even before a patch is available.

A related trap: assuming that deploying a patch fully eliminates zero-day risk. Patch management addresses known weaknesses. By definition, there is no patch for an unknown vulnerability, so patch management alone cannot mitigate zero-day exposure.

How it shows up on the exam

Questions targeting this concept typically probe whether candidates understand the knowledge gap as the defining characteristic. A scenario might describe an attack in which the software vendor was unaware of the flaw and no update existed — the cognitive task is recognizing that condition, not just matching the word "new" to "zero-day."

Candidates are also tested on appropriate response strategies. Because patch management (systematic deployment of vendor-released fixes) cannot address a flaw the vendor does not yet know about, questions may ask what a defender can do: compensating controls, behavioral detection, and network segmentation are grounded responses that do not depend on vendor knowledge. Watch for distractors that suggest applying a patch as the primary control when no patch has been released.

Signal phrases in scenario stems that point toward zero-day: "the vendor was not aware," "no patch was available," "previously unknown flaw," "no advisory had been issued."

Related concepts

• Memory vulnerabilities — a category of weakness (e.g., buffer overflows) that attackers frequently exploit through zero-day attacks before a patch exists.
• Race conditions — another class of implementation weakness that can exist undetected until exploited, sharing the "unknown until triggered" characteristic with zero-days.
• SQL injection — a well-documented attack technique; contrasting it with zero-days illustrates that most known attack classes have established defenses precisely because they are no longer unknown.