What is zero-day vulnerability?

• A. A vulnerability that is unknown to vendors and defenders; exploited before a patch is released, increasing risk.
• B. A vulnerability that has a patch available but not deployed.
• C. A vulnerability only in hardware devices.
• D. A vulnerability that is well-known and patched.

Answer: (A)

Zero-day vulnerability refers to a flaw that is unknown to vendors and defenders when attackers begin exploiting it. Because no one in the defense community has knowledge of the vulnerability or a patch yet, there’s no fix available and no defense ready, so attackers can weaponize it before a patch is released. This creates a window of heightened risk where systems can be compromised before anyone knows how to defend against it. Once the vendor becomes aware and releases a patch or workaround, it’s no longer zero-day.

This isn’t about patches that exist but aren’t deployed, hardware-only issues, or vulnerabilities that are already well-known and fixed—the opposite of zero-day.