At a university, a public proof-of-concept script gains a shell on an unpatched lab server. What is that script?
Select an answer to reveal the explanation.
Short Explanation
A copied key that opens the door is the break-in method, separate from the worn lock and from the person holding the key. You call the proof-of-concept script an exploit. The trap is the missing patch, the student who might run it, or the department's risk appetite.
Full Explanation
An exploit is the method that uses a flaw. This public script gains a shell on the unpatched server, so the script is that method. The missing fix is the weakness the method uses. A person who might run the script is a threat actor. How much exposure the department accepts is a management choice. "An exploit: the method inside that public script, using the unpatched server flaw to gain a shell". The script is the method that uses the flaw to gain the shell, which is the exploit. "The missing patch: the vulnerability that left the lab server open before any code ran". The missing patch is the vulnerability, the weakness left on the server. The weakness is not the script that uses it. "The student who might run the script, a threat actor relative to the unpatched lab". A student who might run the script is a threat relative to the lab. The person is not the script. "The department risk appetite, the amount of lab exposure leadership is willing to accept". Risk appetite is how much exposure leadership will accept. That policy choice is not the proof-of-concept code. Exam caveat: keep the three words apart on this item. The unpatched state is the vulnerability, the script is the exploit, and a person who might run it is the threat. Operational check: attach the script to the lab ticket and record the shell it produced, separate from the missing-patch record.