At a bank, the internet-facing VPN appliance is powered on and reachable from outside the bank, and no specific software flaw has been named. What is that exposure called?
Select an answer to reveal the explanation.
Short Explanation
An unlocked door is not the same thing as a broken lock. You can reach this bank VPN from the internet, and no flaw has been named, so the exposure is the attack surface. The trap is calling reachability a vulnerability, an exploit, or a bad alert.
Full Explanation
Attack surface, the reachable VPN appliance an adversary can try, with no specific flaw named yet is the name for a service an adversary can reach and attempt. The bank VPN appliance is powered on and answers from the internet. Nobody has identified a defect in it, so the finding is the exposure, not a broken check inside the product. Attack surface is reduced by turning the service off, moving it off the internet, or limiting who may connect. That work does not require a published flaw. A vulnerability, a specific weakness already identified inside the bank VPN software would require a specific weakness, such as a missing fix or a check that does not hold. Reachability by itself does not name any weakness. An exploit, working attack code written against a named flaw in that VPN appliance is attack code that uses a weakness. Nothing in the scenario is a tool, a payload, or a procedure aimed at a named defect. A false positive, an alert that fired on VPN traffic the bank had actually allowed presupposes an alert on activity the bank meant to allow. No alert is described at all, so there is nothing to call false. Exam caveat: exposure can be reduced before anyone names a flaw in the software, and a flaw named later is a separate finding from the fact that the appliance was reachable. Operational check: list every bank service that answers from the internet and confirm each one is an intentional exposure with an owner.