Attackers are exploiting a flaw in a widely used email server that the vendor did not know about until today. No patch exists, and signature-based tools have no rule for it. Which defense is most likely to detect or contain the attack right now?
Select an answer to reveal the explanation.
Short Explanation
A zero-day means the defenders get zero days of warning -- no patch, no signature, nothing to match against. So you can't look for what the attack IS; you watch for what it DOES and fence in what it can reach. Any answer that leans on a patch or a signature is the trap.
Full Explanation
A zero-day vulnerability is one that is exploited before the vendor has released a fix, often before the vendor or the public is aware of it. Defenses that depend on prior knowledge of the specific flaw, such as patches, antivirus signatures and scanner checks, cannot help yet. Controls that do not need that knowledge remain effective: behavior-based and anomaly detection can flag unusual process activity, unexpected outbound connections or abnormal file changes on the server, and network segmentation limits where a compromised server can connect, containing lateral movement. Applying a vendor patch is impossible because none exists for this flaw, even if a monthly release has shipped. Adding a published signature fails for the same reason; no signature has been written for an attack nobody has analyzed. Running the vulnerability scanner will not find the flaw because scanner checks are built from known vulnerabilities, so the new flaw has no check yet. Exam caveat: once a patch or mitigation is published, the situation changes to an urgent known vulnerability, and normal patch processes apply. Operational check: review endpoint telemetry on the email servers for anomalous child processes, restrict their outbound traffic to required destinations, apply any vendor-recommended interim mitigation, and track the advisory for the fix.