The security administrator is observing unusual network behavior from a workstation. The workstation is
communicating with a known malicious destination over an encrypted tunnel. A full antivirus scan, with an
updated antivirus definition file, does not show any signs of infection.
Which of the following has happened on the workstation?
Known malware infection
The vulnerability was unknown in that the full antivirus scan did not detect it. This is zero-day vulnerability.
A zero-day vulnerability refers to a hole in software that is unknown to the vendor. This security hole is then
exploited by hackers before the vendor becomes aware and hurries to fix it—this exploit is called a zero-day
attack. Uses of zero day attacks can include infiltrating malware, spyware or allowing unwanted access to user
information. The term “zero day” refers to the unknown nature of the hole to those outside of the hackers,
specifically, the developers. Once the vulnerability becomes known, a race begins for the developer, who must