2.3 Explain various types of vulnerabilities

Domain 2: Threats, Vulnerabilities, and Mitigations

This objective catalogs weaknesses by where they live: application flaws (memory injection, buffer overflow, race conditions including TOC/TOU, malicious updates), operating system vulnerabilities, web issues (SQL injection, cross-site scripting), hardware problems (firmware, end-of-life, legacy), virtualization risks (VM escape, resource reuse), cloud-specific gaps, supply chain weaknesses across service providers and hardware and software suppliers, misconfiguration, mobile device risks (side loading, jailbreaking), and zero-day vulnerabilities. The exam tests recognition: given a description, name the vulnerability class. Learn the signature phrasing — a check that passes before the condition changes is TOC/TOU; a guest breaking into the hypervisor is VM escape; an unknown flaw with no patch is a zero-day. Keep vulnerabilities distinct from the attacks that exploit them; this objective is about the weakness itself. Legacy and end-of-life hardware questions usually hinge on the absence of vendor patches rather than any active exploit.

What you must know

common pitfall · Candidates conflate the vulnerability with the attack — a zero-day is the unpatched flaw itself, not the exploit code or the incident that uses it.

Try a sample question

Researchers observe active exploitation of a flaw in a popular web server. The vendor confirms it was previously unaware of the flaw, and no patch or advisory exists yet. Which type of vulnerability does this describe?

  • A End-of-life system vulnerability
  • B Misconfiguration
  • C Zero-day vulnerability
  • D Legacy application vulnerability
Show answer & explanations
  • A End-of-life vulnerabilities exist in products the vendor no longer supports or patches at all; this vendor still supports the web server and is simply unaware of the new flaw.
  • B A misconfiguration is an insecure setting introduced by administrators, such as open ports or overly permissive access rules, not an unknown defect in the vendor's own code.
  • C correct ·Correct. A zero-day is a vulnerability unknown to the vendor and to defenders that attackers exploit before any patch, signature, or mitigation guidance can be made available.
  • D Legacy vulnerabilities stem from outdated software that remains in use despite newer supported versions; this flaw was newly discovered in a currently maintained, widely deployed product.

sample item — the full bank runs 450+ questions at exam difficulty

Is objective 2.3 your weak spot?

The free readiness check finds your weakest objectives in 15 adaptive questions — then full access drills them until the gauge clears the cut line.

Check my readiness — free