Question

During a security review, an analyst documents that the company's public web portal exposes an HTTP interface, an SSH management port, and an outdated content management system with a known unpatched flaw (CVE-2023-XXXX). A junior teammate asks how to correctly categorize these findings. Which statement accurately distinguishes the attack surface from a vulnerability in this scenario?

Accepted Answer

The exposed HTTP interface, SSH port, and CMS collectively make up the attack surface, while the unpatched CMS flaw is a specific vulnerability.

Answer

The unpatched CMS flaw is the attack surface, and the exposed ports are vulnerabilities that can be scanned.

Answer

All exposed services are vulnerabilities, and the attack surface only exists once an exploit is written for them.

Answer

The attack surface and the vulnerability are the same thing because both describe ways an attacker can gain access.