What is an attack vector?

• A. A policy restricting user access.
• B. A path used to gain unauthorized access to a system.
• C. A method of encryption.
• D. A vulnerability in hardware.

Answer: (B)

An attack vector is the route an attacker uses to gain unauthorized access to a system. It describes the path or method an attacker exploits to reach a target, such as phishing emails that trick a user, drive-by downloads from compromised websites, unpatched software with known flaws, weak or reused passwords, exposed internet-facing services, or misconfigurations that leave an entry point open. Once the path is found, the attacker can deliver malware, steal data, or take control of the system.

A policy restricting user access is a defensive control, not the way into the system. A method of encryption is about protecting data, not breaching it. A hardware vulnerability is a possible weakness, but the attack vector specifically refers to the route or technique used to exploit weaknesses to gain entry, which can involve software, human factors, or configuration issues as entry points.