問題文
A server exposes a management interface on port 22, a web interface on port 443, and nothing else. The web software has a documented flaw in how it parses one header. Which statement separates the attack surface from the vulnerability here?
選択肢
- The two reachable ports form the attack surface, whereas the parsing flaw is the vulnerability.
- Both terms describe the same single measurement, expressed once as a count of open ports and once as a single count of findings.
- The attack surface is zero because both ports require credentials, and an entry point that refuses anonymous requests is not part of it.
- The parsing flaw is the attack surface because it is the point where the attacker interacts with the software, and the two ports are the vulnerability because leaving a port open is itself a weakness that a scanner will report.