A zero-day vulnerability and a vulnerability that has a patch available but remains unpatched mean exactly the same thing.

### Why this is right The statement is false. A zero-day refers to exploitation before a vendor patch is available, while a known weakness may remain unpatched even after a fix exists. ### The concept The distinction affects response choices. When no patch exists, an organization may need compensating controls such as isolation, restricted access, and enhanced monitoring. When a patch exists, risk-based prioritization and prompt, verified deployment are central. Both situations can be serious, but they have different remediation options and timelines. ### The other options - **The statement is false**: Patch availability is the key distinction between these conditions. ### Terms - **Compensating control**: An alternative safeguard used to reduce risk when the preferred fix is unavailable or impractical. ### Remember Ask whether a vendor fix exists before calling an exposure a zero-day.