Which statement best distinguishes a threat vector from an attack surface?
- AA threat vector is the specific path or method an attacker uses to reach a target, while the attack surface is the sum of all points where an attacker could attempt entry. Correct
- BA threat vector is the inventory of vulnerable services exposed to the internet, while the attack surface is the chosen exploit code an adversary deploys against a target.
- CA threat vector is the financial impact of a successful breach, while the attack surface is the technical control set used to reduce that impact.
- DA threat vector is identical to a threat actor's motivation, while the attack surface refers to the actor's available time and resources.
Why A is correct: This correctly separates the two ideas: the vector is the route taken (a phishing email, a USB drop, a vulnerable port), while the attack surface is the aggregate of exposed entry points such as services, accounts, and interfaces.
Why B is wrong: This is tempting because both phrases involve exposure and exploitation, but it inverts the definitions: the inventory of exposed services is the attack surface, and exploit code is a payload, not a vector.
Why C is wrong: This conflates risk and controls with vectors and surfaces; impact is a consequence, and controls are mitigations, neither of which fits the doctrinal meanings of these two terms.
Why D is wrong: Motivation and resources describe the threat actor profile, not the vector or the surface, so this answer mislabels actor characteristics as architectural concepts.