Which term describes the collection of all potential points where an attacker could exploit vulnerabilities?

• A. Asset
• B. Attack Surface
• C. Authentication
• D. Backup

Answer: (B)

Attack surface is the collection of all potential points where an attacker could exploit vulnerabilities. This includes every path into the system—open ports, exposed services and interfaces, APIs, web forms, misconfigurations, and any other entry points created by software, hardware, or user interactions. By understanding and reducing the attack surface, you limit how many ways an attacker might gain access: you can disable unused services, close unnecessary ports, patch and harden software, validate all input, implement proper access controls, and segment networks to contain breaches. The other terms describe different ideas: an asset is something of value you aim to protect, authentication is the process of proving identity, and a backup is a copy of data kept for recovery. The concept described here specifically captures the breadth of possible intrusion paths, not the value of resources or how identity is verified.