A zero-day exploit targets a previously unknown software vulnerability. Because the vulnerability is unknown to the software vendor, no patch exists, and signature-based security tools like antivirus are unaware of the threat. The scenario describes a fully patched and updated computer being compromised without any user error and without detection by antivirus software. This perfectly aligns with the characteristics of a zero-day attack, which bypasses conventional, signature-based, and patch-dependent security measures by exploiting a flaw for which no defense has yet been developed.

A. Blended threat: This describes malware combining multiple attack types (e.g., worm, virus). It does not explain how a fully patched system was initially compromised.

B. Trojan horse: This method requires the user to be deceived into running malicious software disguised as a legitimate program, which the scenario explicitly rules out.

C. Spear phishing: This is a social engineering attack that relies on tricking a specific user into taking an action, which the worker in the scenario did not do.

1. National Institute of Standards and Technology (NIST). (n.d.). Glossary: Zero Day Exploit. Computer Security Resource Center. Retrieved from https://csrc.nist.gov/glossary/term/zerodayexploit.

Reference Point: The NIST glossary defines a zero-day exploit as "An exploit that takes advantage of a zero-day vulnerability," and a zero-day vulnerability as one "for which a patch is not available." This directly supports the conclusion that an attack on a fully patched system points to a zero-day.

2. Von Solms, R., & van Niekerk, J. (2013). From information security to cyber security. Computers & Security, 38, 97-102. https://doi.org/10.1016/j.cose.2013.04.004

Reference Point: Section 3, "The cyber security environment," discusses new-generation threats, including zero-day attacks, which are characterized by their ability to bypass traditional security measures because they are unknown to defenders.

3. MIT OpenCourseWare. (2014). 6.858 Computer Systems Security, Fall 2014. Massachusetts Institute of Technology.

Reference Point: Lecture 1: "Threat models," discusses the nature of vulnerabilities and exploits. The lecture materials explain that exploits target vulnerabilities, and a zero-day exploit is one that targets a vulnerability before a patch is released, making it effective against systems that are otherwise considered "up-to-date."