CS0-003 Vulnerability Management Practice Question
During a web application penetration test using Burp Suite, a security analyst identifies that an API endpoint accepts a URL parameter that is used to fetch data from an external resource. The application does not validate or sanitize the parameter. This is most likely vulnerable to which attack?
⚠ Common exam trap
CS0-004 often tests the confusion between SSRF and XXE or SQLi — candidates must recognize that a URL parameter used for server-side fetching without validation is the signature of SSRF, not injection into a database or XML parser.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-Side Request Forgery (SSRF)
When an application takes a user-supplied URL parameter and fetches content from it without validation, the server can be tricked into making requests to internal or external resources on the attacker's behalf. This is the classic definition of Server-Side Request Forgery (SSRF). The lack of validation or sanitization of the URL parameter is the key indicator, allowing attackers to reach internal metadata endpoints (e.g., 169.254.169.254) or internal services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection
Why it's wrong here
SQL injection requires unsanitized input to reach a database query interpreter, but the vulnerable parameter here is used to fetch an external resource, not to construct SQL statements, so there is no database query context for injected SQL syntax to exploit.
- ✓
Server-Side Request Forgery (SSRF)
Why this is correct
Because the unvalidated URL parameter is used server-side to fetch a resource, an attacker can substitute internal addresses, cloud metadata endpoints, or restricted URLs, forcing the server itself to issue requests it controls, which is the defining behavior of Server-Side Request Forgery.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
XSS requires unsanitized input to be reflected or stored and then rendered in a victim's browser so injected script executes client-side; this scenario involves the server itself fetching a resource based on the parameter, not a browser rendering attacker-controlled markup.
- ✗
XML External Entity (XXE)
Why it's wrong here
XXE specifically abuses a misconfigured XML parser that resolves external entity declarations within XML documents; the described flaw is a URL fetch parameter with no XML document or parser involved, so the XXE attack mechanism does not apply here.
Go deeper
Related to this question
Learn chapter
Security Metrics and KPIs
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
SSRF
A security vulnerability where an attacker tricks a server into making unauthorized requests to internal or external resources on behalf of the attacker.
About these practice questions
Courseiva writes every CS0-004 question from scratch — 701 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.