SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cross-site scripting (XSS)

  Why it's wrong here

  Cross-site scripting (XSS) enables attackers to inject malicious scripts into web pages that execute in a victim's browser, typically to hijack sessions, deface sites, or phish credentials. The exploit hinges on the browser interpreting attacker-controlled content as code, which is a client-side concept. Here, the URL parameter is used server-side to retrieve an image; even if the response is later displayed, the attack exploits the server's network position to access internal metadata, not the browser's script execution context.

• ✓

  Server-side request forgery (SSRF)

  Why this is correct

  Server-side request forgery (SSRF) lets an attacker manipulate server-side HTTP requests by supplying a crafted URL to access internal resources that are not directly reachable from the internet. In this cloud-hosted image processor, an attacker could set the URL to the cloud metadata service (e.g., 169.254.169.254) or internal admin panels, and the server's response or side effects can expose sensitive information. This is a direct match because the server inherently fetches the user-supplied URL, making it the core vulnerability.

• ✗

  Cross-site request forgery (CSRF)

  Why it's wrong here

  Cross-site request forgery (CSRF) relies on an attacker luring a victim's browser into sending a forged, authenticated request to a web application, thereby abusing the trust that the application has in the victim's session. It does not involve the server making requests to arbitrary URLs chosen by the attacker. In this scenario, the API itself is tricked into fetching a URL, not the user's browser, and there is no session authentication being hijacked; therefore, CSRF does not explain the vulnerability.

• ✗

  SQL injection

  Why it's wrong here

  SQL injection occurs when untrusted input is concatenated into a SQL query, allowing attackers to alter database operations such as extracting, modifying, or deleting records. In this API, the URL parameter is used to fetch an image from a remote server via an HTTP request, not to build a database query, so the injection payload would not reach a SQL parser. The vulnerability lies in the server's ability to make arbitrary outbound HTTP requests, not in the database layer.