SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Broken authentication, because the application failed to verify the user again.

  Why it's wrong here

  Broken authentication is a broad category covering flaws in login, password recovery, session issuance, or invalidation. In this scenario, the application did fail to re-verify the user after the address change, but the decisive clue is the exact same session ID being reused from two distant locations. That points to an attacker possessing and replaying a valid session token, not to a failure at the initial authentication step. Session abuse is the more specific and accurate classification because the core issue is unauthorized use of an established session, not a generic authentication mechanism failure.

• ✓

  Session abuse, because a stolen or replayed session token allowed unauthorized actions.

  Why this is correct

  Session abuse is the best fit when an attacker reuses a valid token or session ID to impersonate a user. The address change without reauthentication strongly suggests the attacker hijacked an active session instead of successfully guessing a password.

• ✗

  Cross-site request forgery, because the attacker may have tricked the browser into sending a request.

  Why it's wrong here

  CSRF usually relies on a victim’s browser being tricked into making a request while already authenticated. It does not explain the same session ID appearing from two distant locations unless a token was actually stolen.

• ✗

  Credential stuffing, because the account was likely accessed using reused passwords.

  Why it's wrong here

  Credential stuffing relies on automated login attempts with leaked username/password pairs to gain access via password reuse. Here, the evidence is not a successful password-based login but the same session ID appearing from two distinct geographic locations, which indicates the attacker used an already-authenticated session token. If credential stuffing had occurred, we would expect logs to show a fresh authentication event before the malicious activity, not a reused session identifier. Thus, this is a session-level attack, not a password-level attack, making session abuse the correct answer.