SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Dependency compromise

  Why this is correct

  Dependency compromise happens when a trusted third-party library, package, or component is altered to include malicious behavior. The unusual outbound connections after an update are a strong sign that the dependency may have been tampered with.

• ✗

  Phishing

  Why it's wrong here

  Phishing is a social-engineering technique that relies on deceptive messages, often email or SMS, to trick users into revealing credentials or installing malware via user interaction. The scenario involves no human target being manipulated by a message; instead, the malicious behavior appears inside a trusted software library after an automated dependency update, indicating a supply-chain vector rather than a user-facing deception attack.

• ✗

  Rootkit infection

  Why it's wrong here

  A rootkit is a stealthy malware type designed to conceal its presence and maintain persistent, privileged access to a host, often by hooking system calls or kernel objects. The evidence given is limited to unusual outbound connections following a library update, with no mention of file hiding, privilege escalation, or system tampering that would be characteristic of a rootkit; the direct cause is the altered dependency itself, not a stealth-focused implant on the endpoint.

• ✗

  Password spraying

  Why it's wrong here

  Password spraying is an authentication attack that attempts a few common passwords across many user accounts to avoid lockout thresholds. This scenario has no indication of credential guessing, account enumeration, or brute-force attempts; instead, the compromise is tied to a legitimate application update pulling in a module that establishes malicious communication. The attack surface is code integrity, not the authentication system.