SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A forum lets users save a profile signature. One user enters a string containing script code, and later other users who view that profile see the script run in their browsers. What attack is this?
⚠ Common exam trap
A common mix-up: candidates confuse stored XSS with reflected XSS or CSRF, but the key distinction is that the payload is permanently stored on the server and executed for every viewer, not just the attacker or a single victim.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-site scripting
This is a classic stored cross-site scripting (XSS) attack. The malicious script is permanently stored on the server (in the user's profile signature) and executed in the browsers of any other user who views that profile. The attack exploits the forum's failure to sanitize user input before rendering it in HTML, allowing arbitrary JavaScript to run in the victim's session context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cross-site scripting
Why this is correct
This is cross-site scripting because attacker-supplied script code is stored and then executed when other users view the content. The dangerous part is that the payload is delivered through a trusted website and runs in the victim's browser. Stored XSS is a common issue in profiles, comments, and forums.
- ✗
Command injection
Why it's wrong here
Command injection is a server-side attack where an attacker manipulates input that is passed to an operating system command interpreter (e.g., shell_exec, system, or exec). It results in arbitrary command execution on the host, not script execution inside a user's browser. Here, the malicious payload is stored in a profile signature and rendered as HTML/JavaScript for other clients; there is no indication that the server executes OS commands. The key distinction is the execution context: browser versus server process.
- ✗
CSRF
Why it's wrong here
CSRF (Cross-Site Request Forgery) tricks an authenticated user's browser into sending a forged, state-changing HTTP request (e.g., changing email, transferring funds) by abusing existing session cookies. It does not inject or execute attacker-supplied script code in the page. In this scenario, the attacker stores script in a signature that runs directly in the victim's browser, which is the definition of stored XSS, not a CSRF attack. XSS could be used as a vector to enable CSRF, but the root vulnerability here is unsafe rendering of user input, not a missing anti-CSRF token.
- ✗
Broken authentication
Why it's wrong here
Broken authentication refers to weaknesses in identity verification and session management, such as weak password policies, session fixation, credential stuffing, or predictable session tokens. It does not involve rendering unsafe user-generated content. Here, the attacker does not exploit a login or session flaw; they rely on the application's failure to sanitize a profile signature, allowing arbitrary script to execute in the context of any visiting user's session. The vulnerability is an injection/validation flaw, not an authentication weakness.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.