SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A help desk technician reviews a ticket where a user says they logged out of the payroll portal, but another employee who found the session cookie in a browser debug log could still access the account until the session expired. Which attack best matches this behavior?
⚠ Common exam trap
A common mix-up: candidates confuse session hijacking with CSRF, but the key distinction is that session hijacking involves stealing and reusing an existing session token, whereas CSRF tricks the victim's browser into performing actions using the victim's own active session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session hijacking, because a stolen session token was reused to impersonate the user.
The described behavior—where a session cookie stolen from a browser debug log is reused by another employee to access the payroll portal—is a classic session hijacking attack. Session hijacking occurs when an attacker captures a valid session token (e.g., a cookie containing a session ID) and uses it to impersonate the authenticated user, bypassing the need for credentials. In this case, the session cookie was not invalidated upon logout, allowing the attacker to reuse it until the session's expiration time.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Session hijacking, because a stolen session token was reused to impersonate the user.
Why this is correct
Session hijacking is correct because the attacker obtained a valid session identifier—such as a session cookie—after the user authenticated, and then presented that same token to the web server in subsequent requests. This allows the attacker to fully impersonate the user without knowing their password, as the server only validates the session token to identify the user. The reuse of a stolen token is the defining characteristic of session hijacking, directly matching the scenario described.
- ✗
Pretexting, because the attacker pretended to be an authorized employee on a phone call.
Why it's wrong here
Pretexting is a social engineering technique where an attacker fabricates a scenario (the pretext) to manipulate a victim into revealing sensitive information or performing an action, relying on human trust and deception. The scenario given involves no such conversational manipulation; instead, it focuses on the technical reuse of an existing session token captured from a browser log. Even if a phone call had occurred, the root cause is the compromise and reuse of a session identifier, not deception over the phone.
- ✗
CSRF, because the victim was tricked into sending unwanted requests from their browser.
Why it's wrong here
Cross-Site Request Forgery (CSRF) works by tricking an authenticated user's browser into sending forged requests to a web application, with the browser automatically attaching the user's session cookies. The attacker does not need to steal or reuse the session token, because the victim's existing authenticated session is abused to perform unintended actions. Since the scenario specifically mentions a stolen session token being reused, it indicates session hijacking rather than CSRF, where no token theft or impersonation occurs.
- ✗
Insecure deserialization, because serialized objects were accepted without validation.
Why it's wrong here
Insecure deserialization is a server-side vulnerability where untrusted serialized data (e.g., binary, XML, or JSON objects) is deserialized without proper validation, enabling attackers to manipulate objects, execute code, or escalate privileges. This attack involves crafted serialized payloads sent to the application, not the reuse of a stolen session token from a browser log. The scenario centers on session token theft and impersonation, which is entirely unrelated to object deserialization flaws.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.