SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A Java-based internal portal accepts a serialized object during profile import. After a recent test upload, the server made outbound LDAP calls and created a new local account. What attack pattern best explains this behavior?
⚠ Common exam trap
Many exam-takers confuse insecure deserialization with other injection attacks (SQLi or XSS) because all involve untrusted input, but only deserialization directly allows server-side object reconstruction and arbitrary method invocation without proper validation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure deserialization, because a crafted object triggered unexpected server-side actions.
The scenario describes a Java application accepting a serialized object during profile import, which is a classic vector for insecure deserialization attacks. By crafting a malicious serialized object, an attacker can trigger arbitrary code execution on the server, leading to outbound LDAP calls and local account creation—actions that are not part of normal profile import logic. This attack exploits the trust placed in serialized data without proper validation or integrity checks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection, because the attacker likely altered a database query.
Why it's wrong here
SQL injection occurs when an application concatenates untrusted input directly into a SQL statement, letting an attacker alter query logic, extract data, or bypass authentication. The scenario, however, begins with a serialized Java object being supplied to the portal and ends with server-side LDAP calls and local account creation — symptoms of code execution or object lifecycle manipulation, not a malformed database query. While the LDAP activity might ultimately touch a directory, the root cause is not SQL syntax modification.
- ✗
Cross-site scripting, because the attacker could have injected script into the portal.
Why it's wrong here
Cross-site scripting is a client-side vulnerability where an attacker causes malicious JavaScript to run in another user's browser, typically to steal cookies or perform actions as that user in the portal. There is no evidence of a victim's browser being involved, and the described LDAP lookups plus account creation occur on the server as a direct result of processing the serialized object. Insecure deserialization explains server-side behavior change without requiring script execution or browser delivery.
- ✓
Insecure deserialization, because a crafted object triggered unexpected server-side actions.
Why this is correct
Insecure deserialization occurs when an application accepts untrusted serialized data and rebuilds it unsafely. That can allow an attacker to trigger code paths, remote lookups, or even command execution, which matches the LDAP activity and account creation.
- ✗
CSRF, because the attacker may have forced an administrator to submit a form.
Why it's wrong here
CSRF attacks rely on an authenticated victim's browser automatically sending a forged request with valid session cookies, tricking the server into performing a state-changing action the user did not intend. Here the attacker appears to submit a crafted serialized object directly to the portal, and the impact is autonomous server-side activity (LDAP query, account creation) rather than a victim-initiated request. There is no mention of an admin session or browser being tricked, making CSRF an incorrect classification.
Go deeper
Related to this question
Learn chapter
Social Engineering Attacks
Key term
Lightweight Directory Access Protocol
Lightweight Directory Access Protocol (LDAP) is a standard protocol used to access and manage directory information over a network, such as user credentials and permissions.
Key term
LDAP
LDAP is a protocol used to access and manage directory information over a network, such as user accounts and permissions.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.