SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Cross-site scripting

  Why it's wrong here

  Cross-site scripting (XSS) injects malicious script into client-side content that executes in a victim's browser, typically because output is rendered without proper encoding. Here, submitting a single quote triggers a database error on the server, indicating that the input is being concatenated into a SQL query rather than reflected as HTML/JavaScript. XSS is a client-side injection; the described failure is a server-side syntax error, so the root cause is not script injection into pages.

• ✓

  SQL injection

  Why this is correct

  This is SQL injection because the application appears to concatenate unsanitized input into a database query. A single quote often breaks query syntax and reveals that user input is being interpreted as part of the SQL command. That is a common sign the application is vulnerable to injection attacks.

• ✗

  Session hijacking

  Why it's wrong here

  Session hijacking relies on stealing or predicting a valid session token to impersonate an authenticated user. The database error from a single quote occurs during the login query, before any session is issued or reused, and it is a direct result of malformed SQL rather than token theft. If a session were hijacked, the attacker would already possess a valid session cookie and would not trigger a SQL syntax error at the authentication step. This symptom points to an input-handling flaw, not a session-management weakness.

• ✗

  Insecure deserialization

  Why it's wrong here

  Insecure deserialization involves processing untrusted serialized objects (e.g., Java serialization or PHP object payloads) that can lead to logic tampering or remote code execution. A login form that sends raw user input directly to a database query shows no evidence of serialized data being passed to a deserializer; instead, the single quote disrupts the SQL statement's structure, which is the signature of SQL injection. The error is produced by the database engine, not by a deserialization runtime, so this attack class cannot explain the observed behavior.