SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A SaaS dashboard invalidates passwords after a forced reset, but a stolen bearer token from a browser cookie still works from a VPN exit node for several hours. SIEM logs show the same token value used from two countries within five minutes, and no MFA prompt appears because the token is already accepted. What attack is most likely?
⚠ Common exam trap
Many exam-takers confuse session hijacking with CSRF, but CSRF requires the victim's browser to send the request, whereas session hijacking involves the attacker directly using the stolen token from their own machine.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session hijacking, because a valid session token is being replayed from a different location.
The scenario describes a stolen bearer token (session token) being reused from a different geographic location (VPN exit node) without re-authentication. This is classic session hijacking, where an attacker captures a valid session token (e.g., from a browser cookie) and replays it to impersonate the authenticated user. The fact that the token works even after a password reset and bypasses MFA confirms the attack is session hijacking, not credential theft or request forgery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Session hijacking, because a valid session token is being replayed from a different location.
Why this is correct
Session hijacking is the best answer because the attacker is reusing a valid authenticated token rather than logging in normally. The token continues to work after a password reset, and the same token appears from different geographies in a short window. That strongly suggests the session itself was stolen and replayed, which bypasses authentication controls that only protect the login step.
- ✗
Credential stuffing, because the attacker used many passwords against the portal.
Why it's wrong here
Credential stuffing relies on automated login attempts that submit many previously breached username/password pairs until one succeeds. In this scenario, the user's password was forcibly reset, which would invalidate any stolen password, yet the attacker still maintained access through a valid session token. The evidence points to token replay, not repeated password guessing, so the attack does not match credential stuffing.
- ✗
Cross-site request forgery, because the attacker is making requests on behalf of the user.
Why it's wrong here
Cross-site request forgery (CSRF) tricks a user's browser into sending unwanted requests to a site where the user is authenticated, relying on cookies or other ambient credentials being attached automatically. It does not explain how a stolen bearer token reappears from a different geographic location after a password reset, because CSRF does not require the attacker to possess a copy of the session token. The attacker is actively replaying a hijacked session token, not coercing the victim's browser into making requests.
- ✗
Phishing, because the attacker likely stole the user's password first.
Why it's wrong here
Phishing is a social engineering technique used to trick a user into disclosing their password or other credentials, but after a forced password reset, any phished password would no longer be valid. The attacker's continued access via the same session token from an anomalous location indicates a session token was stolen and replayed, rather than a new login using a phished credential. While phishing could have been the original delivery vector, the active attack pattern being observed is session hijacking, not a password-based attack.
Go deeper
Related to this question
Learn chapter
Password Attacks
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.