Question 879 of 1,152

Threats, Vulnerabilities, and Mitigations →hardMultiple ChoiceObjective-mapped

Quick Answer

The answer is session hijacking, because the attacker is reusing a stolen bearer token to impersonate an authenticated user from a different location. This attack succeeds because the session token itself—not the password or MFA status—is the sole proof of identity; once captured from a browser cookie, it can be replayed from any IP address, including a VPN exit node, without triggering re-authentication. On the Security+ SY0-701 exam, this scenario tests your ability to distinguish session hijacking from credential theft or CSRF—a common trap is assuming a password reset alone stops all access, but tokens persist independently. Remember the key distinction: session hijacking exploits the token, not the credentials. A useful memory tip is “token replay equals hijack”—if the same token works from two countries, the session is stolen, not the password.

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

This SY0-701 practice question tests your understanding of threats, vulnerabilities, and mitigations. Examine the command output carefully: the correct answer depends on what the output actually shows, not on general recall alone. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.

A SaaS dashboard invalidates passwords after a forced reset, but a stolen bearer token from a browser cookie still works from a VPN exit node for several hours. SIEM logs show the same token value used from two countries within five minutes, and no MFA prompt appears because the token is already accepted. What attack is most likely?

Clue words in this question

Noticing these words before you look at the options changes how you read each choice.

Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

Question 1hardmultiple choice

Read the full VPN explanation →

A
Session hijacking, because a valid session token is being replayed from a different location.
Session hijacking is the best answer because the attacker is reusing a valid authenticated token rather than logging in normally. The token continues to work after a password reset, and the same token appears from different geographies in a short window. That strongly suggests the session itself was stolen and replayed, which bypasses authentication controls that only protect the login step.
B
Credential stuffing, because the attacker used many passwords against the portal.
Why wrong: Credential stuffing requires automated login attempts using previously leaked username and password pairs. This scenario is about a stolen session token, not repeated password submission.
C
Cross-site request forgery, because the attacker is making requests on behalf of the user.
Why wrong: CSRF causes the victim's browser to send an unwanted request, but it does not explain the reuse of a stolen bearer token from another country after a password reset.
D
Phishing, because the attacker likely stole the user's password first.
Why wrong: Phishing may be a precursor to token theft, but the attack being observed is token replay and session reuse. The question asks for the most likely active attack pattern.

Full breakdown with real-world context →

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Session hijacking, because a valid session token is being replayed from a different location.

Option A is correct because the scenario describes a stolen bearer token (session token) being reused from a different geographic location (VPN exit node) without re-authentication. This is classic session hijacking, where an attacker captures a valid session token (e.g., from a browser cookie) and replays it to impersonate the authenticated user. The fact that the token works even after a password reset and bypasses MFA confirms the attack is session hijacking, not credential theft or request forgery.

Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Session hijacking, because a valid session token is being replayed from a different location.
Why this is correct
Session hijacking is the best answer because the attacker is reusing a valid authenticated token rather than logging in normally. The token continues to work after a password reset, and the same token appears from different geographies in a short window. That strongly suggests the session itself was stolen and replayed, which bypasses authentication controls that only protect the login step.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
Credential stuffing, because the attacker used many passwords against the portal.
Why it's wrong here
Credential stuffing requires automated login attempts using previously leaked username and password pairs. This scenario is about a stolen session token, not repeated password submission.
✗
Cross-site request forgery, because the attacker is making requests on behalf of the user.
Why it's wrong here
CSRF causes the victim's browser to send an unwanted request, but it does not explain the reuse of a stolen bearer token from another country after a password reset.
✗
Phishing, because the attacker likely stole the user's password first.
Why it's wrong here
Phishing may be a precursor to token theft, but the attack being observed is token replay and session reuse. The question asks for the most likely active attack pattern.

Common exam traps

Common exam trap: answer the scenario, not the keyword

The trap here is that candidates confuse session hijacking with CSRF, but CSRF requires the victim's browser to send the request, whereas session hijacking involves the attacker directly using the stolen token from their own machine.

Trap categories for this question

Scenario analysis trap
Credential stuffing requires automated login attempts using previously leaked username and password pairs. This scenario is about a stolen session token, not repeated password submission.

Detailed technical explanation

How to think about this question

Bearer tokens in OAuth 2.0 or JWT-based authentication are stateless and often have no built-in binding to the client's IP or geolocation, making them vulnerable to replay if stolen. The SIEM logs showing the same token used from two countries within five minutes is a strong indicator of token theft and replay, as legitimate users cannot physically travel that fast. Real-world mitigations include token binding (e.g., using mTLS or JWT with cnf claim) and short token lifetimes with refresh token rotation.

KKey Concepts to Remember

Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.

TExam Day Tips

Watch for words such as best, first, most likely and least administrative effort.
Review why wrong options are wrong, not only why the correct option is correct.

Key takeaway

Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.

Real-world example

How this comes up in practice

An employee at a financial services firm receives an email that appears to come from the IT helpdesk, asking them to reset their password via a link. The link leads to a convincing fake portal that harvests credentials. Security teams use phishing simulations and security-awareness training to reduce this attack vector. Questions like this test whether you can identify social engineering techniques and appropriate controls.

What to study next

Got this wrong? Here's your next step.

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Related SY0-701 practice-question pages

Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.

General Security Concepts practice questions

Practise SY0-701 questions linked to General Security Concepts.

Threats, Vulnerabilities, and Mitigations practice questions

Practise SY0-701 questions linked to Threats, Vulnerabilities, and Mitigations.

Security Architecture practice questions

Practise SY0-701 questions linked to Security Architecture.

Security Operations practice questions

Practise SY0-701 questions linked to Security Operations.

Security Program Management and Oversight practice questions

Practise SY0-701 questions linked to Security Program Management and Oversight.

Security+ social engineering questions

Practise SY0-701 questions linked to Security+ social engineering questions.

Security+ cryptography practice questions

Practise SY0-701 questions linked to Security+ cryptography.

Security+ IAM questions

Practise SY0-701 questions linked to Security+ IAM questions.

Security+ risk management questions

Practise SY0-701 questions linked to Security+ risk management questions.

Security+ incident response questions

Practise SY0-701 questions linked to Security+ incident response questions.

Security+ malware questions

Practise SY0-701 questions linked to Security+ malware questions.

Security+ vulnerability management questions

Practise SY0-701 questions linked to Security+ vulnerability management questions.

Practice this exam

Start a free SY0-701 practice session

Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.

10 questions 20 questions 30 questions 50 questions Timed 30

SY0-701 practice-test guide →Study guide →Browse all practice tests

FAQ

Questions learners often ask

What does this SY0-701 question test?

Threats, Vulnerabilities, and Mitigations — This question tests Threats, Vulnerabilities, and Mitigations — Read the scenario before looking for a memorised answer..

What is the correct answer to this question?

The correct answer is: Session hijacking, because a valid session token is being replayed from a different location. — Option A is correct because the scenario describes a stolen bearer token (session token) being reused from a different geographic location (VPN exit node) without re-authentication. This is classic session hijacking, where an attacker captures a valid session token (e.g., from a browser cookie) and replays it to impersonate the authenticated user. The fact that the token works even after a password reset and bypasses MFA confirms the attack is session hijacking, not credential theft or request forgery.

What should I do if I get this SY0-701 question wrong?

Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.

Are there clue words in this question I should notice?

Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.

What is the key concept behind this question?

Read the scenario before looking for a memorised answer.

About these practice questions

Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Keep practising

Question Discussion

Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.

Loading comments…

This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.