SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A SaaS portal issues signed JWTs in a browser cookie. The help desk confirms a user logged out at 09:10, but SIEM logs show the same token was accepted from a different IP at 09:12 and continued working until the token expired. The application does not keep a server-side revocation list. What weakness is most likely being abused?
⚠ Common exam trap
Many candidates confuse session hijacking with CSRF, but CSRF requires a forged request from a different site, not simply a different IP address, and the key issue is the lack of token revocation after logout.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session hijacking or session abuse, because the attacker can replay a valid token after logout without revocation.
The scenario describes a classic session hijacking or session abuse attack. The application issues signed JWTs in cookies and does not maintain a server-side revocation list, meaning once a token is issued, it remains valid until its expiration. Even after the legitimate user logs out at 09:10, the attacker can replay the same JWT from a different IP at 09:12, and the server will accept it because there is no mechanism to invalidate the token. This lack of revocation is the core weakness being exploited.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection, because the attacker must be manipulating backend database logic to reuse the token.
Why it's wrong here
SQL injection is a server-side attack that manipulates database queries by injecting hostile SQL syntax into input fields. Replaying a previously issued JWT after logout does not involve any SQL payload, nor does it require altering backend database logic; the attacker simply resubmits the same signed token. The session-hijacking scenario points to a flaw in token revocation or session state, not to database query manipulation.
- ✓
Session hijacking or session abuse, because the attacker can replay a valid token after logout without revocation.
Why this is correct
This is session hijacking or session abuse because the attacker is using a valid session token outside the original user context. JWTs are often stateless, so if the application does not track revocation, logout may not immediately invalidate a copied token. The cross-IP reuse after logout strongly suggests the token was stolen or replayed and remained acceptable until its normal expiration.
- ✗
Insecure deserialization, because the token is being decoded and reconstructed on the server.
Why it's wrong here
Insecure deserialization occurs when an application reconstructs objects from untrusted serialized data, often enabling object injection or gadget-chain attacks. A JWT is not a serialized object; it is a Base64URL-encoded JSON structure that is signed and parsed by the application, not deserialized into native objects. Replaying a token after logout is a session-management failure, not an unsafe deserialization of attacker-controlled data — the attacker does not craft a malicious object, they only resubmit a captured token.
- ✗
Cross-site request forgery, because the request is coming from a different IP address.
Why it's wrong here
Cross-site request forgery tricks a victim's browser into sending an authenticated request using ambient credentials, such as cookies, without the victim's intent. In this scenario, the request originates from a different IP address after logout, indicating the attacker is actively replaying a stolen token from their own client, not coercing the victim's browser. Additionally, if logout had invalidated the cookie, a CSRF attack would fail because no valid session would exist; the presence of a still-valid token after logout reinforces session-hijacking, not CSRF.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Access token
A digital key that a computer system gives you to prove your identity and grant you permission to access specific resources or perform actions.
Key term
SIEM
SIEM (Security Information and Event Management) is a system that collects and analyzes log data from across an IT environment to detect and respond to security threats in real time.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.