Courseiva
Threats, Vulnerabilities, and MitigationshardMultiple ChoiceObjective-mapped

SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

A SaaS portal issues signed JWTs in a browser cookie. The help desk confirms a user logged out at 09:10, but SIEM logs show the same token was accepted from a different IP at 09:12 and continued working until the token expired. The application does not keep a server-side revocation list. What weakness is most likely being abused?

⚠ Common exam trap

Many candidates confuse session hijacking with CSRF, but CSRF requires a forged request from a different site, not simply a different IP address, and the key issue is the lack of token revocation after logout.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Session hijacking or session abuse, because the attacker can replay a valid token after logout without revocation.

The scenario describes a classic session hijacking or session abuse attack. The application issues signed JWTs in cookies and does not maintain a server-side revocation list, meaning once a token is issued, it remains valid until its expiration. Even after the legitimate user logs out at 09:10, the attacker can replay the same JWT from a different IP at 09:12, and the server will accept it because there is no mechanism to invalidate the token. This lack of revocation is the core weakness being exploited.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • SQL injection, because the attacker must be manipulating backend database logic to reuse the token.

    Why it's wrong here

    SQL injection is a server-side attack that manipulates database queries by injecting hostile SQL syntax into input fields. Replaying a previously issued JWT after logout does not involve any SQL payload, nor does it require altering backend database logic; the attacker simply resubmits the same signed token. The session-hijacking scenario points to a flaw in token revocation or session state, not to database query manipulation.

  • Session hijacking or session abuse, because the attacker can replay a valid token after logout without revocation.

    Why this is correct

    This is session hijacking or session abuse because the attacker is using a valid session token outside the original user context. JWTs are often stateless, so if the application does not track revocation, logout may not immediately invalidate a copied token. The cross-IP reuse after logout strongly suggests the token was stolen or replayed and remained acceptable until its normal expiration.

  • Insecure deserialization, because the token is being decoded and reconstructed on the server.

    Why it's wrong here

    Insecure deserialization occurs when an application reconstructs objects from untrusted serialized data, often enabling object injection or gadget-chain attacks. A JWT is not a serialized object; it is a Base64URL-encoded JSON structure that is signed and parsed by the application, not deserialized into native objects. Replaying a token after logout is a session-management failure, not an unsafe deserialization of attacker-controlled data — the attacker does not craft a malicious object, they only resubmit a captured token.

  • Cross-site request forgery, because the request is coming from a different IP address.

    Why it's wrong here

    Cross-site request forgery tricks a victim's browser into sending an authenticated request using ambient credentials, such as cookies, without the victim's intent. In this scenario, the request originates from a different IP address after logout, indicating the attacker is actively replaying a stolen token from their own client, not coercing the victim's browser. Additionally, if logout had invalidated the cookie, a CSRF attack would fail because no valid session would exist; the presence of a still-valid token after logout reinforces session-hijacking, not CSRF.

About these practice questions

One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.