SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A scan of a web server hosting an internal help-desk portal reports these findings: `/var/www/uploads` is world-writable by the application account, PHP files in that directory are executed by Apache, and the app allows users to upload images without content-type validation. Which issue should be remediated first to most reduce the chance of remote code execution?
⚠ Common exam trap
The trap here is that candidates may focus on the 'world-writable' aspect alone, but the critical chain is the combination of writable upload path, PHP execution, and lack of content-type validation, which together enable direct remote code execution; other options are valid security concerns but do not address the immediate RCE risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
World-writable executable upload path, because an attacker could upload or modify server-executable code in a web-accessible directory.
The combination of a world-writable upload directory, PHP execution in that directory, and no content-type validation allows an attacker to upload a malicious PHP file (e.g., a web shell) and execute it via the web server, achieving remote code execution. This directly exploits the server's trust in user-supplied files and the execution context of Apache, making it the most immediate and severe risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Outdated browser plug-in on an admin workstation, because it may expose users to drive-by attacks.
Why it's wrong here
An outdated browser plugin on an admin workstation primarily creates client-side exposure, such as drive-by downloads or credential theft when the admin visits a compromised site. However, the scan target is the internal help desk portal's web server, and the plugin's vulnerability would not let an attacker directly read, modify, or execute files on that server. To achieve server-side remote code execution, the attacker would need a vector that reaches the web application's runtime or file system, not just the browser's plugin sandbox. Thus, while it is a legitimate endpoint risk, it is not the most immediate or direct cause of server compromise in this scenario.
- ✗
Default SNMP community string on a printer in a separate VLAN, because it weakens network monitoring.
Why it's wrong here
A default SNMP community string on a printer in a separate VLAN is a real configuration weakness, but its impact is mostly limited to information disclosure about that networked device. If the printer is isolated in its own VLAN, an attacker who exploits it may not have a clear path to the web server, and SNMP does not normally provide a mechanism for arbitrary code execution on another host. The scan finding about a world-writable upload path is far more critical because it enables direct server-side code execution, whereas the SNMP issue would require multiple additional steps and lateral movement to become relevant. Therefore, this issue is a secondary risk that does not compete with the severity of the executable upload path.
- ✓
World-writable executable upload path, because an attacker could upload or modify server-executable code in a web-accessible directory.
Why this is correct
The world-writable, web-executable upload path is the most urgent issue because it creates a direct path to remote code execution. If an attacker can place or alter files in a directory that Apache executes, they may be able to run arbitrary server-side code. The lack of content-type validation increases the chance that a malicious payload will be accepted as a harmless file upload.
- ✗
Missing disk encryption on a help-desk laptop, because stolen devices are a common breach source.
Why it's wrong here
Missing disk encryption on a help-desk laptop is a serious issue if the device is lost or stolen, because it exposes sensitive data stored locally on that endpoint. However, this finding does not explain how an attacker could compromise the web server itself from a network scan. The scenario describes a scan of the server, not a physical theft, and the server's exposure is tied to its web-facing configuration, not endpoint encryption. Consequently, while disk encryption is a best practice for data-at-rest protection, it does not address the immediate remote code execution risk presented by a world-writable executable upload directory.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.