SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst is investigating a series of alerts from the web application firewall. Users are reporting that when they view a product review page on the company's e-commerce site, their browser automatically redirects to a malicious website. The analyst examines the database and finds that a product review submitted by a user contains a <script> tag that loads a JavaScript file from an external domain. Which type of attack has occurred?
⚠ Common exam trap
Many exam-takers confuse stored XSS with CSRF because both involve user interaction and redirects, but stored XSS is about injecting persistent client-side code, while CSRF forges requests without injecting scripts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Stored cross-site scripting (XSS)
The attack is stored cross-site scripting (XSS) because the malicious <script> tag was permanently stored in the product review database. When any user views the product review page, the browser loads and executes the external JavaScript file from the attacker's domain, causing an automatic redirect to a malicious website. This matches the classic stored XSS pattern where payload persists in server-side storage and executes in the victim's browser context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site request forgery (CSRF)
Why it's wrong here
CSRF attacks trick a user's browser into making an unwanted request to a web application in which the user is authenticated, often resulting in actions like changing a password or making a transaction. The described scenario involves script injection and automatic redirects, not unauthorized action requests.
When this WOULD be correct
A user is logged into their banking site and clicks a link that submits a fund transfer request without their knowledge. The question would describe the user being authenticated and the attack leveraging that session to perform actions on their behalf.
- ✓
Stored cross-site scripting (XSS)
Why this is correct
Stored (persistent) XSS occurs when untrusted input, such as a product review, is saved by the server and later rendered as executable JavaScript in the browsers of all visitors to that page. Because the payload is embedded directly in the stored HTML and retrieved from the database on each page load, it executes in the victim's session context without requiring a crafted URL. This enables attackers to steal cookies, impersonate users, or modify page content, making it significantly more damaging than reflected XSS, which relies on a one-time request and isn't persistent.
- ✗
SQL injection
Why it's wrong here
SQL injection targets the database layer by manipulating SQL queries through user input. While it could be used to insert malicious scripts, the symptom described (automatic browser redirect from a web page) is directly caused by client-side script execution, not database manipulation.
When this WOULD be correct
A question where an attacker inputs SQL commands into a web form (e.g., login field) to manipulate the database, such as bypassing authentication or extracting data, and the application does not sanitize inputs.
- ✗
Reflected cross-site scripting (XSS)
Why it's wrong here
Reflected XSS involves malicious script reflected from the web server, typically via a URL parameter or form input, and it is not stored permanently. In this case, the script was found in the database and affects all users visiting the page, which indicates stored XSS.
When this WOULD be correct
Reflected XSS would be correct if the malicious script is embedded in a URL (e.g., in a search query or error message) and the server reflects it back without proper sanitization, causing the browser to execute it. For example, a user clicks a crafted link like https://example.com/search?q=<script>alert('XSS')</script> and the script executes in the response.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Stored cross-site scripting (XSS)Correct answer▾
Why this is correct
Stored (persistent) XSS occurs when untrusted input, such as a product review, is saved by the server and later rendered as executable JavaScript in the browsers of all visitors to that page. Because the payload is embedded directly in the stored HTML and retrieved from the database on each page load, it executes in the victim's session context without requiring a crafted URL. This enables attackers to steal cookies, impersonate users, or modify page content, making it significantly more damaging than reflected XSS, which relies on a one-time request and isn't persistent.
✗Cross-site request forgery (CSRF)Wrong answer — click to see why▾
Why this is wrong here
The attack involves malicious script stored in the database and executed when users view the product review page, which is stored XSS, not CSRF. CSRF tricks a user into performing unwanted actions on a trusted site, not injecting scripts.
★ When this WOULD be the correct answer
A user is logged into their banking site and clicks a link that submits a fund transfer request without their knowledge. The question would describe the user being authenticated and the attack leveraging that session to perform actions on their behalf.
Why candidates choose this
Candidates may confuse the automatic redirection with a forged request, not realizing that the root cause is injected script execution rather than a cross-origin request forgery.
✗SQL injectionWrong answer — click to see why▾
Why this is wrong here
The attack involves malicious script stored in the database and executed when users view the page, not SQL code injection into queries.
★ When this WOULD be the correct answer
A question where an attacker inputs SQL commands into a web form (e.g., login field) to manipulate the database, such as bypassing authentication or extracting data, and the application does not sanitize inputs.
Why candidates choose this
Candidates may confuse any database-related attack with SQL injection, especially when the attack vector involves submitting data that ends up in the database.
✗Reflected cross-site scripting (XSS)Wrong answer — click to see why▾
Why this is wrong here
The attack involves a <script> tag stored in the database and executed when users view the product review page, which is characteristic of stored XSS, not reflected XSS. Reflected XSS would require the malicious script to be part of the request (e.g., in a URL parameter) and reflected back immediately, not stored persistently.
★ When this WOULD be the correct answer
Reflected XSS would be correct if the malicious script is embedded in a URL (e.g., in a search query or error message) and the server reflects it back without proper sanitization, causing the browser to execute it. For example, a user clicks a crafted link like https://example.com/search?q=<script>alert('XSS')</script> and the script executes in the response.
Why candidates choose this
Candidates may confuse stored and reflected XSS, focusing on the presence of a <script> tag and redirection without considering whether the payload is stored in the database or reflected from the request.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Cross-site scripting
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, often to steal data or hijack sessions.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.