SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst is investigating a web application that allows users to input a filename to view its contents. The application passes the user input directly to a system command without sanitization. An attacker submits the input 'file.txt; cat /etc/passwd' and successfully retrieves the contents of the password file. Which type of attack occurred?
⚠ Common exam trap
The SY0-701 exam often tests the distinction between command injection and directory traversal by using a payload that includes both a path and a command separator, leading candidates to mistakenly choose directory traversal when the core exploit is command execution via shell metacharacters.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Command injection
The application passes user input directly to a system command without sanitization. The attacker's input 'file.txt; cat /etc/passwd' uses a semicolon to terminate the intended command and execute a second command, which retrieves the password file. This is a classic command injection attack, where arbitrary system commands are executed via the vulnerable interface.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) is a client-side vulnerability that occurs when an attacker injects malicious JavaScript, HTML, or other client-side scripts into web pages served to other users. These scripts execute in a victim's browser, not on the web server's operating system, so XSS cannot be used to chain system commands via semicolons. While XSS can steal session tokens or perform actions on behalf of the user, it does not provide direct server-side command execution.
When this WOULD be correct
A web application reflects user input without sanitization, and an attacker submits a script like <script>alert('XSS')</script> that executes in another user's browser, stealing session cookies.
- ✗
SQL injection
Why it's wrong here
SQL injection targets the database layer by inserting malicious SQL statements into queries, allowing attackers to read, modify, or delete data. Although some database systems support stacked queries that might execute multiple statements, SQL injection still operates within the database engine and does not directly invoke operating system commands. The use of a semicolon in SQL injection is for delimiting SQL statements, not for chaining OS commands, which distinguishes it from command injection.
When this WOULD be correct
A web application takes user input and directly concatenates it into a SQL query without sanitization, e.g., 'SELECT * FROM users WHERE id = ' + user_input. An attacker submits '1 OR 1=1' to retrieve all records.
- ✓
Command injection
Why this is correct
Command injection is a server-side vulnerability where an attacker inserts operating system commands into input fields that are passed to system functions like exec() or system() without sanitization. The semicolon is a classic delimiter that allows chaining a second command after the intended one, enabling arbitrary code execution with the web server's privileges. This directly explains why the scenario points to command injection rather than other injection classes.
- ✗
Directory traversal
Why it's wrong here
Directory traversal attacks exploit insufficient path sanitization to access files outside the intended web root by using sequences like ../ to navigate the filesystem. This vulnerability allows attackers to view sensitive files (e.g., /etc/passwd) but does not enable direct command execution or command chaining. The technique is fundamentally about reading arbitrary files, not running system commands, so it does not match the attacker's observed behavior of using semicolons to chain commands.
When this WOULD be correct
A question where user input is used to construct a file path (e.g., 'filename=../../../etc/passwd') and the application fails to validate or sanitize the path, allowing access to sensitive files outside the intended directory.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Command injectionCorrect answer▾
Why this is correct
Command injection is a server-side vulnerability where an attacker inserts operating system commands into input fields that are passed to system functions like exec() or system() without sanitization. The semicolon is a classic delimiter that allows chaining a second command after the intended one, enabling arbitrary code execution with the web server's privileges. This directly explains why the scenario points to command injection rather than other injection classes.
✗Cross-site scripting (XSS)Wrong answer — click to see why▾
Why this is wrong here
The attack involves injecting a system command via user input, not injecting client-side scripts into web pages viewed by other users.
★ When this WOULD be the correct answer
A web application reflects user input without sanitization, and an attacker submits a script like <script>alert('XSS')</script> that executes in another user's browser, stealing session cookies.
Why candidates choose this
Candidates may confuse any injection-based attack with XSS, especially when the input is unsanitized, without recognizing the specific context of command execution versus script execution.
✗SQL injectionWrong answer — click to see why▾
Why this is wrong here
The attack involves executing system commands via user input, not manipulating a database query. SQL injection targets database queries, not system commands.
★ When this WOULD be the correct answer
A web application takes user input and directly concatenates it into a SQL query without sanitization, e.g., 'SELECT * FROM users WHERE id = ' + user_input. An attacker submits '1 OR 1=1' to retrieve all records.
Why candidates choose this
Candidates may confuse injection attacks, thinking any injection is SQL injection, or they may not distinguish between command injection and SQL injection.
✗Directory traversalWrong answer — click to see why▾
Why this is wrong here
Directory traversal involves accessing files outside the web root by manipulating path parameters (e.g., '../../etc/passwd'), not by injecting commands. The attacker here injected a command separator (';') to execute an arbitrary system command, which is command injection.
★ When this WOULD be the correct answer
A question where user input is used to construct a file path (e.g., 'filename=../../../etc/passwd') and the application fails to validate or sanitize the path, allowing access to sensitive files outside the intended directory.
Why candidates choose this
Candidates may confuse the retrieval of '/etc/passwd' with directory traversal, but the key difference is the use of a command separator (';') versus path traversal sequences ('../').
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.