SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst is reviewing the source code of a custom authentication service. The service uses a function that compares a user-supplied password to the stored password hash by iterating through each byte and returning false immediately upon the first mismatch. The analyst measures the function's execution time and discovers it varies measurably depending on how many initial bytes match. Which type of attack is this vulnerability most likely to facilitate?
⚠ Common exam trap
Test-takers frequently confuse a timing attack with a brute-force or dictionary attack, not realizing that the key clue is the measurable variation in execution time due to early exit on mismatch, which is a classic side-channel indicator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Timing attack
The vulnerability is a timing attack because the comparison function returns false immediately upon the first mismatched byte, causing execution time to vary based on how many initial bytes match. An attacker can measure these timing differences to iteratively guess each byte of the password hash, effectively reducing the search space from exponential to linear. This is a classic side-channel attack that exploits observable timing variations in cryptographic or authentication operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Brute-force attack
Why it's wrong here
A brute-force attack systematically tries all possible passwords, but the vulnerability here is a timing side-channel that leaks information about byte-by-byte hash comparison, not about password entropy or guess rate. This option is tempting because timing variations can theoretically reduce brute-force effort, but the actual attack enabled is a timing-based oracle that reveals partial hash matches, not a full password guess. A brute-force attack would be correct if the service lacked any side-channel and required exhaustive guessing against a constant-time comparison.
When this WOULD be correct
A brute-force attack would be correct if the question described a service with no rate limiting or account lockout, allowing an attacker to try all possible passwords until the correct one is found.
- ✗
Dictionary attack
Why it's wrong here
A dictionary attack uses a precomputed list of common passwords or phrases, and does not utilize execution time measurements. It relies on the likelihood that users choose weak passwords, not on side-channel information like timing.
When this WOULD be correct
A dictionary attack would be correct if the question described an attacker using a list of common passwords (e.g., from a breach) to try against the authentication service, without any mention of timing or byte-by-byte comparison.
- ✗
Replay attack
Why it's wrong here
A replay attack involves intercepting a valid authentication token (such as a session cookie or hashed password) and retransmitting it to impersonate the user. It does not involve manipulating or measuring execution time of a comparison function.
When this WOULD be correct
A replay attack would be correct if the question described a scenario where an attacker intercepts a hashed password or session token sent over the network and later resends it to gain unauthorized access, without needing to crack the password.
- ✓
Timing attack
Why this is correct
A timing attack exploits measurable variations in the time it takes to execute a cryptographic operation. In this case, the early-exit comparison enables an attacker to deduce the correct secret byte by byte, making it the correct classification.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Timing attackCorrect answer▾
Why this is correct
A timing attack exploits measurable variations in the time it takes to execute a cryptographic operation. In this case, the early-exit comparison enables an attacker to deduce the correct secret byte by byte, making it the correct classification.
✗Brute-force attackWrong answer — click to see why▾
Why this is wrong here
A brute-force attack systematically tries all possible passwords, but the vulnerability here is about exploiting timing variations in password comparison, not about trying many passwords.
★ When this WOULD be the correct answer
A brute-force attack would be correct if the question described a service with no rate limiting or account lockout, allowing an attacker to try all possible passwords until the correct one is found.
Why candidates choose this
Candidates may associate any password-related attack with brute-force, overlooking that the specific timing leak enables a more efficient side-channel attack.
✗Dictionary attackWrong answer — click to see why▾
Why this is wrong here
A dictionary attack uses a precomputed list of likely passwords, not the timing variation of password comparison. The vulnerability described is about measuring execution time to deduce password bytes, which is a timing attack, not a dictionary attack.
★ When this WOULD be the correct answer
A dictionary attack would be correct if the question described an attacker using a list of common passwords (e.g., from a breach) to try against the authentication service, without any mention of timing or byte-by-byte comparison.
Why candidates choose this
Candidates may confuse 'dictionary attack' with any attack that involves comparing passwords, or they may think the timing variation helps in narrowing down the password, similar to how a dictionary attack narrows down possibilities.
✗Replay attackWrong answer — click to see why▾
Why this is wrong here
A replay attack involves capturing and retransmitting valid data (e.g., authentication tokens) to impersonate a user, but the vulnerability here is about timing variations in password comparison, not about intercepting and reusing network traffic.
★ When this WOULD be the correct answer
A replay attack would be correct if the question described a scenario where an attacker intercepts a hashed password or session token sent over the network and later resends it to gain unauthorized access, without needing to crack the password.
Why candidates choose this
Candidates may confuse any attack that involves authentication bypass with replay attacks, or they might think that timing variations could be used to replay a successful authentication sequence.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Network-Based Attacks
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.