SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A security analyst is reviewing the source code of a custom web application. The application receives JSON data from users, which includes a 'type' field. The application uses the 'type' field to determine which Java class to instantiate, and then calls a method on that object. The application does not validate or sanitize the 'type' field. An attacker sends a crafted JSON payload that causes the application to instantiate an unexpected class, leading to remote code execution. Which type of vulnerability does this example describe?
⚠ Common exam trap
Candidates often confuse insecure deserialization with injection attacks (SQLi or XSS) because the attacker is 'injecting' a class name, but the core mechanism is the unsafe deserialization of untrusted data to instantiate objects, not injecting code into a query or script context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Insecure deserialization
The application deserializes untrusted JSON data and uses the 'type' field to dynamically instantiate a Java class without validation. This is a classic insecure deserialization vulnerability, where an attacker can supply a malicious class name (e.g., a gadget class like `Runtime` or a custom class) that, when instantiated and its method called, executes arbitrary code on the server. The lack of input sanitization on the 'type' field directly enables remote code execution via object instantiation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL injection
Why it's wrong here
SQL injection involves injecting malicious SQL code into queries via user input. The scenario does not involve any database interactions or SQL commands; it involves instantiating arbitrary classes from user-supplied data, which is characteristic of insecure deserialization, not SQL injection.
When this WOULD be correct
A web application takes user input and directly concatenates it into a SQL query without sanitization, allowing an attacker to manipulate the query to access or modify database data.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) is a client-side vulnerability where an attacker injects malicious scripts into web pages viewed by other users. This scenario involves server-side code execution through unsafe class instantiation, not injection of scripts into a web page, so XSS is not the correct classification.
When this WOULD be correct
A web application reflects user input in HTML output without proper encoding. An attacker submits a script in a comment field, and when other users view the comment, the script executes in their browsers, stealing session cookies. This is a stored XSS vulnerability.
- ✓
Insecure deserialization
Why this is correct
Correct. Insecure deserialization occurs when an application deserializes untrusted data, allowing an attacker to control serialized objects or, as in this case, the class name to be instantiated. This can lead to remote code execution, denial of service, or privilege escalation.
- ✗
Directory traversal
Why it's wrong here
Directory traversal is an attack that exploits insufficient input validation to access files outside the web root directory. This scenario does not involve file path manipulation; it involves the insecure instantiation of arbitrary classes from untrusted data, which is a deserialization issue.
When this WOULD be correct
A web application takes a filename parameter from user input and uses it to read a file without proper validation, allowing an attacker to use '../' sequences to read files outside the intended directory, such as /etc/passwd.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.
✓Insecure deserializationCorrect answer▾
Why this is correct
Correct. Insecure deserialization occurs when an application deserializes untrusted data, allowing an attacker to control serialized objects or, as in this case, the class name to be instantiated. This can lead to remote code execution, denial of service, or privilege escalation.
✗SQL injectionWrong answer — click to see why▾
Why this is wrong here
The vulnerability involves instantiating arbitrary Java classes from user-controlled JSON data, which is a classic insecure deserialization flaw, not SQL injection, as no database queries are involved.
★ When this WOULD be the correct answer
A web application takes user input and directly concatenates it into a SQL query without sanitization, allowing an attacker to manipulate the query to access or modify database data.
Why candidates choose this
Candidates may confuse any injection-style vulnerability with SQL injection, especially when the attack involves crafted input leading to unintended behavior.
✗Cross-site scripting (XSS)Wrong answer — click to see why▾
Why this is wrong here
The vulnerability involves instantiation of arbitrary Java classes from user-supplied type field, leading to remote code execution, which is classic insecure deserialization. Cross-site scripting (XSS) involves injecting malicious scripts into web pages viewed by other users, not server-side object instantiation.
★ When this WOULD be the correct answer
A web application reflects user input in HTML output without proper encoding. An attacker submits a script in a comment field, and when other users view the comment, the script executes in their browsers, stealing session cookies. This is a stored XSS vulnerability.
Why candidates choose this
Candidates may confuse any input-based attack with XSS, especially when the description involves user-supplied data leading to code execution, but XSS is client-side script execution, not server-side code execution via object instantiation.
✗Directory traversalWrong answer — click to see why▾
Why this is wrong here
Directory traversal involves manipulating file paths to access unauthorized files, not instantiating arbitrary classes from user input. The vulnerability here is about insecure deserialization, where untrusted data controls object instantiation.
★ When this WOULD be the correct answer
A web application takes a filename parameter from user input and uses it to read a file without proper validation, allowing an attacker to use '../' sequences to read files outside the intended directory, such as /etc/passwd.
Why candidates choose this
Candidates may confuse the concept of 'type' field controlling class instantiation with file path manipulation, or they might think any injection that leads to code execution is a directory traversal.
Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.