SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  SQL injection

  Why this is correct

  Correct. The log entries show SQL syntax such as `OR '1'='1'` and `DROP TABLE`, which are classic indicators of SQL injection attempts. This attack exploits improper input sanitization to manipulate database queries. These payloads are appended to SQL statements executed by the web application's backend database, allowing an attacker to bypass authentication or alter data.

• ✗

  LDAP injection

  Why it's wrong here

  LDAP injection exploits vulnerabilities in applications that build LDAP filters from user input without proper sanitization, using constructs like `(&(uid=user)(userPassword=pass))` or wildcard `*` to bypass authentication. The observed payloads (`OR '1'='1'`, `DROP TABLE`) are structured for SQL's WHERE-clause logic, not for LDAP filter syntax, which relies on parentheses, ampersands, and pipe characters (e.g., `(|(cn=...)(uid=...))`). Hence, the attack targets a SQL backend, not an LDAP directory.

  When this WOULD be correct

  An LDAP injection question would involve an application that authenticates users against an LDAP directory, with logs showing payloads like `*)(uid=*))(|(uid=*` or `admin*` in login fields, causing unauthorized access or data exposure.

• ✗

  Command injection

  Why it's wrong here

  Command injection is an attack where an attacker manipulates user-supplied input to execute arbitrary operating system commands on the host server by injecting shell metacharacters such as `;`, `|`, `&&`, or backticks. The log entries show SQL-specific syntax, not these command separators or OS command names (e.g., `cat`, `ls`, `whoami`). Therefore, this activity is not indicative of command injection.

  When this WOULD be correct

  Command injection would be correct if the logs showed URL parameters with system commands, such as '; ls -la' or '| dir', and the application returned command output in the HTTP response, indicating the server executed the commands.

• ✗

  Cross-site scripting (XSS)

  Why it's wrong here

  Cross-site scripting (XSS) occurs when an attacker injects malicious client-side scripts, such as JavaScript, into web pages that are then executed in the browsers of other users. The observed log entries contain SQL keywords and operators like `OR '1'='1'` and `DROP TABLE`, rather than script tags, event handlers, or payloads like `<script>alert(1)</script>`, which would be expected for XSS. Thus, the attack pattern does not match XSS.

  When this WOULD be correct

  A security analyst finds that a web application reflects user input in HTTP responses without sanitization, and a proof-of-concept payload like <script>alert('XSS')</script> executes in a browser. The question would specify that the attack targets other users via stored or reflected scripts.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SY0-701 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SY0-701blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”