SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Cross-site scripting (XSS)

  Why this is correct

  Cross-site scripting is a client-side injection flaw where an application reflects or stores user-supplied data without proper output encoding, allowing an attacker to execute arbitrary JavaScript in another user's browser. This enables session token theft via document.cookie, UI redressing, or keylogging, and it compromises the victim's session rather than directly attacking the server-side database. Because the payload runs in the browser context, it is distinct from server-side data attacks and cannot be mitigated by input sanitization alone; contextual output encoding on the response path is required.

• ✗

  ARP poisoning

  Why it's wrong here

  Address Resolution Protocol poisoning is a Layer 2 network attack where an attacker on the same broadcast domain sends forged ARP reply packets, binding the victim's IP address to the attacker's MAC address. This intercepts, modifies, or drops frames intended for the legitimate host, enabling man-in-the-middle traffic capture, but it has no bearing on web application source code or user input handling. Since ARP operates below IP and does not interact with application-layer protocols like HTTP, it cannot be used to inject client-side scripts or SQL queries into a web server.

• ✓

  SQL injection

  Why this is correct

  SQL injection is a server-side database attack that occurs when untrusted input is concatenated directly into a SQL statement, allowing an attacker to manipulate the query structure to retrieve, modify, or delete records. Attackers can exploit error messages or blind conditions to extract tables, bypass authentication by crafting 'OR 1=1' predicates, or use stacked queries to write files. Unlike XSS, which executes in the client's browser, SQLi executes within the relational database engine and requires parameterized queries or prepared statements to neutralize the attack.

• ✓

  XML external entity (XXE) injection

  Why this is correct

  XML External Entity injection exploits insecure XML parsers in web applications that process XML input without disabling external entity resolution. An attacker defines a custom doctype that references an external entity, causing the parser to read local files such as /etc/passwd or make outbound HTTP calls to internal network endpoints, leading to arbitrary file disclosure and SSRF. This vulnerability is specific to XML-based interfaces and differs from SQL injection by targeting the parsers' entity expansion mechanism, and it can be prevented by configuring XML processors to not resolve external entities.

• ✗

  DNS cache poisoning

  Why it's wrong here

  DNS cache poisoning is an attack against the Domain Name System where forged DNS packets are injected into a recursive resolver's cache, mapping a legitimate domain name to an IP address controlled by the attacker. This redirects users to fraudulent IP addresses, but it affects the DNS resolution infrastructure rather than the web application's own code or data-handling logic. It is a network-layer attack that occurs before an HTTP connection is established, so it does not exploit vulnerabilities like SQLi or XSS that reside within the application's input-validation or output-encoding mechanisms.

• ✗

  Evil twin attack

  Why it's wrong here

  An evil twin attack involves deploying a rogue wireless access point configured with the same SSID and security settings as a legitimate network, tricking clients into associating with it automatically. This allows the attacker to capture credentials, inject malicious traffic, or perform phishing during the user's connection, but it is a radio-frequency/network-level attack and unrelated to server-side application vulnerabilities. Because the attack targets Wi-Fi clients at the link layer, it cannot directly trigger SQLi or XSS in a web application unless the attacker separately delivers malicious payloads over the compromised channel.

Go deeper

Related to this question