SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A support portal has a search field that accepts customer last names. After a tester enters a single quote, the application returns a database syntax error. Which attack is the tester most likely trying to verify?
⚠ Common exam trap
Watch out — candidates often confuse the database syntax error with a client-side script execution indicator, leading them to choose XSS, but the error is a direct result of SQL syntax breakage, not script injection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection
The tester is most likely trying to verify a SQL injection vulnerability. Entering a single quote into a search field that interacts with a database can break the SQL query syntax if user input is improperly sanitized, causing the database to return a syntax error. This error indicates that the input is being directly concatenated into a SQL statement, confirming the presence of a SQL injection flaw.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) would manifest as injected JavaScript executing in a user's browser, not as a database error. A single quote like the one in the customer-last-name search field could potentially break an HTML/JS context, but that would cause client-side rendering errors or script execution, not a server-side SQL syntax exception. Here, the back end is clearly attempting to interpret the quote as part of a SQL statement, which is the definitive fingerprint of SQL injection rather than XSS.
- ✓
SQL injection
Why this is correct
SQL injection happens when user input is inserted into a database query without proper validation or parameterization. A single quote causing a syntax error is a common sign that the input is affecting the SQL statement.
- ✗
CSRF
Why it's wrong here
CSRF is an attack on session trust: a malicious page forces the victim's browser to send an authenticated request to a legitimate site, typically triggering a state-changing action such as changing an email address or transferring funds. A search field lookup would be an illogical CSRF target, and the reported database syntax error could never arise merely because a cross-site request was dispatched. That symptom only appears when the server improperly interpolates the raw quote into a SQL query, and CSRF plays no role in constructing the query string.
- ✗
SSRF
Why it's wrong here
SSRF occurs when an application fetches a user-controlled URL on behalf of the attacker, letting them reach internal endpoints or cloud metadata services. For the search field to be SSRF-vulnerable, the input would need to be interpreted as a URL and cause the server to issue an HTTP request, not cause a database parser to reject a malformed quote. The actual symptom—a SQL syntax error triggered by a single character—indicates the input is being concatenated into a database command, which lies outside SSRF's attack model.
Visual reference
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.