SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A support portal searches customer records by last name. When a tester enters a single quote into the search field, the application returns a database syntax error. Which attack is most likely possible?
⚠ Common exam trap
Test-takers frequently confuse a database syntax error with a client-side script error, leading them to choose cross-site scripting, but the error message originates from the database server, not the browser.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection, because the input may be altering the database query
The single quote character is a common SQL injection test payload. When it triggers a database syntax error, it confirms that the input is being directly concatenated into a SQL query without proper sanitization or parameterization. This allows an attacker to break out of the intended query structure and execute arbitrary SQL commands, making SQL injection the most likely attack.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SQL injection, because the input may be altering the database query
Why this is correct
A single quote in the last-name search field terminates the string literal and changes the query's syntax, allowing an attacker to modify the WHERE clause or append UNION-based logic. The database engine then throws a syntax error that reveals the injection point. This directly demonstrates that user input is concatenated into the SQL statement without parameterization, a hallmark of SQL injection.
- ✗
Cross-site scripting, because the page is executing malicious JavaScript in the browser
Why it's wrong here
Cross-site scripting would manifest when untrusted input is rendered as HTML or JavaScript and executes in the victim's browser, leading to cookie theft, session hijacking, or DOM manipulation. A database syntax error from a quoted search term occurs on the server during query parsing, not in the client-side script interpreter. Therefore, XSS cannot account for the error message observed in the support portal.
- ✗
Server-side request forgery, because the server is making internal network calls
Why it's wrong here
Server-side request forgery involves an attacker controlling a server-side request to access internal resources or metadata endpoints, such as the cloud instance metadata service. The signature of SSRF is an outbound HTTP request whose response is returned to the attacker, not an SQL syntax error in a customer record search. The quote-induced database exception proves the input is reaching a query layer rather than a network request function, so SSRF is not the cause.
- ✗
Cross-site request forgery, because the user is being tricked into submitting a form
Why it's wrong here
Cross-site request forgery exploits the victim's active session by forcing their browser to submit a pre-forged request, relying on cookies being sent automatically; it targets state-changing actions like password changes or transfers. The search field's single quote generating a database error indicates the input is being processed as part of a server-side SQL statement, whereas CSRF involves no such server-side parsing and would instead trigger a normal but unauthorized request. Thus, CSRF does not match the observed symptom.
Visual reference
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.