SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A tester enters a crafted search term into an internal web application and sees no error message, but the page response always delays by exactly five seconds when the input includes a single quote followed by a conditional sleep function. The returned results look normal, so the tester repeats the request several times and the timing remains consistent. Which attack is most likely being attempted?
⚠ Common exam trap
Many exam-takers confuse a time-based delay with command injection (Option B) because both involve a pause, but the key differentiator is the single quote syntax and the database-specific sleep function, not an OS-level command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Time-based blind SQL injection, because the attacker is inferring database behavior from delayed responses.
The consistent five-second delay triggered by a single quote followed by a conditional sleep function (e.g., ' OR SLEEP(5)) indicates a time-based blind SQL injection. The tester is inferring database behavior from response timing because the application does not display error messages or output differences, but the database executes a sleep command when the injected SQL is syntactically valid. This technique exploits the database's ability to conditionally pause execution, allowing an attacker to extract data bit by bit based on true/false conditions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reflected cross-site scripting, because the tester's input is being echoed back into the response.
Why it's wrong here
Reflected XSS would cause the injected payload to execute as client-side JavaScript in the victim's browser, producing behaviors like DOM manipulation or cookie theft. However, the described symptom is a server-side, query-dependent response-time delay that persists even when the page appears to render normally. A single quote followed by a conditional sleep indicates the input is being evaluated by a database engine, not echoed for browser interpretation. Thus, while the input may be reflected, the observable timing channel is characteristic of SQL injection, not XSS.
- ✗
Command injection, because the application is pausing while executing system-level sleep commands.
Why it's wrong here
Command injection typically exploits a weakness in shell or system-level command execution, where commands like `sleep` are executed by the operating system, often causing a fixed delay. Here, the delay is tied to crafted SQL conditions (e.g., conditional `SLEEP()` inside a query) and varies based on the logical evaluation of injected fragments. The application appears to return normal results, suggesting the payload is being processed within a database query, not passed to a system shell. Also, standard command injection would likely produce OS-specific error messages or side effects, not subtle, repeatable timing differences consistent with a database's response time.
- ✓
Time-based blind SQL injection, because the attacker is inferring database behavior from delayed responses.
Why this is correct
The timing pattern is the critical clue. When an application does not reveal errors or data directly, an attacker can still infer whether injected SQL changes control flow by measuring response delays. A single quote plus a conditional sleep is a classic sign of time-based blind SQL injection. The normal-looking results and consistent pauses show the query is being influenced even without visible error output.
- ✗
Session fixation, because the tester is manipulating how the application handles user input over time.
Why it's wrong here
Session fixation is an attack where an attacker forces a victim to use a known session identifier before authentication, then hijacks the session after the user logs in. It has nothing to do with how a search field processes or times its queries, and it would not produce a consistent, input-dependent delay pattern. Manipulating user input over time is a general description of many web attacks, but the specific mechanism here—database-driven conditional sleep triggered by SQL keywords—points to a backend injection flaw, not session management. Therefore, the observed behavior is a database timing side channel, not a session-related vulnerability.
Visual reference
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.