SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
A user enters `<script>alert('test')</script>` into a public comment field, and other visitors see the script run in their browsers. What attack is this?
⚠ Common exam trap
Test-takers frequently confuse client-side attacks (XSS) with server-side attacks (SQL injection) because both involve user input, but XSS targets the browser's execution context while SQL injection targets the database query parser.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-site scripting
This is a classic cross-site scripting (XSS) attack because the user-supplied input containing a script tag is echoed back to other visitors' browsers without proper sanitization or encoding. The script executes in the context of the victim's browser, allowing the attacker to steal cookies, redirect users, or deface the page. XSS exploits the trust a user has for a particular website, unlike SQL injection which targets the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Cross-site scripting
Why this is correct
Cross-site scripting (XSS) occurs when an application includes unvalidated user-supplied data in a web page, allowing attacker-controlled script to execute in the context of any victim's browser. In stored XSS, the malicious payload is permanently saved—such as in a comment field—and then served to every subsequent visitor. The 'alert' confirms script execution; an attacker could instead steal session cookies or perform actions on behalf of the user. This is the textbook explanation for why this is correct.
- ✗
SQL injection
Why it's wrong here
SQL injection targets the database layer by inserting or modifying SQL commands through input fields, typically via query string parameters or form data. This input is interpreted as a database query, not as browser-rendered script. The comment field's text is stored and then served as HTML/JavaScript to clients, causing execution in the browser. While SQL injection can also access data, the specified behavior—executing 'alert' in a page—is exclusively a browser-side scripting issue, not a database attack.
- ✗
Broken authentication
Why it's wrong here
Broken authentication is a server-side vulnerability that encompasses flaws in login mechanisms, session token generation, and password recovery processes. It does not involve client-side script execution. Even if the comment system had broken authentication, the submitted text would not run as code in a browser simply because of that weakness. The observed behavior is a browser rendering and executing input, which points to XSS rather than an auth flaw.
- ✗
Insecure deserialization
Why it's wrong here
Insecure deserialization is a server-side vulnerability where untrusted data is deserialized into objects, allowing attackers to manipulate application logic or achieve remote code execution at the application server. It does not involve storing user text that later executes in another user's browser. The comment field scenario is a classic stored XSS attack, where the script runs in the client's browser due to inadequate output encoding. Entering text that triggers a JavaScript alert on page load is in no way related to object deserialization pipelines.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Cross-site scripting
Cross-site scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, often to steal data or hijack sessions.
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.