SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Replay attack, because a captured valid authentication message was resent to gain access again.

  Why this is correct

  A replay attack succeeds because the attacker intercepts a legitimate authentication message—such as a RADIUS Access-Request or an IKEv2 authentication payload—and later retransmits the exact same datagram to the VPN concentrator. Since the message is cryptographically valid and the server did not enforce a fresh nonce, timestamp, or one-time challenge, the expected behavior is to accept it and establish a session. The attacker never needs to decrypt or forge anything; the captured blob is simply replayed, which directly explains the observed repeated acceptance of the same authentication request.

• ✗

  ARP poisoning, because the attacker redirected traffic by altering local address resolution.

  Why it's wrong here

  ARP poisoning is a Layer 2 attack that corrupts the ARP cache of hosts on a local segment, allowing the attacker to intercept or redirect traffic by associating their MAC address with an IP address. In a VPN concentrator scenario, ARP poisoning could be used as a precursor to sniff an authentication exchange, but it cannot cause the concentrator to accept the same authentication message multiple times. The root problem here is semantic: the server re-uses a captured message as valid proof of identity, which is a protocol-level replay flaw, not a link-layer mapping issue. ARP poisoning would also only work on a directly connected network, whereas the VPN authentication request may traverse the internet.

• ✗

  Phishing, because the user was tricked into entering credentials on a fake page.

  Why it's wrong here

  Phishing attacks exploit human psychology by presenting a fake login page that resembles the legitimate VPN portal, tricking users into typing their username and password. The scenario describes an authentication request that is repeatedly accepted by the VPN concentrator, which points to automated reuse of a captured protocol message, not a user voluntarily submitting credentials. Even if phishing were used to harvest credentials, that would enable credential replay of a password, not a pre-session authentication blob that the concentrator validates for freshness. Phishing fails as an explanation because it does not account for the same cryptographic authentication message being resent intact.

• ✗

  Denial of service, because the attacker is overwhelming the VPN gateway with requests.

  Why it's wrong here

  A denial-of-service (DoS) attack aims to exhaust resources on a VPN gateway—CPU, memory, connection tables, or bandwidth—so that legitimate users cannot establish sessions. In contrast, the symptom here is that an authentication request is successfully accepted, indicating that the attacker is gaining access, not preventing access. DoS would typically manifest as an outage or timeouts, whereas the scenario describes unauthorized access via a replayed message. Replay attacks can sometimes be used to create many sessions as a side effect, but the core problem is authentication bypass, not resource exhaustion.

Go deeper

Related to this question