SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  SQL injection, because the database is being queried with unsafe concatenated input.

  Why it's wrong here

  SQL injection is incorrect because the attack surface is the backend database query, not the browser-side rendering of stored content. In this scenario, the profile display name is retrieved and shown to other users; for the attack to be SQLi, the name would have to be concatenated into a SQL statement at runtime, which would allow data exfiltration or modification. There is no evidence of unsafe query construction, and SQLi would not cause script to execute in another user's browser, as the database does not interpret HTML/JavaScript.

• ✓

  Cross-site scripting, because untrusted content is executed in another user's browser context.

  Why this is correct

  This is stored cross-site scripting (XSS): an attacker saves a malicious script as their display name, and when other users load the profile page, the server emits the unvalidated and unencoded name directly into the HTML. The browser then executes the payload in the context of the victim's session, enabling actions like stealing cookies, forcing redirects, or capturing keystrokes. Because the script runs in another user's browser, it exactly matches the description of untrusted content being executed on the client.

• ✗

  Cross-site request forgery, because the attacker is forcing the victim to submit a form automatically.

  Why it's wrong here

  Cross-site request forgery (CSRF) is wrong because it does not involve injecting or executing stored content; instead, an attacker tricks an authenticated user's browser into sending a forged request to a site, relying on the browser automatically attaching session cookies. The described flaw is that a saved display name becomes active script when rendered — a content-based, client-side execution issue, not a request-forgery issue. CSRF would typically be triggered by a malicious link or form hosted elsewhere, not by a profile field that is rendered and executed in the page.

• ✗

  Broken authentication, because the login system is failing to verify usernames correctly.

  Why it's wrong here

  Broken authentication is not applicable because the login system itself is not described as flawed; the problem is that user-supplied profile content is rendered as executable code. Authentication-related vulnerabilities concern credential validation, session fixation, or insecure password storage, whereas this attack occurs after the user is authenticated and simply relies on the application failing to sanitize display name input. Even if authentication were perfectly secure, the stored XSS would still occur, so the root cause is output encoding/input validation, not authentication.