SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
After a routine dependency update, a development team notices that the customer portal begins making outbound connections to an unfamiliar domain during startup. The domain is not part of the application design, and the behavior started immediately after the third-party library was updated. Which threat is most likely?
⚠ Common exam trap
Test-takers frequently confuse supply-chain compromise with DNS poisoning, because both involve unexpected outbound connections, but DNS poisoning would affect all network traffic and not be tied to a specific library update.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Supply-chain compromise
The scenario describes a supply-chain compromise, where a trusted third-party library has been maliciously altered to include unauthorized outbound connections. This is a classic software supply-chain attack, as the dependency update introduced code that phones home to an unfamiliar domain, indicating the library's integrity was compromised before or during distribution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Supply-chain compromise
Why this is correct
A supply-chain compromise occurs when an attacker injects malicious code into a legitimate software dependency, which is then distributed through trusted update channels. In this scenario, the routine dependency update is the infection vector; the trojanized library can spawn unexpected outbound connections to command-and-control servers to exfiltrate data or receive instructions. The timing correlation between the update and anomalous network traffic makes this the most direct and probable cause.
- ✗
Evil twin access point
Why it's wrong here
An evil twin is a rogue wireless access point that impersonates a legitimate Wi-Fi network, typically to capture credentials or intercept wireless traffic. This attack requires physical proximity to the victim and operates at the network layer via radio signals, not within web application code. Since the issue is unexpected outbound connections from an updated application library, an evil twin cannot explain the symptom, and it would not be triggered by a dependency update.
- ✗
Bluetooth pairing abuse
Why it's wrong here
Bluetooth pairing abuse exploits vulnerabilities in short-range wireless communications, such as Bluejacking, Bluesnarfing, or BlueBorne, to compromise nearby Bluetooth-enabled devices. These attacks depend on the adversary being within roughly 10–100 meters and require the target device to have Bluetooth active. A server-side web application dependency update would have no interaction with Bluetooth, and its outbound connections are unrelated to short-range radio pairing attacks.
- ✗
DNS poisoning on the client network
Why it's wrong here
DNS poisoning on the client network can redirect legitimate domain names to attacker-controlled IP addresses, causing browsers or applications to connect to malicious servers. However, a dependency update is an application-layer change, not a network infrastructure change, and the observed outbound connections originate from the updated library's code. Moreover, modern applications often use certificate pinning or outbound IP whitelisting, making DNS redirection less likely to succeed. The temporal correlation with the library update strongly points to the dependency itself rather than a network-level DNS attack.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.