SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  SQL injection, because the attacker is altering the database query through crafted input.

  Why this is correct

  The injected condition `OR 1=1--` is a classic indicator that user input is being interpreted as part of a database query. The application returns too much data because the attacker has manipulated the SQL logic.

• ✗

  Cross-site scripting, because malicious code is being reflected in the browser.

  Why it's wrong here

  Cross-site scripting (XSS) is a client-side injection attack that executes malicious scripts in a victim's browser when untrusted input is included in HTML or JavaScript responses. The log entries show a server-side SQL predicate being altered via `OR 1=1--`, which affects the API's database query logic, not the user's browser. Moreover, an XSS payload would appear as script tags or event handlers in the request, but the captured payload manipulates SQL syntax to return all order records, so XSS is not the correct interpretation.

• ✗

  Cross-site request forgery, because the request appears to be an unauthorized action.

  Why it's wrong here

  Cross-site request forgery (CSRF) leverages an authenticated victim's session to replay a forged request, often as a state-changing action like POST or PUT, and the attacker generally does not need to see the response. Here, the repeated `GET /api/orders` requests with SQL injection payloads are directly crafted by the attacker to extract data, not simply to trigger an unintended action on behalf of a logged-in user. CSRF would not embed `OR 1=1--` in the query string; instead it would use predefined parameters for a valid action the victim is authorized to perform, making this classification incorrect.

• ✗

  Broken access control, because the API is not validating the user role correctly.

  Why it's wrong here

  Broken access control is an authorization flaw that lets a user access objects or actions beyond their permitted level, for example by changing an ID or role in the request. The attack seen in the log, however, is an injection of `OR 1=1--` into the `GET /api/orders` query parameter, which fundamentally alters the SQL statement's WHERE clause so the database returns every order. Even if the API properly validated roles, this SQL injection would still succeed because the query is constructed by concatenating raw input; the flaw is in query handling, not in role-based access validation.