SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
CI Build Output Downloading package: report-utils@4.2.0 Expected integrity: sha512-F3d9e2f0e3a9c1... Actual integrity: sha512-7ab4d1c19f0a22... Source registry: registry.example.net Build status: WARN - package checksum mismatch Developer note: The update was pulled automatically during the nightly pipeline.
Based on the exhibit, what is the most likely issue with the software component being built?
⚠ Common exam trap
Many candidates confuse a supply-chain compromise with a web-specific attack like XSS, but the question's context of a build pipeline and dependency fetching points directly to the integrity of the software supply chain.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Supply-chain compromise, because the dependency may have been altered before it reached the build pipeline.
The exhibit shows a build pipeline that fetches a dependency from a public repository. If the dependency has been tampered with before it reaches the pipeline, this is a classic supply-chain compromise. Attackers often inject malicious code into popular open-source packages, which then gets incorporated into the build, compromising the final software component.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Supply-chain compromise, because the dependency may have been altered before it reached the build pipeline.
Why this is correct
A checksum or integrity mismatch during an automated dependency pull is a strong sign that the package may have been tampered with in transit or replaced in the software supply chain. Because the build pipeline trusted the registry source automatically, the control failure is around dependency integrity and third-party trust.
- ✗
Cross-site scripting, because the package name suggests the application handles web content.
Why it's wrong here
XSS is a web application attack involving malicious script in user-facing content. The exhibit is about a build pipeline downloading a package and comparing integrity values. There is no browser, user input field, or script execution evidence here.
- ✗
Credential stuffing, because automated systems frequently reuse credentials during updates.
Why it's wrong here
Credential stuffing relies on stolen username and password pairs being tried against logins. The log shows package download integrity validation, not authentication attempts. No user account access or password reuse is indicated in the build output.
- ✗
Replay attack, because the nightly pipeline used an old copy of the package request.
Why it's wrong here
Replay attacks involve capturing and resending valid communications to trick a system. Here, the issue is that the downloaded package's integrity does not match the expected value. That points to package tampering or dependency compromise, not a duplicated authentication message.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.