SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Web application log excerpt: Request: GET /search?q=acme' OR '1'='1'-- HTTP/1.1 Response: 500 Internal Server Error Database log: syntax error near "OR" at line 1 Developer note: the search feature appends user input directly into the SQL query string without parameterization.
Based on the exhibit, what type of web attack is most likely taking place?
⚠ Common exam trap
The trap here is that candidates see the input in the URL and the error message and mistakenly associate them with cross-site scripting (XSS), failing to recognize that the error is a database server response, not a client-side script execution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection, because the attacker is manipulating the database query with crafted input.
The exhibit shows a URL parameter (e.g., `id=1 OR 1=1`) that is being passed to a database query. The attacker is injecting SQL syntax to manipulate the query logic, which is the hallmark of SQL injection. The 500 error likely results from the database server crashing or returning an invalid result set, confirming that the injection is affecting the database.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting, because the input is visible in the URL and causes an error.
Why it's wrong here
Cross-site scripting (XSS) requires an attacker to inject executable script, such as JavaScript, that is then rendered and executed within a victim's browser. Here, the input is visible in the URL (a common trait of reflected attacks), but the resulting error is a database syntax error, not a browser-side script error. The error message and the developer's note about string concatenation show that the input is being embedded directly into a SQL query, which is the hallmark of SQL injection, not XSS.
- ✓
SQL injection, because the attacker is manipulating the database query with crafted input.
Why this is correct
This is SQL injection because the input includes SQL control characters and logic that alter the intended query. The database error and the developer note about string concatenation confirm that user-supplied data is being inserted directly into SQL without parameterization. That makes the application vulnerable to query manipulation.
- ✗
Broken authentication, because the application returns a 500 error.
Why it's wrong here
Broken authentication involves weaknesses in login, session management, or credential verification, such as weak password policies, session fixation, or credential stuffing. A 500 internal server error, by itself, indicates an unhandled server-side exception; in this case, it is a database syntax error triggered by crafted input. The attacker is not attempting to bypass authentication but rather to alter the logic of a SQL query, so the observed behavior does not align with an authentication attack.
- ✗
Insecure deserialization, because the application is parsing attacker-controlled data.
Why it's wrong here
Insecure deserialization occurs when an application deserializes attacker-controlled serialized objects, leading to logic abuse, privilege escalation, or arbitrary code execution. In this exhibit, the attacker-supplied input is a search parameter that is concatenated into a SQL statement, as shown by the syntax error referencing a query fragment. This is a direct manipulation of query structure, not the reconstruction of a serialized object, so the attack pattern is SQL injection rather than insecure deserialization.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.