SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Web Access Log 2026-04-17T10:22:11Z "GET /thumb?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/ HTTP/1.1" 200 512 2026-04-17T10:22:14Z "GET /thumb?url=http://10.0.5.14:8080/admin HTTP/1.1" 200 133 Application server outbound connections observed to internal RFC1918 addresses after each request.
Based on the exhibit, which attack is most likely being attempted against the application?
⚠ Common exam trap
CompTIA often tests SSRF by showing a URL parameter like `?url=` or `?file=` pointing to an internal IP (e.g., 127.0.0.1 or 169.254.169.254), and candidates confuse it with CSRF because both involve 'forged requests,' but SSRF is server-side while CSRF is client-side.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.
The exhibit shows an attacker manipulating a URL parameter (e.g., `?url=http://169.254.169.254/latest/meta-data/`) to make the application fetch an internal resource. This is a classic Server-Side Request Forgery (SSRF) attack, where the application is tricked into making requests to internal services (like cloud metadata endpoints) on the attacker's behalf, bypassing network segmentation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting, because the attacker is trying to inject script into the victim's browser session.
Why it's wrong here
XSS targets the browser by injecting malicious script into content that other users view. The exhibit instead shows the server fetching URLs supplied by the user, including internal addresses and cloud metadata. That behavior is not browser-based script execution.
- ✓
Server-side request forgery, because the application is being tricked into making internal requests on the attacker's behalf.
Why this is correct
The application accepts a URL parameter and then makes outbound requests to internal resources, including the cloud metadata endpoint. That is the hallmark of SSRF. The attacker is causing the server to reach addresses that should not normally be accessible through a public request path.
- ✗
Cross-site request forgery, because the attacker is forcing an authenticated user to submit an unwanted request.
Why it's wrong here
CSRF exploits a victim's browser and authenticated session to trigger actions on a different site. Here, the evidence shows the server directly making internal outbound requests based on a supplied URL. The attack does not rely on a browser session or user interaction with a forged form.
- ✗
SQL injection, because the attacker is manipulating a query parameter to expose backend data.
Why it's wrong here
SQL injection manipulates database queries, usually by altering SQL syntax in input fields. The log output here shows URL fetching and requests to the metadata service, not database error messages or SQL syntax anomalies. This is a request-forgery issue, not a database query injection.
Go deeper
Related to this question
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.