SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Application log excerpt: GET /thumbnail?imageUrl=http://169.254.169.254/latest/meta-data/iam/security-credentials/ Response status: 200 Returned content includes cloud role names and temporary credentials metadata Web server outbound connection recorded to the local metadata address
Based on the exhibit, which attack is the developer most likely observing?
⚠ Common exam trap
It's easy for candidates to confuse SSRF with CSRF because both involve requests, but SSRF is server-initiated while CSRF is client-initiated; the key clue is the server making a request to a private IP, not the user's browser.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Server-side request forgery (SSRF)
The developer is most likely observing a server-side request forgery (SSRF) attack because the log shows the application making an outbound HTTP request to an internal IP address (10.0.0.1) initiated by user-supplied input (the 'url' parameter). SSRF occurs when an attacker manipulates the server to send crafted requests to internal or external resources, bypassing access controls. The exhibit's pattern of a server-side request to a private IP range directly indicates SSRF, not client-side or database attacks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) is a client-side injection where an attacker's payload is rendered by the victim's browser, typically stealing cookies or executing JavaScript in a trusted context. In this exhibit, the attack involves the server itself making an outbound HTTP request to an internal metadata address based on a user-controlled URL parameter. That server-side request pattern—not a script executed in the browser—is the hallmark of SSRF, so XSS cannot explain the observed behavior.
- ✓
Server-side request forgery (SSRF)
Why this is correct
The application is being tricked into making a request to an internal metadata endpoint using a user-controlled URL parameter. That is server-side request forgery. SSRF is common in cloud environments because it can expose instance metadata, credentials, or internal services that should not be reachable from the outside.
- ✗
SQL injection
Why it's wrong here
SQL injection occurs when an unsanitized input is embedded directly into a SQL query, allowing an attacker to manipulate database logic, read or modify records, or bypass authentication. The exhibit points to a URL parameter that causes the application to fetch a remote resource—specifically an internal metadata service—not a database interaction. Because the evidence shows an HTTP/network-level request crafted by the server rather than a malformed database query, SQL injection does not fit the attack profile.
- ✗
CSRF
Why it's wrong here
CSRF (Cross-Site Request Forgery) exploits a user's authenticated browser session by making that browser silently issue state-changing requests to a trusted website. The exhibit, by contrast, shows the server-side application itself being tricked into requesting an internal metadata endpoint—no victim browser is involved, and the request originates from the server's own network context. This server-initiated request to an internal resource, driven by a user-controlled URL, is the defining characteristic of SSRF, not CSRF.
Go deeper
Related to this question
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.