SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
Exhibit
Reverse proxy config excerpt: proxy_set_header X-Original-URL $request_uri; proxy_set_header X-Forwarded-User $remote_user; Access log: GET /app/report HTTP/1.1 200 X-Original-URL: /admin/export X-Forwarded-User: jlee Backend log: 09:41:11 GET /admin/export user=jlee role=analyst response=200 09:41:13 POST /admin/export user=jlee role=analyst response=200
Based on the exhibit, which vulnerability is being exploited?
⚠ Common exam trap
Test-takers frequently confuse parameter manipulation for privilege escalation with CSRF, but CSRF requires an authenticated victim to unknowingly submit a request, whereas this attack directly alters the authorization flag without needing another user's session.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication bypass
The exhibit shows a URL parameter `?admin=false` being changed to `?admin=true`, which directly toggles an administrative access control flag. This is a classic authentication bypass vulnerability because the application trusts client-supplied input to determine authorization status, allowing an attacker to escalate privileges without valid credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
Cross-site scripting (XSS) requires an attacker to inject executable script into web content that a victim's browser renders within a trusted origin. The exhibit shows no script payload, no response tampering, and no indication that another user's browser executed attacker-controlled HTML or JavaScript. Instead, the attacker directly manipulates the X-Original-URL header to alter server-side routing, which is a request-layer trust issue, not a client-side script execution issue. Therefore, the behavior does not match XSS.
- ✗
Cross-site request forgery (CSRF)
Why it's wrong here
Cross-site request forgery (CSRF) exploits a victim's authenticated browser by making it send a forged request to an application automatically, typically through cookies or other ambient credentials. The exhibit shows an authenticated user actively submitting a request with an explicitly modified X-Original-URL header to access /admin/export—this is not an involuntary request triggered from a different site, but a deliberate client-side modification of request routing headers. Browsers normally do not send custom X-Original-URL headers cross-site, so the attack depends on direct request tampering rather than CSRF's session-hijacking model. Thus, CSRF is not the exploited vulnerability.
- ✓
Authentication bypass
Why this is correct
The backend is trusting client-influenced headers and a forwarded path value to reach an administrative endpoint. The logs show a normal analyst account reaching /admin/export after supplying X-Original-URL, which indicates the application or proxy is failing to enforce access controls consistently. That is an authentication or authorization bypass caused by trusting data the client can manipulate.
- ✗
Command injection
Why it's wrong here
Command injection requires unsanitized user input to be incorporated into an OS shell command, often using metacharacters such as ;, |, &, `, or $(). The exhibit contains no such metacharacters in the request path, headers, or query strings, and the response is an HTTP 200 returning exported administrative data, not the output of an arbitrary system command. The vulnerability lies in a proxy or application trusting the client-supplied X-Original-URL header to route a request to /admin/export, bypassing access control checks. That is an authentication/authorization bypass, not an OS-level command execution flaw.
Go deeper
Related to this question
Learn chapter
Application Attacks: SQL Injection, XSS
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.