A company uses a cloud-based CRM that exposes a REST API for integrations. A security review finds that the API accepts requests without validating the 'Content-Type' header, and the API returns detailed error messages that include stack traces. Which of the following is the MOST significant risk?

Insecure direct object reference (IDOR)

Cross-site scripting (XSS) vulnerability

Insecure API leading to data exposure

Denial of service due to malformed requests

A web application takes a user-supplied search term and constructs a SQL query by concatenating the term directly into the query string. An attacker submits the term: ' OR '1'='1. Which of the following is the MOST likely result?

The application logs the user out.

The application displays an error message with the query string.

The application crashes due to a syntax error.

The application returns all rows from the table.

A user reports that after opening a PDF attachment from an unknown sender, their Windows workstation begins running unauthorized processes. The workstation is fully patched, but the PDF viewer application is outdated. Which of the following is the MOST likely root cause?

Unpatched operating system vulnerability

Injection flaw in the PDF file format

Buffer overflow in the PDF viewer application

Hardware firmware vulnerability

CompTIASecurity+

Domain 2Objective 3

Vulnerabilities SY0-701 Practice Questions (Page 2)

Part of the Threats, vulnerabilities, and mitigations domain, which accounts for 22% of the SY0-701 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~8–13 in this domain), expect 2–3 from this objective — we provide 32 practice questions to prepare you well beyond it. (estimate)

32questions here

7free pages

8concepts

22%of the exam

Questions 6–10

6expert · hard
A company uses a cloud-based CRM that exposes a REST API for integrations. A security review finds that the API accepts requests without validating the 'Content-Type' header, and the API returns detailed error messages that include stack traces. Which of the following is the MOST significant risk?
Select an answer first
7foundation · easy
An organization fails to apply a critical security update to its operating systems, leaving them vulnerable to known exploits. Which type of OS vulnerability is this?
Select an answer first
8application · medium
A web application takes a user-supplied search term and constructs a SQL query by concatenating the term directly into the query string. An attacker submits the term: ' OR '1'='1. Which of the following is the MOST likely result?
Select an answer first
9application · medium
A user reports that after opening a PDF attachment from an unknown sender, their Windows workstation begins running unauthorized processes. The workstation is fully patched, but the PDF viewer application is outdated. Which of the following is the MOST likely root cause?
Select an answer first
10foundation · easy
Which type of vulnerability occurs when an application writes data beyond the boundaries of an allocated memory buffer, potentially corrupting adjacent memory?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SY0-701

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “SY0-701” is a trademark of its owner, used for identification only.

Vulnerabilities SY0-701 Practice Questions (Page 2)

Questions 6–10

A company uses a cloud-based CRM that exposes a REST API for integrations. A security review finds that the API accepts requests without validating the 'Content-Type' header, and the API returns detailed error messages that include stack traces. Which of the following is the MOST significant risk?

An organization fails to apply a critical security update to its operating systems, leaving them vulnerable to known exploits. Which type of OS vulnerability is this?

A web application takes a user-supplied search term and constructs a SQL query by concatenating the term directly into the query string. An attacker submits the term: ' OR '1'='1. Which of the following is the MOST likely result?

A user reports that after opening a PDF attachment from an unknown sender, their Windows workstation begins running unauthorized processes. The workstation is fully patched, but the PDF viewer application is outdated. Which of the following is the MOST likely root cause?

Which type of vulnerability occurs when an application writes data beyond the boundaries of an allocated memory buffer, potentially corrupting adjacent memory?

Keep studying — Threats, vulnerabilities, and mitigations