CompTIA SY0-701 Bundle

A generic file-based delivery attack brings malicious content to a target through a file such as an email attachment or shared executable. A document is indeed a file, but the question singles out an embedded object within otherwise normal-looking content that launches a payload upon activation. That internal active-content mechanism is more precise than the broad fact that a file was involved. The distinction helps defenders apply object and macro restrictions rather than only scanning file names or transport channels.

A vulnerable client-side application contains a coding or configuration weakness that allows untrusted content to trigger unintended behavior. The scenario instead says an embedded document object actively launches a payload when the user activates it. It does not demonstrate a parser bug, exploited memory corruption, or an outdated client. Malicious active content can operate through permitted document features, so assuming a software vulnerability would change the technical cause without evidence.

A software supply-chain dependency attack places malicious code in a package or third-party component trusted by a build or installation process. The case concerns a user opening a document containing a disguised embedded object, not a developer resolving packages or a vendor publishing a compromised update. Both may execute unauthorized code, but the trust relationships are different. The observed activation route is document content rather than build-time dependencies.

Disinformation uses false claims presented as factual information to mislead an audience, often on a broad distribution channel. The observed attacker here impersonates a senior manager directly in the official support workflow to circumvent identity checks. False statements may form part of the deception, but the targeted victim is the help desk and the requested action is a support-process bypass. The more precise risk is social engineering of an identity-verification procedure rather than mass false-information dissemination.

Instant-message phishing can occur in a coworker chat or collaboration tool when someone sends a malicious link or request. The case takes place in a help-desk support channel in which the attacker asks a support agent to bypass identity verification while claiming to be a senior manager. Although the interaction may use chat technology, it is specifically an abuse of account-recovery or support authentication controls. The recipient's role and requested support action make the help-desk category more precise.

File-based delivery involves a malicious program or document transported through a share, attachment, or similar medium and executed by a recipient. The scenario contains a support conversation and a request to weaken verification, not an executable or embedded payload. An intruder who obtains access through the help desk might later upload malware, but that is not the social-engineering vector described. The immediate failure mode is human authorization being bypassed, not content execution.

Help-desk social engineering manipulates support personnel into bypassing authentication, performing password resets, or disclosing access information. The attacker here spreads fabricated outage notices to a wider employee audience and directs recipients to an unapproved portal. No support agent or help-desk workflow is involved. Although the notices imitate operational information, the specifically observed enabling tactic is false publicized information, not a direct request to a technical support representative.

Instant-message social engineering requires an identified messaging channel, such as a team chat containing a deceptive link or request. The scenario says fabricated outage notices are distributed but does not specify a chat service or a hijacked messaging account. The notices could arrive through several media, so inferring a particular collaboration channel would be unjustified. Their shared defining feature is intentionally false outage information that redirects employees into an attacker-controlled workflow.

Brand impersonation would require the attacker to imitate a trusted company's name, logo, domain, or official support presence. An unapproved portal could be counterfeit, but the question does not say it copies any existing brand or closely matches a legitimate hostname. The fabricated outage notice is the evidence provided. Calling this brand impersonation would depend on an additional fact about visual identity or domains that investigators have not observed.

Bluetooth exposure involves discoverable short-range radio interfaces or pairing and profile features on nearby devices. The lobby condition is a wired Ethernet socket connecting to the internal user VLAN; it does not depend on Bluetooth discovery or pairing. Both can be abused by physically nearby attackers, but the access protocols and mitigations differ. Securing the physical jack and its switch port is necessary, rather than changing Bluetooth settings on clients.

Removable-device threats arise from unknown USB drives or other portable storage used to introduce malicious files or exploit host interfaces. The lobby Ethernet jack is a network cable connection, not a removable storage drive carrying software. An attacker might use a USB-to-Ethernet adapter to connect a laptop, but the security defect remains an unmonitored wired network port allowing access to an internal VLAN. Treating it as storage media would target the wrong control.

An exposed service port is a listening TCP or UDP endpoint on a host that remote clients may connect to, such as an insecure management service. This scenario identifies a physical Ethernet jack in the lobby that provides a path into the internal switching network. No particular server service or open Internet port is mentioned. A physical connector and a network listener may interact, but they are not interchangeable attack surfaces.

An exposed service port would mean the workstation or agent accepts unauthorized inbound connections on a particular reachable network listener. Here the significant fact is that an outdated workstation management agent processes untrusted commands from a remote controller. That describes weakness in the installed client agent and its trust handling; the case does not say an unintended server port is publicly reachable. A vulnerable client can be exploited without exposing a new service listener.

Supply-chain dependency risk comes from a malicious or untrusted package entering software through an external library, vendor release, or build process. The management agent is described as outdated and processing untrusted controller input, not as a knowingly compromised update or forged library. A supply-chain incident could create an insecure agent, but that origin is not evidenced. The relevant weakness is the behavior of software already installed on the workstation.

File-based delivery introduces malicious code through an attachment, shared file, or executable launched by the target. The scenario instead points to commands or messages processed by an existing workstation management agent from a remote controller. The attacker could send malicious content as data to the agent, but no file download or direct execution path is described. Calling it file delivery would replace the observed client-agent attack surface with an unrelated transport assumption.

Directory traversal occurs when user-controlled path segments such as parent-directory markers cause an application to access files outside an intended directory. The question instead describes SQL syntax changing a server-side database query. No file path is being constructed or used to retrieve an unauthorized directory. Both problems can arise from trusting user input, but the relevant interpreter and security boundary differ. The observed behavior implicates query construction rather than filesystem-path normalization.

Stored cross-site scripting places attacker-controlled browser-executable content in a data store and serves it later to other visitors. The scenario provides no persisted comment, page, or JavaScript execution in a browser. Instead special SQL characters alter a database query on the server. An attacker could potentially exploit both weaknesses in one application, but the evidence here concerns injection into database syntax, not an unescaped persistent web script.

Reflected cross-site scripting happens when submitted content is returned in an immediate web response and executes as script in the visitor's browser. This case says unusual SQL syntax changes the server's database query, which involves the SQL interpreter rather than browser JavaScript. The presence of a search field is not sufficient to diagnose XSS. The deciding observation is the altered SQL execution semantics behind the application, not what a user sees in HTML output.

SQL injection manipulates commands sent to a database server by inserting untrusted SQL syntax into query construction. The malicious comment here is already stored and later runs as JavaScript in viewers' browsers. There is no sign that the original input changed the application's SQL statements. The database could merely be the storage location for the hostile script, and using a database does not transform browser-side execution into SQL injection.

Unsafe deserialization occurs when an application reconstructs objects from untrusted serialized data in a way that can trigger unintended behavior or code execution. The scenario does not describe object reconstruction or gadget chains. It describes saved comment text rendered as executable JavaScript in the browser of subsequent readers. The decisive boundary is output encoding and HTML/script interpretation, not trusted deserialization of a binary or structured object.

Reflected XSS returns an attacker's input in a single immediate HTTP response, often when a user follows a crafted URL. The injected script in this question remains in a published comment and affects later readers who did not submit the payload themselves. Both execute in browsers, but their delivery lifecycles differ. Calling it reflected XSS would ignore the server-side persistence and repeated exposure of independent visitors.

SQL injection affects the database query language or its execution when application input is used unsafely as SQL syntax. The crafted URL parameter here is copied into an HTML response and executed in the browser, with no indication that a database command was changed. Input validation is relevant to both classes, but the interpreter that executes the payload is different. This is client-side script execution caused by unsafe output handling, not database manipulation.

Stored XSS involves attacker input being retained in comments, profiles, or other storage and later served to visitors. The payload in this case travels through a crafted query parameter and appears immediately in the HTTP response without being stored. A single link can affect a victim, but future visitors do not receive the script unless they encounter the crafted request. The lack of persistence is why reflected, rather than stored, XSS is the narrower diagnosis.

A buffer overflow occurs when code writes beyond the bounds of an allocated memory region, often because size checks are inadequate. This scenario shows HTML reflecting a crafted parameter and executing JavaScript in the browser, not memory corruption or overwritten stack/heap memory. Although both are application vulnerabilities, the visible execution environment and root cause differ. Stack canaries or memory-safe parsing would not by themselves correct unsafe HTML output encoding in this page.

A time-of-check/time-of-use race occurs when a program validates a resource and later uses it after an attacker can change what the reference points to. The image-parser case instead describes writing oversized bytes into a fixed-size buffer. There is no interval between permission checking and file use and no attacker-controlled replacement of a path. Both bugs can occur in low-level software, but one is temporal and the other violates memory bounds.

Process injection uses operations that place executable code inside another running process and may arrange for that process to execute the code. This scenario involves the parser overflowing its own fixed stack buffer while handling malformed metadata; no separate target process or cross-process memory modification is described. A buffer exploit might later be used to inject code, but the observed vulnerability itself is memory-boundary failure, not the subsequent adversary execution technique.

Insecure deserialization involves restoring an object graph from untrusted serialized input in a way that triggers unexpected methods or dangerous object behavior. The image parser handles oversized metadata copied into a fixed stack buffer; the problem is an unchecked length and memory overwrite. Even if metadata is structured, the case does not describe object reconstruction or deserialization gadget execution. The mechanism distinguishes a buffer overflow from broader untrusted-data handling problems.

Reflected XSS would involve unsafe inclusion of attacker input in an HTML response, causing execution in a user's browser. The privileged service instead checks one filesystem path and uses it later after an attacker changes the target. No browser or script-bearing web response is present. Both may stem from untrusted input, but the exploit depends on timing between resource validation and use, not output escaping or HTML interpretation.

Buffer overflow exploits a write past an allocated memory boundary, usually involving unchecked input sizes. The case does not mention an oversized buffer or memory corruption. It states that a temporary path is checked and then points to a different target when opened. The defect is the gap between validation and access, allowing the security decision to apply to a different object. Bounds checking would not by itself close this race window.

Process memory injection places code into the address space of another running process, often to evade detection or gain that process's privileges. Here the attacker swaps a filesystem target between a check and an open operation. There is no injection into another process or execution of a payload from its memory. A malicious file might eventually be opened, but the explicit vulnerability is that the service trusts a previously checked path after its referent changes.

Stored XSS is the delivery of persistent attacker-controlled browser script through saved web content such as a comment or profile. The scenario describes executable bytes placed in a live trusted application's process memory. No web page, saved comment, HTML rendering, or browser execution is mentioned. A browser itself could be the victim process in a different case, but the attack technique here is cross-process memory manipulation, not unsafe storage and rendering of script content.

A buffer overflow overwrites bytes beyond the boundaries of an allocated buffer due to inadequate size validation. In this case the attacker deliberately places code inside a separate running process through process manipulation; there is no evidence of an overlong input or accidental out-of-bounds write. Buffer corruption might be one possible way to gain control in other scenarios, but it is not the described mechanism. The distinction is how the code enters the victim process.

A TOCTOU race exploits the time interval between checking a resource and using it after that resource changes. The case contains no temporary path, permission check, or resource replacement. The adversary's action is to inject executable bytes directly into a trusted process's memory, often followed by execution within that process. While concurrency vulnerabilities can sometimes help an attack, such a race is not part of the evidence provided and should not be presumed.