Threats, Vulnerabilities, and Mitigations
Targeted SY0-701 practice for this exam objective, with an explanation for every answer option.
- Certification
- SY0-701
- Domain
- Threats, Vulnerabilities, and Mitigations
- Questions
- 10
Practice SY0-701 Threats, Vulnerabilities, and Mitigations questions with exam-style scenarios, detailed explanations, and option-by-option rationale for this domain.
Example question from this objective
Each option is explained, so the reasoning behind the distractors is part of the answer.
An attacker gains arbitrary code execution in a serverless function. Which action would turn the compromised runtime into part of a distributed denial-of-service campaign analogous to the Mirai botnet?
- Alter validated user input before it reaches the smart contract, causing unauthorized transfers or incorrect state updates.
- Use the compromised function to launch a large distributed denial-of-service (DDoS) attack against the platform’s public RPC endpoints.
- Exploit a reentrancy flaw in the smart contract and drain funds from the liquidity pools.
- Extract API keys and cloud credentials from environment variables to expand access to the cloud infrastructure.
Alter validated user input before it reaches the smart contract, causing unauthorized transfers or incorrect state updates. — Changing input or contract state is a fraud or integrity issue. It does not reflect the main botnet pattern of using many compromised systems to generate large-scale traffic or resource exhaustion.
Use the compromised function to launch a large distributed denial-of-service (DDoS) attack against the platform’s public RPC endpoints. — A compromised serverless function can be used as a distributed attack node to flood targets with traffic, which matches the resource-exhaustion and coordinated disruption typical of Mirai-style botnets.
Exploit a reentrancy flaw in the smart contract and drain funds from the liquidity pools. — Reentrancy attacks target contract logic directly. The question asks for an effect of compromising the serverless function that resembles a botnet attack, so this does not fit.
Extract API keys and cloud credentials from environment variables to expand access to the cloud infrastructure. — Stealing secrets can enable broader cloud compromise, but Mirai-like attacks are primarily about mass compromise and coordinated DDoS activity, not credential harvesting or control-plane access.