SY0-701 Question 59
Single answer2.2 Explain common threat vectors and attack surfaces.A company recently rolled out a web-based customer portal that integrates with a third-party payment provider. After deployment, the security team discovers that customer records can be queried directly through an exposed API endpoint by modifying an account number in the URL. No authentication token is required for those requests because the endpoint was intended only for internal use during development. Which threat vector and attack surface issue best describes this situation?
- A
An unauthorized API exposure that increases the web application attack surface
- B
A rogue access point creating a wireless evil twin attack vector
- C
A removable media attack caused by infected USB devices used by developers
- D
A supply chain compromise introduced by the third-party payment provider
Show answer and explanation
Correct answer: A
Explanation
This scenario tests recognition of common threat vectors and attack surfaces in modern environments, especially exposed services and APIs. The key clues are: the endpoint is externally reachable, no authentication is required, and records can be accessed by modifying an identifier. That points to unauthorized API exposure and broken access control, both of which are major web application attack surface issues. In practice, this aligns with widely recognized guidance such as OWASP API Security recommendations, especially concerns around broken object level authorization and exposed endpoints left accessible after development. From a Security+ perspective, candidates should identify that APIs, web applications, and externally accessible services are common attack surfaces, and misconfigurations or weak access controls create the threat vector attackers exploit.
- A. Correct.
Correct. The scenario describes an exposed API endpoint that is reachable without authentication and allows direct object access by changing identifiers in the URL. This is a classic example of an API-related attack surface issue within a web application. It represents an exposed service and improper access control, both of which expand the organization's attack surface and create a practical threat vector for unauthorized data access.
- B. Incorrect.
Incorrect. A rogue access point or evil twin involves wireless infrastructure impersonation to intercept or manipulate traffic. The scenario is centered on a web application API endpoint and broken access control, not Wi-Fi misuse or wireless network spoofing.
- C. Incorrect.
Incorrect. Removable media attacks involve malware or unauthorized data transfer through USB drives or similar media. Although developers were involved in creating the endpoint, nothing in the scenario indicates malware infection, device-based propagation, or physical media as the threat vector.
- D. Incorrect.
Incorrect. A supply chain compromise would involve malicious code, tampered software, or compromise introduced through a vendor, service provider, or software dependency. While the portal integrates with a third-party payment provider, the weakness described is an internally exposed development API endpoint with no authentication, not a compromise originating from the vendor.