200-201 Network Intrusion Analysis Practice Question
An analyst reviews a PCAP and sees HTTP requests containing script tags and event handlers such as 'onload' and 'onerror'. Additionally, the URI contains 'alert(1)'. Which TWO types of attacks are indicated? (Select 2)
⚠ Common exam trap
Cisco often tests the distinction between Reflected and DOM-based XSS by presenting a payload that appears in the URI but is not reflected in the server's response body, leading candidates to incorrectly assume only one type is present.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Reflected XSS
The presence of script tags, event handlers like 'onload' and 'onerror', and the URI containing 'alert(1)' indicates that the attacker is injecting client-side script into the HTTP response. Since the payload is reflected in the URI (likely in a query parameter or path) and executed immediately in the browser without being stored on the server, this is Reflected XSS (option B). The same payload can also be executed via client-side JavaScript that manipulates the DOM using untrusted data from the URI, which is characteristic of DOM-based XSS (option C).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Command injection
Why it's wrong here
Command injection uses system commands.
- ✓
Reflected XSS
Why this is correct
Script tags in URI indicate reflected XSS.
- ✓
DOM-based XSS
Why this is correct
Event handlers can be used in DOM-based XSS.
- ✗
Stored XSS
Why it's wrong here
Stored XSS is stored on server, not in URI.
- ✗
SQL injection
Why it's wrong here
SQL injection uses SQL keywords.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.