Courseiva
Network Intrusion AnalysismediumMultiple SelectObjective-mapped

200-201 Network Intrusion Analysis Practice Question

An analyst reviews a PCAP and sees HTTP requests containing script tags and event handlers such as 'onload' and 'onerror'. Additionally, the URI contains 'alert(1)'. Which TWO types of attacks are indicated? (Select 2)

⚠ Common exam trap

Cisco often tests the distinction between Reflected and DOM-based XSS by presenting a payload that appears in the URI but is not reflected in the server's response body, leading candidates to incorrectly assume only one type is present.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

Reflected XSS

The presence of script tags, event handlers like 'onload' and 'onerror', and the URI containing 'alert(1)' indicates that the attacker is injecting client-side script into the HTTP response. Since the payload is reflected in the URI (likely in a query parameter or path) and executed immediately in the browser without being stored on the server, this is Reflected XSS (option B). The same payload can also be executed via client-side JavaScript that manipulates the DOM using untrusted data from the URI, which is characteristic of DOM-based XSS (option C).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • Command injection

    Why it's wrong here

    Command injection uses system commands.

  • Reflected XSS

    Why this is correct

    Script tags in URI indicate reflected XSS.

  • DOM-based XSS

    Why this is correct

    Event handlers can be used in DOM-based XSS.

  • Stored XSS

    Why it's wrong here

    Stored XSS is stored on server, not in URI.

  • SQL injection

    Why it's wrong here

    SQL injection uses SQL keywords.

About these practice questions

Courseiva writes every 200-201 question from scratch — 979 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.