hardMultiple Choice
200-201 Practice Question: During a vulnerability assessment, a security…
During a vulnerability assessment, a security team discovers that a web application allows users to upload files without proper validation. An attacker could upload a malicious file and execute it on the server. Which type of vulnerability is this?
⚠ Common exam trap
Cisco often tests the distinction between client-side attacks (XSS) and server-side attacks (RCE), so candidates may confuse file upload RCE with XSS because both involve malicious file or script injection, but the execution context (server vs. client) is the key differentiator.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remote code execution (RCE)
The vulnerability allows an attacker to upload a malicious file (e.g., a web shell) and then execute it on the server, which is the definition of remote code execution (RCE). This occurs because the application fails to validate file types, contents, or execution permissions, enabling arbitrary code to run in the server's context.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting (XSS)
Why it's wrong here
XSS injects client-side scripts, not server-side execution via file upload.
- ✗
SQL injection
Why it's wrong here
SQL injection manipulates database queries through unsanitised input, not uploaded files executed by the server. It tempts because both are injection-class web flaws, yet the described mechanism is unrestricted file upload leading to server-side code execution, which SQL injection does not describe.
- ✓
Remote code execution (RCE)
Why this is correct
Unvalidated file uploads let an attacker place executable code that the server later runs, which is remote code execution. This satisfies the stem's stated impact of executing a malicious file on the server, rather than mere cross-site scripting or information disclosure.
- ✗
Insecure direct object reference
Why it's wrong here
Insecure direct object reference exposes objects by manipulating identifiers, such as changing an account number in a URL. It tempts because both are access-control flaws in web applications, yet the scenario concerns missing file-type validation enabling server-side execution, not identifier tampering.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.