200-201 Network Intrusion Analysis Practice Question
In a PCAP analysis, an analyst uses the filter 'http.request.uri contains "UNION"' and finds multiple HTTP requests with 'SELECT' and 'UNION SELECT' in the URI parameter. Which type of attack is likely occurring?
⚠ Common exam trap
Many candidates confuse SQL injection with command injection or XSS, as all involve injecting malicious input; candidates must recognize that 'UNION SELECT' is specific to SQL, not OS commands or client-side scripts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SQL injection
The filter 'http.request.uri contains "UNION"' detects HTTP requests where the URI contains the SQL keyword 'UNION'. The presence of 'SELECT' and 'UNION SELECT' in URI parameters is a classic signature of SQL injection (SQLi), where an attacker attempts to manipulate backend database queries by injecting SQL code into input fields. This attack targets the database layer, aiming to extract or modify data, and is distinct from other web vulnerabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SQL injection
Why this is correct
The 'UNION SELECT' string in URI parameters is a classic SQL injection signature, used to append attacker-controlled queries onto a legitimate database statement. Its presence across multiple HTTP requests confirms attempts to manipulate backend SQL through unsanitised input.
- ✗
Buffer overflow
Why it's wrong here
Buffer overflow exploits memory handling by sending oversized input, leaving no SQL syntax in the URI. It is tempting because malformed HTTP requests can trigger it, and would be correct where a crafted payload corrupts a process's stack or heap rather than manipulating a database query.
- ✗
Cross-site scripting
Why it's wrong here
Cross-site scripting injects client-side script that executes in a victim's browser; 'UNION SELECT' targets the backend database instead. It is tempting because both involve malicious input in HTTP requests, and would be correct where reflected or stored JavaScript executes in a user's session.
- ✗
Command injection
Why it's wrong here
Command injection appends shell metacharacters so the server executes OS commands; 'UNION SELECT' is SQL syntax, not shell syntax. It is tempting because both attacks arrive through HTTP parameters, and would be correct where a URI field causes the web server to run an operating-system command.
About these practice questions
This 200-201 question is part of Courseiva's 968-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.