hardMultiple ChoiceObjective-mapped
Unicode Encoding Directory Traversal — Detecting in Snort Alerts
Exhibit
Refer to the exhibit. [**] [1:256:1] ET WEB_SERVER Possible Unicode Encoding Bypass [**]
Which type of attack does this Snort alert most likely indicate?
Quick Answer
The correct answer is directory traversal, as the Snort alert signature 'ET WEB_SERVER ATTACKS Directory Traversal Attempt' is specifically designed to detect patterns like '../' or their unicode encoding variants such as '%2e%2e%2f' within HTTP request URIs. This unicode encoding directory traversal technique attempts to bypass simple string filters by representing the dot-dot-slash sequence in hexadecimal, allowing an attacker to navigate outside the web root directory to access sensitive files like /etc/passwd. On the Cisco CyberOps Associate 200-201 exam, this question tests your ability to interpret Snort alert signatures and map them to attack categories, with a common trap being to confuse directory traversal with SQL injection or XSS—but the alert explicitly targets path traversal patterns, not database or script injection syntax. A helpful memory tip: think of the '%2e%2e%2f' as "dot-dot-slash in disguise," and remember that any alert referencing 'Directory Traversal Attempt' in the signature name is a dead giveaway for this attack.
⚠ Common exam trap
Cisco often tests the ability to distinguish between web application attacks by focusing on the specific payload pattern in the alert signature, where candidates confuse directory traversal with SQL injection or XSS because all three involve HTTP requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Directory traversal
The Snort alert signature 'ET WEB_SERVER ATTACKS Directory Traversal Attempt' specifically detects patterns like '../' or encoded variants (e.g., '%2e%2e%2f') in HTTP requests. This indicates an attempt to access files outside the web root directory, which is the hallmark of a directory traversal attack. The alert triggers on the URI path, not on SQL syntax or script injection patterns.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Buffer overflow
Why it's wrong here
Buffer overflow exploits memory corruption, not path traversal.
- ✗
SQL injection
Why it's wrong here
SQL injection usually involves SQL commands, not Unicode encoding.
- ✓
Directory traversal
Why this is correct
Unicode bypass of './' and '../' filters is a known directory traversal technique.
- ✗
Cross-site scripting
Why it's wrong here
XSS often uses script tags, not Unicode path traversal.
Go deeper
Related to this question
About these practice questions
One of 979 original 200-201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 200-201
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An intrusion detection system (IDS) generates an alert for a packet containing the string '/etc/passwd'. What type of attack is likely detected?
easy- ✓ A.Directory traversal
- B.Cross-site scripting
- C.Buffer overflow
- D.SQL injection
Why A: The string '/etc/passwd' is a classic indicator of a directory traversal attack, where an attacker attempts to access files outside the web root directory by manipulating path parameters. An IDS detecting this string in a packet payload (e.g., in a URL or HTTP request) suggests the attacker is trying to read the Unix password file, which is a common target in path traversal exploits. This attack exploits insufficient input validation to navigate the file system using '../' sequences or absolute paths.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.