mediumMultiple Choice
ISC2 CC Practice Question: A SOC analyst is reviewing logs from a web server…
A SOC analyst is reviewing logs from a web server and sees the following entry: GET /../../../../etc/passwd HTTP/1.1 Which type of attack is being attempted?
⚠ Common exam trap
ISC2 often tests directory traversal by including a file path like '/etc/passwd' in the URL, which candidates may mistakenly associate with SQL injection or XSS due to the presence of 'passwd' or the GET method, but the key indicator is the '../' sequence indicating file system navigation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Directory traversal
The log entry shows a GET request with '../' sequences attempting to navigate outside the web root to access the '/etc/passwd' file. This is the classic signature of a directory traversal attack, which exploits insufficient path sanitization to read arbitrary files on the server. The correct answer is C because the attack targets the file system, not the application's data layer or client-side scripts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cross-site scripting
Why it's wrong here
Cross-site scripting injects script into pages rendered for other users; this request instead uses ../ sequences to traverse directories and read /etc/passwd, a path traversal attack. XSS would be the answer if the log showed script tags or encoded JavaScript submitted to a reflected parameter.
- ✗
SQL injection
Why it's wrong here
SQL injection manipulates database queries through unescaped input; this GET request targets the filesystem with directory traversal to reach /etc/passwd, involving no SQL syntax or database. SQL injection would fit if the log showed UNION SELECT or quote-breaking characters in a query parameter.
- ✓
Directory traversal
Why this is correct
The sequence of ../ directory sequences climbing to /etc/passwd attempts to escape the web root and read a file outside the intended directory. This manipulation of path traversal characters is the defining mechanism of directory traversal, directly matching the logged GET request in the stem.
- ✗
Cross-site request forgery
Why it's wrong here
Cross-site request forgery tricks an authenticated browser into sending a forged state-changing request; this log shows direct server-side path traversal reading /etc/passwd, with no victim session or forged authenticated action. CSRF would fit a forged POST abusing an existing session cookie.
Go deeper
Related to this question
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.