PEN-200 Client-Side Attacks Practice Question
Refer to the exhibit.
```http HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'
<html> <body> <h1>Welcome</h1> <script>var token = '12345';</script> </body> </html> ```
Based on the HTTP response headers and body shown in the exhibit, what significant security risk is present regarding client-side attacks?
⚠ Common exam trap
Candidates often misinterpret CSP headers by assuming that any CSP policy is secure. They overlook the specific 'unsafe-inline' directive, which explicitly allows the very vulnerability the CSP is intended to prevent.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'unsafe-inline' directive permits the execution of inline scripts, undermining CSP protections against Cross-Site Scripting
The inclusion of the 'unsafe-inline' directive in the Content Security Policy script-src allows the browser to execute inline script blocks present in the HTML. This configuration largely defeats the protective benefits of a CSP against Cross-Site Scripting, as attackers who can inject inline scripts will achieve execution.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The application is completely immune to Cross-Site Scripting because a Content Security Policy is strictly enforced
Why it's wrong here
The policy includes 'unsafe-inline' in script-src, which permits inline <script> blocks such as the token assignment, so injected inline script executes. A strict policy without 'unsafe-inline' or nonces would block it; here the directive is deliberately weakened, leaving reflected or stored XSS viable.
- ✓
The 'unsafe-inline' directive permits the execution of inline scripts, undermining CSP protections against Cross-Site Scripting
Why this is correct
The script-src directive includes 'unsafe-inline', so the browser executes the inline <script> block defining the token. This nullifies CSP's core defence against injected inline scripts, allowing an attacker who achieves HTML injection to run arbitrary JavaScript despite the policy being present.
- ✗
The server is vulnerable to remote code execution because the nginx version header is explicitly exposed
Why it's wrong here
Exposing the server software version header reveals information for reconnaissance but does not grant remote code execution or relate to client-side CSP configurations. Version disclosure is an informational finding rather than a direct execution vulnerability.
- ✗
The session token is vulnerable to interception because the response is transmitted over unencrypted HTTP
Why it's wrong here
While the snippet shows HTTP/1.1, the exhibit does not provide transport layer security details, and the core vulnerability highlighted is the CSP directive. The primary security misconfiguration in the exhibit is the allowance of unsafe inline script execution.
About these practice questions
This PEN-200 question is part of Courseiva's 285-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.