PEN-200 Client-Side Attacks Practice Question
You are analyzing a target web application that reflects user input directly into an HTML attribute without proper sanitization. Which vulnerability class should you primarily investigate for exploitation?
⚠ Common exam trap
Candidates often confuse Reflected XSS with Stored XSS or SQL Injection. They forget that the vulnerability is specifically triggered by the immediate reflection of input in a browser-rendered context.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cross-Site Scripting (XSS)
Reflected Cross-Site Scripting occurs when untrusted user input is immediately processed and returned by a web application in an unsafe context, such as within an HTML attribute. Identifying this flaw allows attackers to craft malicious URLs that execute arbitrary JavaScript in the victim browser.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SQL Injection
Why it's wrong here
SQL injection involves manipulating database queries rather than targeting user browsers through reflected markup. This vulnerability manifests when input is concatenated directly into backend SQL statements, leading to data exposure or authentication bypass instead of client-side script execution.
- ✓
Cross-Site Scripting (XSS)
Why this is correct
Reflected XSS targets client-side execution by injecting malicious JavaScript through unvalidated parameters that get rendered immediately. This vulnerability allows attackers to steal session cookies, capture keystrokes, or perform actions on behalf of the authenticated user when they click a crafted link.
- ✗
Remote Code Execution
Why it's wrong here
Remote code execution affects the server-side application logic by allowing attackers to execute operating system commands via vulnerable functions. Unlike client-side XSS, RCE compromises the underlying server infrastructure rather than the browser context of individual visiting users.
- ✗
Cross-Site Request Forgery
Why it's wrong here
CSRF forces an authenticated user to execute unwanted actions on a web application in which they are currently logged in. It relies on predictable request parameters rather than injecting and executing arbitrary scripts within the context of the victim browser.
About these practice questions
This PEN-200 question is part of Courseiva's 285-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official OffSec exam blueprint
This PEN-200 practice question is part of Courseiva's free OffSec certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PEN-200 exam.