A "Server-Side Includes" attack involves eccouncil video

Full Certification Question

A "Server-Side Includes" attack involves exploiting a web application by injecting scripts into HTML pages or remotely executing arbitrary code. If a specific web-page file type exists on the web server, it strongly indicates vulnerability to this kind of attack. Which web-page file type is a strong indication that the server is vulnerable to this attack?