CAP Certified AppSec Practitioner Exam Questions and Answers

Cross-Site Scripting (XSS) attacks occur when an attacker injects malicious scripts (e.g., JavaScript) into a web application, which are then executed in a victim’s browser. Effective input validation is a key defense against XSS by ensuring that user input does not contain malicious content.

Option A ("Blacklisting HTML and other harmful characters"): Blacklisting involves blocking known harmful characters (e.g., <, >, &) or patterns. While this can mitigate some XSS attacks, it is not the most effective approach because blacklists can be bypassed (e.g., using alternate encodings, nested tags, or new attack vectors). Blacklisting is inherently reactive and prone to evasion.

Option B ("Whitelisting and allowing only trusted input"): Whitelisting involves defining a strict set of allowed characters or patterns (e.g., only alphanumeric characters for a username). This is the most effective method because it explicitly permits only safe input and rejects everything else, making it much harder for attackers to inject malicious scripts. For example, if a field expects a phone number, a whitelist might allow only digits, spaces, and dashes, rejecting any HTML or script tags outright.

Option C ("Using a Web Application Firewall (WAF)"): A WAF can help detect and block XSS attacks by filtering malicious requests, but it is not an input validation method. WAFs are a secondary defense and can be bypassed; they are not a substitute for proper validation at the application level.

Option D ("Marking Cookie as HttpOnly"): The HttpOnly flag prevents cookies from being accessed by JavaScript, mitigating the impact of XSS (e.g., stealing session cookies), but it does not prevent the XSS attack itself. It addresses the consequence, not the root cause, and is not an input validation technique.

The correct answer is B, aligning with the CAP syllabus under "Cross-Site Scripting (XSS)" and "Input Validation Best Practices."References: SecOps Group CAP Documents - "XSS Prevention," "Input Validation and Sanitization," and "OWASP XSS Prevention Cheat Sheet" sections.

The payload {{7*7}} is a common test string used to detectServer-Side Template Injection (SSTI)vulnerabilities. SSTI occurs when user input is improperly rendered within a server-side template engine (e.g., Jinja2, Freemarker, or Handlebars), allowing the execution of arbitrary template expressions. If the server evaluates {{7*7}} and returns 49 (the result of 7 multiplied by 7), it indicates that the server is processing the input as a template expression, confirming an SSTI vulnerability. This can potentially lead to remote code execution if the template engine supports advanced features.

Option A ("Server Side Template Injection (SSTI)"): Correct, as {{7*7}} is a standard payload to test for SSTI by checking if the server evaluates the expression.

Option B ("Client-Side Template Injection (CSTI)"): Incorrect, as CSTI involves client-side rendering (e.g., JavaScript templates like Mustache), and {{7*7}} would not be evaluated on the client unless explicitly designed to do so, which is not implied here.

Option C ("Both 1 and 2"): Incorrect, as the payload specifically targets server-side processing.

Option D ("None of the above"): Incorrect, as SSTI is applicable.

The correct answer is A, aligning with the CAP syllabus under "Server-Side Template Injection" and "Input Validation."References: SecOps Group CAP Documents - "SSTI Vulnerabilities," "Template Engine Security," and "OWASP Injection Prevention" sections.

The xmlrpc.php endpoint is a file commonly associated with WordPress, a popular Content Management System (CMS). XML-RPC (XML Remote Procedure Call) is a protocol used for remote communication, and in WordPress, xmlrpc.php enables features like remote publishing, pingbacks, and trackbacks. However, it is also a frequent target for attacks (e.g., brute-force attacks, DDoS) if not properly secured or disabled when unnecessary. While other CMS platforms like Drupal may support XML-RPC, they typically do not use a file named xmlrpc.php by default; Drupal’s XML-RPC functionality is often integrated into its core or modules (e.g., via xmlrpc.module) and uses different endpoints.

Option A ("WordPress"): Correct, as xmlrpc.php is a hallmark of WordPress installations.

Option B ("Drupal"): Incorrect, as Drupal does not use xmlrpc.php by default; its XML-RPC endpoints are different.

Option C ("Both A and B"): Incorrect, as xmlrpc.php is specific to WordPress.

Option D ("None of the above"): Incorrect, as WordPress is the correct match.

The correct answer is A, aligning with the CAP syllabus under "CMS Security" and "WordPress Vulnerabilities."References: SecOps Group CAP Documents - "Content Management System Security," "WordPress Hardening," and "OWASP CMS Security Guide" sections.

The Same-Origin Policy (SOP) is a fundamental security mechanism in web browsers that restricts how a document or script loaded from one origin can interact with resources from another origin. An origin is defined by the combination ofprotocol,host, andport. Two pages have the same origin if their protocol (e.g., http://), host (e.g., www.example.com ), and port (default is 80 for HTTP) match exactly. The given URL is http://www.example.com/dir/page2.html, which uses HTTP, host www.example.com, and the default port 80.

Option 1 ("http://www.example.com/dir/other.html"): Matches the protocol (http), host (www.example.com ), and port (default 80), so it is in the same origin.

Option 2 ("http://www.example.com:81/dir/other.html"): Differs in port (81 vs. default 80), so it is a different origin.

Option 3 ("http://www.example.com/dir/other.html"): Identical to Option 1, matching protocol, host, and port, so it is in the same origin. However, since it’s a duplicate of Option 1 in the list, it doesn’t add a new page.

Option 4 ("http://en.example.com/dir/other.html"): Differs in host (en.example.com vs.www.example.com ), so it is a different origin.

Since the question asks which pages are in the same origin, and only Option 1 (and its duplicate Option 3) matches, the correct answer is A ("1 Only"), considering unique pages. The CAP syllabus covers SOP under "Client-Side Security" and "Cross-Origin Resource Sharing (CORS)."References: SecOps Group CAP Documents - "Same-Origin Policy," "Browser Security Models," and "OWASP Client-Side Security" sections.

The password reset mechanism now includes a one-time random token alongside the userId in the reset link: https://example.com/reset_password?userId=5298 &token=70e7803e-bf53-45e1-8a3f-fb15da7de3a0. Let’s evaluate the effectiveness of this mechanism:

Analysis: The inclusion of a one-time random token (e.g., 70e7803e-bf53-45e1-8a3f-fb15da7de3a0) is a best practice for secure password reset mechanisms. This token should be unique, unpredictable, and tied to the specific user’s reset request (e.g., stored in the database with an expiration time). When the user clicks the link, the application should verify that the token matches the one associated with the userId and that it hasn’t been used or expired.

Preventing Arbitrary Resets: Without the token, an attacker could manipulate the userId (e.g., to 5299) to reset another user’s password (as seen in Question 45). However, with the token, the attacker would need to guess the correct token for the targeted userId, which is computationally infeasible if the token is sufficiently random (e.g., a UUID or cryptographically secure random string) and properly validated. This prevents unauthorized password resets.

Additional Considerations: The link uses https://, ensuring a secure channel (unlike Question 45). The message "If the email exists..." prevents username enumeration, as discussed previously.

Option A ("True"): Correct, as the one-time random token, if implemented correctly (e.g., validated server-side, single-use, time-limited), prevents an attacker from resetting arbitrary users’ passwords.

Option B ("False"): Incorrect, as the mechanism is secure with the token.

The correct answer is A, aligning with the CAP syllabus under "Secure Password Reset" and "Token-Based Authentication."References: SecOps Group CAP Documents - "Password Reset Security," "Token Generation Best Practices," and "OWASP Forgot Password Cheat Sheet" sections.

Cookies can have security attributes to enhance their protection against various attacks. The question asks which attribute ensures that the cookie is only sent over a TLS (encrypted) channel, meaning it is transmitted securely via HTTPS and not over unencrypted HTTP.

Option A ("Secure"): The Secure attribute ensures that the browser only sends the cookie over a secure, encrypted connection (i.e., HTTPS). If a request is made over HTTP, the browser will not include the cookie, preventing it from being intercepted in plaintext. This is the correct answer.

Option B ("HttpOnly"): The HttpOnly attribute prevents the cookie from being accessed by JavaScript (e.g., via document.cookie), mitigating XSS attacks that steal cookies, but it does not enforce transmission over TLS.

Option C ("No_XSS"): This is not a valid cookie attribute; it appears to be a made-up termand does not relate to TLS enforcement.

Option D ("None of the above"): Incorrect, as the Secure attribute directly addresses the requirement.

The correct answer is A, aligning with the CAP syllabus under "Cookie Security" and "Session Management."References: SecOps Group CAP Documents - "Cookie Security Attributes," "Secure Session Management," and "OWASP Session Management Cheat Sheet" sections.

Asymmetric key encryption (also known as public-key cryptography) uses a pair of keys: a public key for encryption and a private key for decryption (or vice versa for signing). Symmetric key encryption, on the other hand, uses the same key for both encryption and decryption. Let’s evaluate the options:

Option A ("AES"): AES (Advanced Encryption Standard) is a symmetric key encryption algorithm. It uses a single key (e.g., 128, 192, or 256 bits) for both encryption and decryption, making it a symmetric algorithm, not an asymmetric one.

Option B ("RSA"): RSA (Rivest-Shamir-Adleman) is an asymmetric key encryption algorithm. It uses a public key to encrypt data and a private key to decrypt it, making it a classic example of asymmetric cryptography.

Option C ("Diffie-Hellman"): Diffie-Hellman is an asymmetric key exchange algorithm. While it is primarily used for key exchange rather than direct encryption, it relies on asymmetric principles (public and private keys) to securely establish a shared secret, so it is considered part of asymmetric cryptography.

Option D ("DSA"): DSA (Digital Signature Algorithm) is an asymmetric algorithm used for digital signatures. It uses a pair of keys (public and private) for signing and verification, making it an asymmetric algorithm.

The correct answer is A, as AES is the only symmetric algorithm listed, aligning with the CAP syllabus under "Cryptography Fundamentals" and "Symmetric vs. Asymmetric Encryption."References: SecOps Group CAP Documents - "Cryptographic Algorithms," "Symmetric and Asymmetric Encryption," and "OWASP Cryptographic Storage Cheat Sheet" sections.

Insecure Deserialization occurs when untrusted data is deserialized by an application, allowing attackers to execute arbitrary code, manipulate objects, or cause denial-of-service. If user input is not validated or sanitized, many languages and frameworks are vulnerable to this issue because deserialization often involves reconstructing objects from serialized data, which can include malicious payloads.

Option A (".NET"): .NET applications (e.g., using BinaryFormatter or XmlSerializer) areprone to Insecure Deserialization if untrusted data is deserialized without validation. For example, BinaryFormatter can execute arbitrary code during deserialization, a well-known vulnerability (e.g., CVE-2017-11882).

Option B ("Java"): Java’s ObjectInputStream is notoriously vulnerable to Insecure Deserialization. Libraries like java.io.Serializable can execute code during deserialization of untrusted data, as seen in vulnerabilities like Apache Commons Collections (CVE-2015-7501).

Option C ("PHP"): PHP applications using functions like unserialize() are vulnerable if they deserialize untrusted input. For example, an attacker can craft a serialized object to trigger a gadget chain, leading to remote code execution (e.g., CVE-2016-7124).

Option D ("All of the above"): Correct, as .NET, Java, and PHP all have deserialization mechanisms that, if not properly secured, can lead to Insecure Deserialization vulnerabilities when handling untrusted input.

The correct answer is D, aligning with the CAP syllabus under "Insecure Deserialization" and "OWASP Top 10 (A08:2021 - Software and Data Integrity Failures)."References: SecOps Group CAP Documents - "Insecure Deserialization," "Serialization Security," and "OWASP Deserialization Cheat Sheet" sections.

Cookies can have security attributes to protect them against various attacks. Let’s evaluate each option to determine which attribute is not used to secure cookies:

Option A ("HttpOnly"): The HttpOnly attribute prevents cookies from being accessed by JavaScript (e.g., via document.cookie). This mitigates XSS attacks that attempt to steal session cookies, making it a valid security attribute.

Option B ("Secure"): The Secure attribute ensures that the cookie is only sent over HTTPS connections, preventing it from being transmitted over unencrypted HTTP. This protects against interception (e.g., in a man-in-the-middle attack), making it a valid security attribute.

Option C ("Restrict"): There is no standard cookie attribute called Restrict. Cookie security attributes are well-defined (e.g., HttpOnly, Secure, SameSite), and Restrict does not exist in this context. This is not a valid attribute for securing cookies.

Option D ("Same-Site"): The SameSite attribute (e.g., SameSite=Strict or SameSite=Lax)controls whether a cookie is sent with cross-site requests. It helps mitigate CSRF attacks by ensuring the cookie is only sent with same-site requests (or limited cross-site scenarios), making it a valid security attribute.

The correct answer is C, as Restrict is not a recognized cookie attribute, aligning with the CAP syllabus under "Cookie Security" and "Session Management."References: SecOps Group CAP Documents - "Cookie Security Attributes," "Session Security," and "OWASP Session Management Cheat Sheet" sections.

The scenario describes an e-commerce website where a user can view order details by manipulating the order_id parameter in the URL (e.g., https://example.com/order_id=53870). A security researcher found that changing the order_id allows access to arbitrary orders and sensitive data, indicating an authorization issue. This is not a simple input validation problem (e.g., SQL injection or path traversal), as the input (order_id) is processed, but the system fails to enforce proper access controls. This is a classic case of Insecure Direct Object References (IDOR), where an attacker can access resources by guessing or manipulating identifiers without proper authorization checks. The root cause is a weak authorization mechanism, likely tied to poor session management orprivilege validation, allowing unauthorized users to view others’ data.

Option A ("The root cause of the problem is a lack of input validation..."): Incorrect, as the issue is not about invalid input (e.g., malicious code) but about unauthorized access to valid data. Whitelisting might help sanitize input, but it doesn’t address authorization.

Option B ("The root cause of the problem is a weak authorization (Session Management)..."): Correct, as the problem stems from inadequate authorization checks. Validating user privileges (e.g., ensuring the user can only access their own orders) or improving session management (e.g., tying orders to user sessions) can fix this IDOR vulnerability.

Option C ("The problem can be solved by implementing a Web Application Firewall (WAF)"): Incorrect as a standalone solution, as WAFs mitigate certain attacks (e.g., SQLi, XSS) but are not a substitute for fixing authorization logic. A WAF might detect patterns but won’t enforce proper access control.

Option D ("None of the above"): Incorrect, as Option B accurately identifies the root cause and solution.

The correct answer is B, aligning with the CAP syllabus under "Authorization and Access Control" and "OWASP Top 10 (A04:2021 - Insecure Design)."References: SecOps Group CAP Documents - "Session Management," "Insecure Direct Object References (IDOR)," and "OWASP Top 10" sections.

The request is a POST to /dashboard/userdata with a parameter useragent=http://127.0.0.1/admin. The response is a 200 OK with an HTML page titled "Admin Panel," suggesting the server processed the request and returned content from http://127.0.0.1/admin. Let’s evaluate the vulnerability:

Analysis: The useragent parameter contains a URL (http://127.0.0.1/admin), and the server appears to fetch content from this URL, as indicated by the response containing the "Admin Panel" page. The URL 127.0.0.1 refers to the server’s localhost, meaning the server is making an internal request to itself based on user input. This is a hallmark of Server-Side Request Forgery (SSRF), where an attacker can trick the server into making requests to arbitrary locations, including internal systems (e.g., 127.0.0.1) or external sites. SSRF can lead to accessing internal resources (e.g., admin panels, metadata endpoints) or performing unauthorized actions.

Option A ("HTTP Desync Attack"): HTTP Desync attacks exploit discrepancies in how front-end and back-end servers interpret HTTP requests (e.g., smuggling requests). This scenario involves a straightforward POST request with no evidence of desynchronization or smuggling, so this is incorrect.

Option B ("File Path Traversal Attack"): File Path Traversal involves manipulating file paths (e.g., ../../etc/passwd) to access unauthorized files on the server’s filesystem. The useragent parameter contains a URL, not a file path, and the response indicates a web request, not filesystem access, so this is incorrect.

Option C ("Open URL Redirection"): Open URL Redirection occurs when the server redirects the client to a user-supplied URL (e.g., via a Location header). The response here is a 200 OK, not a redirect (e.g., 302 Found), and the server is fetching content server-side, not redirecting the client, so this is incorrect.

Option D ("Server-Side Request Forgery"): Correct, as the server is making a request to http://127.0.0.1/admin based on the useragent parameter, indicating an SSRF vulnerability.

The correct answer is D, aligning with the CAP syllabus under "Server-Side Request Forgery (SSRF)" and "OWASP Top 10 (A10:2021 - Server-Side Request Forgery)."References: SecOps Group CAP Documents - "SSRF Vulnerabilities," "Input Validation for URLs," and "OWASP SSRF Prevention Cheat Sheet" sections.

A JWT consists of three parts:Header,Payload, andSignature, separated by dots (.). The given JWT is:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJUYW1I1joiU2vjbB3ZiNo_mn0vNWT4G1-ATqOTmo7rm70VI12WCdkMI_S1_bPg_G8

The first part (eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9) is the Header.

The second part (eyJUYW1I1joiU2vjbB3ZiNo_mn0vNWT4G1-ATqOTmo7rm70VI12WCdkMI_S1_bPg_G8) is the Payload.

The third part (not fully shown) would be the Signature, which is computed as HMAC-SHA256(base64UrlEncode(header) + "." + base64UrlEncode(payload), secret).

Option A ("eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 represents a JWT Signature"): Incorrect, as this is the Header, not the Signature.

Option B ("mn0vNWT4G1-ATqOTmo7rm70VI12WCdkMI_S1_bPg_G8 represents a JWT Signature"): Incorrect, as this is part of the Payload, not the Signature.

Option C ("eyJUYW1I1joiU2vjbB3ZiNo represents a JWT Signature"): Incorrect, as this is the beginning of the Payload, not the Signature.

Option D ("None of the above"): Correct, as none of the segments listed represent the JWT Signature (the third part, which is not fully shown).

The correct answer is D, aligning with the CAP syllabus under "JWT Structure" and "Token Security."References: SecOps Group CAP Documents - "JSON Web Tokens (JWT)," "Token Integrity," and "OWASP JWT Cheat Sheet" sections.

Let’s evaluate the two statements about NoSQL injection:

Statement A: NoSQL databases (e.g., MongoDB, Cassandra) are designed for scalability and flexibility, often sacrificing strict consistency for performance (e.g., eventual consistency in distributed systems). Unlike traditional SQL databases, they do not enforce rigid relational constraints, which simplifies scaling but does not eliminate the risk of injection attacks. Even without SQL syntax, NoSQL databases are vulnerable to injection if user input is not sanitized (e.g., in MongoDB, injecting $where or $ne operators). This statement is true.

Statement B: NoSQL database queries are typically written in the application’s programming language (e.g., JavaScript for MongoDB), using a custom API (e.g., MongoDB’s query API), or formatted in standards like JSON, XML, or LINQ. For example, a MongoDB query might look like db.collection.find({ "key": input }), where input is a JSON-like structure. This statement accurately describes how NoSQL queries are constructed and is true.

Option A ("A is true, and B is false"): Incorrect, as both statements are true.

Option B ("A is false, and B is true"): Incorrect, as both statements are true.

Option C ("Both A and B are false"): Incorrect, as both statements are true.

Option D ("Both A and B are true"): Correct, as both statements accurately describe NoSQL databases and their vulnerability to injection.

The correct answer is D, aligning with the CAP syllabus under "NoSQL Injection" and "Database Security."References: SecOps Group CAP Documents - "NoSQL Injection Vulnerabilities," "Database Query Security," and "OWASP Top 10 (A03:2021 - Injection)" sections.

The screenshot shows a login form where the user coder@viewer attempts to log in, and the application responds with "User does not exist." Let’s evaluate the statements:

Option A ("The application is vulnerable to username enumeration"): Correct. Username enumeration occurs when an application reveals whether a username exists in the system, often through distinct error messages. Here, the message "User does not exist" for coder@viewer directly indicates that the username is invalid, allowing an attacker to enumerate valid usernames by testing different inputs and observing the responses (e.g., "Invalid password" for existing users vs. "User does not exist"). Best practice is to use generic error messages like "Invalid username or password" to prevent enumeration.

Option B ("The application is vulnerable to brute-force attacks"): Incorrect. There’s no evidence in the screenshot of a lack of brute-force protections (e.g., rate limiting, account lockout). Brute-force vulnerability would require additional context, such as no CAPTCHA or no lockout mechanism, which is not shown.

Option C ("The application does not enforce a strong password policy"): Incorrect. The screenshot does not provide information about password requirements (e.g., length, complexity), so we cannot conclude whether a strong password policy is enforced.

Option D ("None of the above"): Incorrect, as A is true.

The correct answer is A, aligning with the CAP syllabus under "Username Enumeration" and "Authentication Security."References: SecOps Group CAP Documents - "Authentication Best Practices," "Enumeration Attacks," and "OWASP Authentication Cheat Sheet" sections.

The code snippet loads a JavaScript file from a third-party CDN with integrity and crossorigin attributes. Let’s analyze what these attributes do:

The integrity attribute specifies a Subresource Integrity (SRI) hash (e.g., sha384-Fmb0CYeA6gM2uLuyvqs7x75u0mktDh2nKLomp3PHkJ0b5vJF2qF6Gbrc/6dK), which the browser uses to verify the integrity of the loaded script. If the script’s content does not match the hash, the browser will not execute it, protecting against tampering (e.g., if the CDN is compromised).

The crossorigin="anonymous" attribute ensures the request does not send credentials (e.g., cookies) and allows the script to be loaded from a different origin while enabling CORS (Cross-Origin Resource Sharing).

Option A ("The code snippet will perform validations for Cross-Site Scriptingattacks"): Incorrect. XSS (Cross-Site Scripting) involves injecting malicious scripts into a page. The integrity attribute ensures the script’s integrity but does not validate the script’s content for XSS vulnerabilities (e.g., if the script itself contains malicious code). XSS prevention requires other measures, like Content Security Policy (CSP) or input sanitization.

Option B ("The code snippet will perform validations for Cross-Site Request Forgery attacks"): Incorrect. CSRF (Cross-Site Request Forgery) involves tricking a user into making unintended requests. The integrity and crossorigin attributes do not address CSRF, which requires server-side protections like CSRF tokens.

Option C ("The code snippet will perform Subresource Integrity (SRI) checks"): Correct. The integrity attribute explicitly enables SRI, ensuring the browser verifies the script’s hash before execution. This protects against supply chain attacks where a third-party script might be modified maliciously.

Option D ("The code snippet will perform validations for Outdated Javascript checks"): Incorrect. The snippet does not check for outdated JavaScript versions. SRI ensures the script matches the expected hash but does not validate the script’s version or security status.

The correct answer is C, aligning with the CAP syllabus under "Subresource Integrity (SRI)" and "Third-Party Script Security."References: SecOps Group CAP Documents - "SRI Implementation," "Third-Party Resource Security," and "OWASP Secure Coding Practices" sections.