CAP Certified AppSec Practitioner Exam Question and Answers

The HTTP request is a POST to /changepassword with a session cookie (JSESSIONID) and parameters new_password and confirm_password. Let’s evaluate each option:

Option A ("The change password feature does not validate the user"): The request includes a JSESSIONID cookie, which typically indicates that the user is authenticated via a session. There’s no evidence that user validation is absent, so this is not correct.

Option B ("The change password feature uses basic authorization"): Basic authorization would involve an Authorization: Basic header with a Base64-encoded username and password, which is not present here. The authentication appears to be session-based (via cookie), not basic auth, so this is incorrect.

Option C ("The change password feature is vulnerable to Cross-Site Request Forgery attack"): Cross-Site Request Forgery (CSRF) occurs when a malicious site tricks a user’s browser into making an unintended request to another site where the user is authenticated. This request lacks a CSRF token (e.g., a unique, unpredictable token in the request body or header) to verify the request’s legitimacy. The Sec-Fetch-Site: same-origin header indicates the request is currently from the same origin, but this is a browser feature, not a server-side CSRF protection. Without a CSRF token, the endpoint is vulnerable to CSRF, as an attacker could craft a malicious form on another site to submit this request on behalf of the user. This is the correct answer.

Option D ("All of the above"): Since A and B are incorrect, D cannot be correct.

The correct answer is C, aligning with the CAP syllabus under "Cross-Site Request Forgery (CSRF)" and "OWASP Top 10 (A08:2021 - Software and Data Integrity Failures)."References: SecOps Group CAP Documents - "CSRF Prevention," "Session Management," and "OWASP Secure Coding Practices" sections.

A safe password must adhere to security best practices, including sufficient length, complexity, and resistance to common attacks (e.g., brute force, dictionary attacks). Let’s evaluate each option:

Option A ("Monday@123"): This password is weak because it combines a common word ("Monday") with a simple number and symbol pattern. It is vulnerable to dictionary attacks and does not meet complexity requirements (e.g., mixed case, special characters, and randomness).

Option B ("abcdef"): This is a sequence of letters with no numbers, special characters, or uppercase letters. It is extremely weak and easily guessable, making it unsafe.

Option C ("Sq0Jh819%ak"): This password is considered safe because it is at least 10 characters long, includes a mix of uppercase letters (S, J, H), lowercase letters (q, h, a, k), numbers (0, 8, 9, 1), and a special character (%). It lacks predictable patterns and meets modern password policy standards (e.g., NIST SP 800-63B recommends at least 8 characters with complexity).

Option D ("1234567890"): This is a simple numeric sequence, highly predictable, and vulnerable to brute-force attacks, making it unsafe.

The correct answer is C, as it aligns with secure password creation guidelines, a key topic in the CAP syllabus under "Authentication Security" and "Secure Coding Practices."References: SecOps Group CAP Documents - "Password Management," "Authentication Security," and "OWASP Secure Coding Guidelines" sections.

The HTTP response headers provide metadata about the server and its configuration. Let’s analyze each header and evaluate the statements:

Headers Breakdown:

Server: Microsoft-IIS/8.0: Indicates the web server is Microsoft Internet Information Services (IIS) version 8.0.

X-AspNet-Version: 2.0.50727: Indicates the application is using ASP.NET version 2.0.50727.

X-Powered-By: ASP.NET: Confirms the application framework is ASP.NET.

Other headers (e.g., Cache-Control, Content-Type, Expires) are standard and not directly relevant to the statements.

Option A ("The application is using an outdated server technology"): The Server: Microsoft-IIS/8.0 header indicates the server is running IIS 8.0, which was released in 2012 and is associated with Windows Server 2012. As of the current date (March 06, 2025), IIS 8.0 is outdated; Microsoft has released newer versions (e.g., IIS 10 with Windows Server 2016/2019). Additionally, mainstream support for Windows Server 2012 ended in October 2018, and extended support ended in October 2023, making IIS 8.0 unsupported and vulnerable to unpatched security issues. This statement is true.

Option B ("The application is disclosing the server version"): The Server: Microsoft-IIS/8.0 header explicitly discloses the server type (IIS) and version (8.0). Disclosing server version information is a security risk because attackers can use this to identify known vulnerabilities specific to that version (e.g., CVE exploits for IIS 8.0). Best practice is to suppress or obfuscate this header (e.g., Server: WebServer), so this statement is true.

Option C ("The application is disclosing the version of the framework used"): The X-AspNet-Version: 2.0.50727 header reveals the ASP.NET framework version (2.0.50727), which corresponds to .NET Framework 2.0, released in 2005. Disclosing the framework version is a security risk because attackers can target known vulnerabilities in that version (e.g., .NET Framework 2.0 is long unsupported; support ended in 2011). Best practice is to disable this header in the application configuration (e.g., in web.config for ASP.NET), so this statement is true.

Option D ("All of the above"): Since A (outdated server technology), B (disclosing server version), and C (disclosing framework version) are all true, this is the correct answer.

The correct answer is D, aligning with the CAP syllabus under "Information Disclosure" and "HTTP Header Security."References: SecOps Group CAP Documents - "Information Disclosure Prevention," "Server Hardening," and "OWASP Secure Headers Project" sections.

Multifactor Authentication (MFA) enhances security by requiring multiple forms of verification (e.g., something you know, like a password, and something you have, like a one-time code) to authenticate a user. It is effective against attacks that rely on stolen credentials, but let’s evaluate its impact on the listed vulnerabilities:

Option A ("Cross-Site Scripting Vulnerability"): XSS (Cross-Site Scripting) involves injecting malicious scripts into a web application that execute in the victim’s browser. MFA does not prevent XSS because it occurs after authentication; an attacker can exploit XSS to steal session cookies or perform actions on behalf of the authenticated user, bypassing MFA’s protection.

Option B ("Cross-Site Request Forgery Vulnerability"): CSRF (Cross-Site Request Forgery) tricks a user’s browser into making unintended requests to a site where they are authenticated. MFA does not prevent CSRF because the attack leverages the user’s existing session (post-authentication). The browser automatically sends cookies (e.g., session cookies) with the forged request, and MFA does not interfere with this process.

Option C ("Path Traversal Vulnerability"): Path Traversal allows an attacker to manipulate file paths (e.g., ../../etc/passwd) to access unauthorized files on the server. MFA does not prevent this because it is an application-level vulnerability unrelated to user authentication; an attacker with or without credentials can exploit it if the application fails to validate input.

Option D ("All of the above"): Correct, as MFA is designed to secure the authentication process, not to mitigate vulnerabilities like XSS, CSRF, or Path Traversal, which exploit application logic or session management after authentication.

The correct answer is D, aligning with the CAP syllabus under "Multifactor Authentication" and "Application Security Vulnerabilities."References: SecOps Group CAP Documents - "MFA Implementation," "XSS/CSRF/Path Traversal Mitigation," and "OWASP Authentication Cheat Sheet" sections.

Server-side attacks target vulnerabilities on the server, often involving code execution, data manipulation, or unauthorized access to server resources. Let’s evaluate each option:

Option A ("OS Code Injection"): This is a server-side attack where an attacker injects operating system commands (e.g., via system() calls in PHP) to execute arbitrary code on the server, such as rm -rf /.

Option B ("Cross-Site Request Forgery"): CSRF is a client-side attack where an attacker tricks a user’s browser into making an unintended request to a server where the user is authenticated (e.g., submitting a form to transfer funds). The attack exploits the client’s trust in the user’s session, not a server-side vulnerability. Thus, it is not a server-side attack.

Option C ("SQL Injection"): This is a server-side attack where an attacker injects malicious SQL code into a query (e.g., ' OR '1'='1) to manipulate the database, potentially extracting data or modifying records.

Option D ("Directory Traversal Attack"): This is a server-side attack where an attacker manipulates file paths (e.g., ../../etc/passwd) to access unauthorized files on the server outside the intended directory.

The correct answer is B, aligning with the CAP syllabus under "Client-Side vs. Server-Side Attacks" and "CSRF Prevention."References: SecOps Group CAP Documents - "CSRF Vulnerabilities," "Server-Side Attacks," and "OWASP Top 10 (A08:2021 - Software and Data Integrity Failures)" sections.

The request is a GET to /dashboard.php with a purl parameter (http://attacker.com). The response is a 302 Found redirect with a Location: http://attacker.com header, indicating the server redirects the client to the URL specified in the purl parameter. Let’s evaluate the statements:

Option A ("Application is likely to be vulnerable to Open Redirection vulnerability"): Correct. Open Redirection occurs when an application redirects to a user-supplied URL without validation. Here, the purl parameter (http://attacker.com) is directly used in the Location header, allowing an attacker to redirect users to a malicious site (e.g., for phishing). This is a classic Open Redirection vulnerability if the application does not restrict redirects to trusted domains.

Option B ("Application is vulnerable to Cross-Site Request Forgery vulnerability"): Incorrect. CSRF involves tricking a user into making an unintended request (e.g., via a malicious form). This response does not indicate a CSRF issue; there’s no evidence of state-changing actions or lack of CSRF tokens.

Option C ("Application uses an insecure protocol"): Incorrect. The request is made over HTTP, and the redirect is to an HTTP URL (http://attacker.com), which is insecure, but the response itself does not indicate the protocol used for the initial request. The server could be using HTTPS for the initial response; the insecure protocol is in the redirect destination, which relates to the Open Redirection issue, not the application’s protocol usage broadly.

Option D ("All of the above"): Incorrect, as only A is true.

The correct answer is A, aligning with the CAP syllabus under "Open Redirection Vulnerabilities" and "URL Redirection Attacks."References: SecOps Group CAP Documents - "Open Redirection," "Input Validation for Redirects," and "OWASP Top 10 (A10:2021 - Server-Side Request Forgery)" sections.

The code snippet loads a JavaScript file from a third-party CDN with integrity and crossorigin attributes. Let’s analyze what these attributes do:

The integrity attribute specifies a Subresource Integrity (SRI) hash (e.g., sha384-Fmb0CYeA6gM2uLuyvqs7x75u0mktDh2nKLomp3PHkJ0b5vJF2qF6Gbrc/6dK), which the browser uses to verify the integrity of the loaded script. If the script’s content does not match the hash, the browser will not execute it, protecting against tampering (e.g., if the CDN is compromised).

The crossorigin="anonymous" attribute ensures the request does not send credentials (e.g., cookies) and allows the script to be loaded from a different origin while enabling CORS (Cross-Origin Resource Sharing).

Option A ("The code snippet will perform validations for Cross-Site Scriptingattacks"): Incorrect. XSS (Cross-Site Scripting) involves injecting malicious scripts into a page. The integrity attribute ensures the script’s integrity but does not validate the script’s content for XSS vulnerabilities (e.g., if the script itself contains malicious code). XSS prevention requires other measures, like Content Security Policy (CSP) or input sanitization.

Option B ("The code snippet will perform validations for Cross-Site Request Forgery attacks"): Incorrect. CSRF (Cross-Site Request Forgery) involves tricking a user into making unintended requests. The integrity and crossorigin attributes do not address CSRF, which requires server-side protections like CSRF tokens.

Option C ("The code snippet will perform Subresource Integrity (SRI) checks"): Correct. The integrity attribute explicitly enables SRI, ensuring the browser verifies the script’s hash before execution. This protects against supply chain attacks where a third-party script might be modified maliciously.

Option D ("The code snippet will perform validations for Outdated Javascript checks"): Incorrect. The snippet does not check for outdated JavaScript versions. SRI ensures the script matches the expected hash but does not validate the script’s version or security status.

The correct answer is C, aligning with the CAP syllabus under "Subresource Integrity (SRI)" and "Third-Party Script Security."References: SecOps Group CAP Documents - "SRI Implementation," "Third-Party Resource Security," and "OWASP Secure Coding Practices" sections.

The screenshot shows an HTTP response header from https://example.com with a 404 status. Let’s evaluate each option:

Option A ("The application discloses the framework name and version"): The X-Powered-By: PHP/5.4.5-5 header reveals the server is running PHP version 5.4.5-5, which is a security risk as it exposes the framework and version. This information can help attackers identify known vulnerabilities, making A incorrect (i.e., it is a problem).

Option B ("The application reveals user-agent details"): The response does not include user-agent details; it only shows the server’s configuration. User-agent details are part of the request, not the response, so this is incorrect (not a problem here).

Option C ("A cookie is set with HttpOnly and a Secure flag"): The Cookie header includes HttpOnly and Secure attributes, which are best practices to prevent JavaScript access and ensure transmission over HTTPS, respectively. This is correct behavior, so it is not incorrect.

Option D ("The application accepts insecure protocol"): The response uses https://, indicating a secure protocol (TLS), and there’s no evidence of accepting insecure protocols like HTTP. This is not incorrect.

Thus, the incorrect statement is A, as disclosing the framework name and version via X-Powered-By is a security misconfiguration. This aligns with the CAP syllabus under "Security Headers" and "Information Disclosure."References: SecOps Group CAP Documents - "Security Misconfigurations," "HTTP Headers," and "OWASP Top 10 (A05:2021 - Security Misconfiguration)" sections.

A Race Condition vulnerability occurs in multi-threaded or multi-process applications when two or more threads access a shared resource concurrently, and the outcome depends on the non-deterministic order of their execution. This can lead to inconsistent states or security issues, such as privilege escalation or data corruption, if the access is not properly synchronized (e.g., using locks or semaphores). The classic definition focuses on concurrent access to the same resource.

Option A ("A situation that occurs when two threads access the same resource at the same time"): Correct, as this accurately describes a race condition where the lack of synchronization on a shared resource (e.g., a file, variable, or database entry) can lead to unpredictable behavior.

Option B ("A situation that occurs when two threads access different resources at the same time"): Incorrect, as race conditions specifically involve contention over the same resource, not different ones.

Option C ("A situation that occurs when a single thread unpredictably accesses two resources"): Incorrect, as race conditions require multiple threads or processes; a single thread’s behavior is not a race condition.

Option D ("A situation that occurs when a single thread predictably accesses two resources"): Incorrect, as predictability negates the race condition concept, and it still involves only one thread.

The correct answer is A, aligning with the CAP syllabus under "Race Condition Vulnerabilities" and "Multi-Threaded Security."References: SecOps Group CAP Documents - "Concurrency Issues," "Race Conditions," and "OWASP Secure Coding Practices" sections.

SAML (Security Assertion Markup Language) is an open standard for exchanging authentication and authorization data between parties, particularly in the context of single sign-on (SSO). It is based on XML and is widely used to enable secure web-based authentication and authorization across different domains. The correct full form isSecurity Assertion Markup Language, where "Assertion" refers to statements about a subject (e.g., identity, attributes), "Markup" indicates the XML-based structure, and "Language" denotes the defined syntax.

Option A ("Security Assertion Markup Language"): This is the correct and official full form of SAML as defined by OASIS (Organization for the Advancement of Structured Information Standards).

Option B ("Security Authorization Markup Language"): Incorrect, as "Authorization" is not part of the acronym; SAML focuses on both authentication and authorization assertions.

Option C ("Security Assertion Management Language"): Incorrect, as "Management" is not part of the acronym; SAML is about markup, not management.

Option D ("Secure Authentication Markup Language"): Incorrect, as "Secure" is not part of the acronym, and SAML covers more than just authentication.

The correct answer is A, aligning with the CAP syllabus under "Authentication and Authorization" and "Single Sign-On (SSO) Standards."References: SecOps Group CAP Documents - "SAML Overview," "Authentication Protocols," and "OWASP Identity Management" sections.

Null Byte Injection is a vulnerability where a null byte character (\0 or ASCII 0) is injected into user-supplied input to manipulate application behavior, often bypassing filters or terminating strings prematurely in languages like C or C++ that rely on null-terminated strings. In web applications, this is typically encoded in URLs using percent-encoding (e.g., %xx, where xx is the hexadecimal value). The ASCII value of a null byte is 0, which is represented as %00 in URL encoding.

Option A ("%01"): Represents the ASCII character with value 1 (Start of Heading), not a null byte.

Option B ("%10"): Represents the ASCII character with value 16 (Data Link Escape), not a null byte.

Option C ("%25"): Represents the % character itself (ASCII 37), not a null byte.

Option D ("%00"): Represents the null byte (ASCII 0), which is the correct URL-encoded form used in Null Byte Injection attacks.

The correct answer is D, aligning with the CAP syllabus under "Injection Attacks" and "Input Validation Bypasses."References: SecOps Group CAP Documents - "Null Byte Injection," "URL Encoding," and "OWASP Injection Prevention" sections.

This question is identical to Question 52, describing a scenario where a TLS certificate has expired, causing a TLS error message, and asking about the correct course of action. The analysis remains the same:

Option A ("There is no urgency to renew the certificate as the communication is still over TLS"): Incorrect. An expired TLS certificate invalidates the trust model, even if the connection technically uses TLS. Browsers will issue warnings, and users may bypass them, but the lack of a valid certificate compromises security, making renewal urgent.

Option B ("There is an urgency to renew the certificate as the users of the website may get conditioned to ignore TLS warnings and therefore ignore a legitimate warning which could be a real Man-in-the-Middle attack"): Correct. Repeated exposure to TLS warnings due to an expired certificate may desensitize users, increasing the risk that they ignore legitimate warnings from a Man-in-the-Middle (MitM) attack. Renewing the certificate promptly is essential to maintain security and user trust.

The correct answer is B, aligning with the CAP syllabus under "TLS Configuration" and "Certificate Management."References: SecOps Group CAP Documents - "TLS Security," "Certificate Expiry Management," and "OWASP Transport Layer Protection Cheat Sheet" sections.

A Dependency Confusion Attack occurs when an attacker uploads a malicious package with the same name as a private package to a public package repository (e.g., npm, PyPI), causing a package manager to prioritize the malicious public package over the intended private one due to misconfiguration or version precedence. To identify potential private packages for such an attack, attackers analyze dependency configuration files that list the application’s dependencies.

Option A ("package.json"): This file is used by npm (Node.js package manager) to define dependencies for JavaScript projects. It lists package names and versions, making it a prime target for identifying private packages that might be targeted in a dependency confusion attack.

Option B ("requirements.txt"): This file is used by pip (Python package manager) to define dependencies for Python projects. It similarly lists package names and versions, making it another target for identifying private packages.

Option C ("Both A and B"): Correct, as both package.json (JavaScript/Node.js) and requirements.txt (Python) are dependency configuration files that can reveal private package names, which an attacker might exploit in a dependency confusion attack.

Option D ("None of the above"): Incorrect, as both files are relevant.

The correct answer is C, aligning with the CAP syllabus under "Supply Chain Attacks" and "Dependency Management."References: SecOps Group CAP Documents - "Dependency Confusion Attacks," "Software Supply Chain Security," and "OWASP Dependency-Check Guide" sections.

Hashing algorithms are used to securely store passwords by transforming them into fixed-length strings. A secure hashing algorithm for passwords should be resistant to collision attacks, preimage attacks, and brute-force attempts, and should be slow to compute to deter attackers. Let’s evaluate the options:

Option A ("SHA-0"): SHA-0 is the original version of the SHA family, published in 1993, but it was quickly withdrawn due to serious cryptographic weaknesses (e.g., collision vulnerabilities). It is not secure and should not be used.

Option B ("MD5"): MD5 is a widely used hash function but is cryptographically broken. It is vulnerable to collision attacks (e.g., practical attacks demonstrated since 2004) and is extremely fast, making it unsuitable for password hashing as it can be brute-forced easily.

Option C ("SHA-1"): SHA-1, part of the SHA family, is also considered broken for security purposes. It has known collision vulnerabilities (e.g., the SHAttered attack in 2017 demonstrated practical collisions), and like MD5, it is too fast for secure password hashing.

Option D ("Bcrypt"): Bcrypt is specifically designed for password hashing. It is a slow hashing algorithm with a configurable work factor (cost factor), making it resistant to brute-force attacks. It also includes a built-in salt to prevent rainbow table attacks. Bcrypt is widely recommended by security standards (e.g., OWASP, NIST) for secure password storage and is the most secure option among those listed.

The correct answer is D, aligning with the CAP syllabus under "Password Hashing" and "Cryptographic Best Practices."References: SecOps Group CAP Documents - "Secure Password Storage," "Hashing Algorithms," and "OWASP Password Storage Cheat Sheet" sections.

The vulnerability described is anInsecure Direct Object Reference (IDOR), where manipulating the order_id (e.g., 53870) allows unauthorized access to other users’ orders. The fixes proposed by Bob and John aim to obscure the numeric value of order_id to prevent easy guessing or manipulation:

Bob’s Fix (SHA1 Hash): Replaces order_id=53870 with order_id=1ff0fe6f1599536d1326418124a261bc98b8ea1 (SHA1 hash of 53870). While this obscures the original value, an attacker can still attempt to hash potential order IDs (e.g., 53871, 53872) and test them in the URL. If the application directly uses the hash to look up the order without validating the user’s authorization, the vulnerability persists. SHA1 is aone-way hash, but it does not inherently enforce access control.

John’s Fix (Base64 Encoding): Replaces order_id=53870 with order_id=NTM4NzA= (Base64 encoding of 53870). Base64 is a reversible encoding, and an attacker can easily decode NTM4NzA= back to 53870 using standard tools. If the application decodes it and uses the original value to fetch orders without authorization checks, the IDOR vulnerability remains.

Evaluation: Both fixes address the symptom (disclosing the numeric value) but fail to address the root cause: lack of authorization validation. The application must ensure that only the authenticated user can access their own orders, regardless of the order_id format (numeric, hashed, or encoded). Neither fix includes such a check, so the vulnerability persists.

Option A ("Both solutions are adequate to fix the problem"): Incorrect, as neither solution enforces authorization.

Option B ("Both solutions are inadequate and the vulnerability is still not fixed"): Correct, as both SHA1 hashing and Base64 encoding are superficial changes that do not prevent unauthorized access.

Option C ("Only John’s solution fixes the problem"): Incorrect, as John’s Base64 encoding is reversible and does not fix the IDOR issue.

Option D ("Only Bob’s solution fixes the problem"): Incorrect, as Bob’s SHA1 hashing also does not address the authorization flaw.

The correct answer is B, aligning with the CAP syllabus under "Insecure Direct Object References (IDOR)" and "Access Control Best Practices."References: SecOps Group CAP Documents - "IDOR Mitigation," "Cryptographic Hashing," and "OWASP Access Control Testing Guide" sections.