Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
Scan the code below and identify the vulnerability which is the most applicable for this scenario.
The code snippet shows HTML <meta> and <link> tags, along with a <script> tag, loading external resources:
Bootstrap CSS from cdnjs.cloudflare.com (version 4.1.1)
jQuery JavaScript from cdnjs.cloudflare.com (version 3.3.1)
Let's evaluate the potential vulnerabilities:
The resources are loaded from a third-party CDN (cdnjs.cloudflare.com), and the versions specified (Bootstrap 4.1.1 and jQuery 3.3.1) may have known vulnerabilities. For instance, jQuery 3.3.1 has known XSS (Cross-Site Scripting) vulnerabilities (e.g., CVE-2019-11358) that can be exploited if the library is used insecurely. Similarly, Bootstrap 4.1.1 has known issues (e.g., CVE-2018-14041) related to XSS in certain components like tooltips or modals if not configured properly.
The use of outdated or vulnerable third-party components is a Component with a Known Vulnerability, a common issue in web applications. The CAP syllabus emphasizes identifying and mitigating risks from third-party libraries, especially those with known CVEs.
Option A ('SQL Injection'): SQL injection occurs in server-side database queries, not in client-side HTML or JavaScript loading. This code snippet does not involve database interaction, so this is incorrect.
Option B ('Type Juggling'): Type juggling is a PHP-specific vulnerability where loose type comparison (== vs ===) leads to security issues. This code is HTML/JavaScript, not PHP, so type juggling does not apply.
Option C ('Component with a Known Vulnerability'): As explained, the use of potentially outdated jQuery and Bootstrap versions introduces the risk of known vulnerabilities, making this the most applicable answer.
Option D ('Server-Side Request Forgery'): SSRF involves tricking the server into making unauthorized requests, which is not relevant here as the code loads resources in the browser, not on the server.
The correct answer is C, aligning with the CAP syllabus under 'Component Vulnerabilities' and 'OWASP Top 10 (A09:2021 - Using Components with Known Vulnerabilities).'
A robots.txt file tells the search engine crawlers about the URLs which the crawler can access on your site. Which of the following is true about robots.txt?
The robots.txt file is a text file placed in a website's root directory to communicate with web crawlers (e.g., Googlebot) about which pages or resources should not be accessed or indexed. It uses directives like Disallow to specify restricted areas (e.g., Disallow: /admin/). However, robots.txt is not a security mechanism; it is only a request to crawlers, and malicious bots or users can ignore it.
Option A ('Developers must not list any sensitive files and directories in this file'): Correct. Listing sensitive files or directories (e.g., Disallow: /secret/) in robots.txt can inadvertently expose their existence to attackers, who can then attempt to access them directly. The best practice is to avoid mentioning sensitive paths and rely on proper access controls (e.g., authentication, authorization) instead.
Option B ('Developers must list all sensitive files and directories in this file to secure them'): Incorrect. Listing sensitive paths in robots.txt does not secure them; it only informs crawlers to avoid them, and it can serve as a roadmap for attackers.
Option C ('Both A and B'): Incorrect, as A and B are contradictory; B is false.
Option D ('None of the above'): Incorrect, as A is true.
The correct answer is A, aligning with the CAP syllabus under 'Web Crawler Security' and 'Information Disclosure Prevention.'
Which is the most effective way of input validation to prevent Cross-Site Scripting attacks?
Cross-Site Scripting (XSS) attacks occur when an attacker injects malicious scripts (e.g., JavaScript) into a web application, which are then executed in a victim's browser. Effective input validation is a key defense against XSS by ensuring that user input does not contain malicious content.
Option A ('Blacklisting HTML and other harmful characters'): Blacklisting involves blocking known harmful characters (e.g., <, >, &) or patterns. While this can mitigate some XSS attacks, it is not the most effective approach because blacklists can be bypassed (e.g., using alternate encodings, nested tags, or new attack vectors). Blacklisting is inherently reactive and prone to evasion.
Option B ('Whitelisting and allowing only trusted input'): Whitelisting involves defining a strict set of allowed characters or patterns (e.g., only alphanumeric characters for a username). This is the most effective method because it explicitly permits only safe input and rejects everything else, making it much harder for attackers to inject malicious scripts. For example, if a field expects a phone number, a whitelist might allow only digits, spaces, and dashes, rejecting any HTML or script tags outright.
Option C ('Using a Web Application Firewall (WAF)'): A WAF can help detect and block XSS attacks by filtering malicious requests, but it is not an input validation method. WAFs are a secondary defense and can be bypassed; they are not a substitute for proper validation at the application level.
Option D ('Marking Cookie as HttpOnly'): The HttpOnly flag prevents cookies from being accessed by JavaScript, mitigating the impact of XSS (e.g., stealing session cookies), but it does not prevent the XSS attack itself. It addresses the consequence, not the root cause, and is not an input validation technique.
The correct answer is B, aligning with the CAP syllabus under 'Cross-Site Scripting (XSS)' and 'Input Validation Best Practices.'
In the context of NoSQL injection, which of the following is correct?
Statement A: NoSQL databases provide looser consistency restrictions than traditional SQL databases. By requiring fewer relational constraints and consistency checks, NoSQL databases often offer performance and scaling benefits. Yet these databases are still potentially vulnerable to injection attacks, even if they aren't using the traditional SQL syntax.
Statement B: NoSQL database calls are written in the application's programming language, a custom API call, or formatted according to a common convention (such as XML, JSON, LINQ, etc).
Let's evaluate the two statements about NoSQL injection:
Statement A: NoSQL databases (e.g., MongoDB, Cassandra) are designed for scalability and flexibility, often sacrificing strict consistency for performance (e.g., eventual consistency in distributed systems). Unlike traditional SQL databases, they do not enforce rigid relational constraints, which simplifies scaling but does not eliminate the risk of injection attacks. Even without SQL syntax, NoSQL databases are vulnerable to injection if user input is not sanitized (e.g., in MongoDB, injecting $where or $ne operators). This statement is true.
Statement B: NoSQL database queries are typically written in the application's programming language (e.g., JavaScript for MongoDB), using a custom API (e.g., MongoDB's query API), or formatted in standards like JSON, XML, or LINQ. For example, a MongoDB query might look like db.collection.find({ 'key': input }), where input is a JSON-like structure. This statement accurately describes how NoSQL queries are constructed and is true.
Option A ('A is true, and B is false'): Incorrect, as both statements are true.
Option B ('A is false, and B is true'): Incorrect, as both statements are true.
Option C ('Both A and B are false'): Incorrect, as both statements are true.
Option D ('Both A and B are true'): Correct, as both statements accurately describe NoSQL databases and their vulnerability to injection.
The correct answer is D, aligning with the CAP syllabus under 'NoSQL Injection' and 'Database Security.'
Which of the following is NOT an asymmetric key encryption algorithm?
Asymmetric key encryption (also known as public-key cryptography) uses a pair of keys: a public key for encryption and a private key for decryption (or vice versa for signing). Symmetric key encryption, on the other hand, uses the same key for both encryption and decryption. Let's evaluate the options:
Option A ('AES'): AES (Advanced Encryption Standard) is a symmetric key encryption algorithm. It uses a single key (e.g., 128, 192, or 256 bits) for both encryption and decryption, making it a symmetric algorithm, not an asymmetric one.
Option B ('RSA'): RSA (Rivest-Shamir-Adleman) is an asymmetric key encryption algorithm. It uses a public key to encrypt data and a private key to decrypt it, making it a classic example of asymmetric cryptography.
Option C ('Diffie-Hellman'): Diffie-Hellman is an asymmetric key exchange algorithm. While it is primarily used for key exchange rather than direct encryption, it relies on asymmetric principles (public and private keys) to securely establish a shared secret, so it is considered part of asymmetric cryptography.
Option D ('DSA'): DSA (Digital Signature Algorithm) is an asymmetric algorithm used for digital signatures. It uses a pair of keys (public and private) for signing and verification, making it an asymmetric algorithm.
The correct answer is A, as AES is the only symmetric algorithm listed, aligning with the CAP syllabus under 'Cryptography Fundamentals' and 'Symmetric vs. Asymmetric Encryption.'
You found the xmrpc.php endpoint while performing a security assessment on a web application. The target application is most likely using which of the following Content Management Systems (CMS)?
The xmlrpc.php endpoint is a file commonly associated with WordPress, a popular Content Management System (CMS). XML-RPC (XML Remote Procedure Call) is a protocol used for remote communication, and in WordPress, xmlrpc.php enables features like remote publishing, pingbacks, and trackbacks. However, it is also a frequent target for attacks (e.g., brute-force attacks, DDoS) if not properly secured or disabled when unnecessary. While other CMS platforms like Drupal may support XML-RPC, they typically do not use a file named xmlrpc.php by default; Drupal's XML-RPC functionality is often integrated into its core or modules (e.g., via xmlrpc.module) and uses different endpoints.
Option A ('WordPress'): Correct, as xmlrpc.php is a hallmark of WordPress installations.
Option B ('Drupal'): Incorrect, as Drupal does not use xmlrpc.php by default; its XML-RPC endpoints are different.
Option C ('Both A and B'): Incorrect, as xmlrpc.php is specific to WordPress.
Option D ('None of the above'): Incorrect, as WordPress is the correct match.
The correct answer is A, aligning with the CAP syllabus under 'CMS Security' and 'WordPress Vulnerabilities.'
Under the same-origin policy (also SOP), a web browser permits scripts contained in a web page to access data in another web page, but only if both web pages have the same origin. Which of the following pages are in the same origin as that of the below URL?
http://www.example.com/dir/page2.html
http://www.example.com/dir/other.html
http://www.example.com:81/dir/other.html
http://www.example.com/dir/other.html
http://en.example.com/dir/other.html
The Same-Origin Policy (SOP) is a fundamental security mechanism in web browsers that restricts how a document or script loaded from one origin can interact with resources from another origin. An origin is defined by the combination of protocol, host, and port. Two pages have the same origin if their protocol (e.g., http://), host (e.g., www.example.com), and port (default is 80 for HTTP) match exactly. The given URL is http://www.example.com/dir/page2.html, which uses HTTP, host www.example.com, and the default port 80.
Option 1 ('http://www.example.com/dir/other.html'): Matches the protocol (http), host (www.example.com), and port (default 80), so it is in the same origin.
Option 2 ('http://www.example.com:81/dir/other.html'): Differs in port (81 vs. default 80), so it is a different origin.
Option 3 ('http://www.example.com/dir/other.html'): Identical to Option 1, matching protocol, host, and port, so it is in the same origin. However, since it's a duplicate of Option 1 in the list, it doesn't add a new page.
Option 4 ('http://en.example.com/dir/other.html'): Differs in host (en.example.com vs. www.example.com), so it is a different origin.
Since the question asks which pages are in the same origin, and only Option 1 (and its duplicate Option 3) matches, the correct answer is A ('1 Only'), considering unique pages. The CAP syllabus covers SOP under 'Client-Side Security' and 'Cross-Origin Resource Sharing (CORS).'
Exam domains verified against: Official The SecOps Group CAP exam guide, last checked October 2026.
Blacklisting blocks known malicious patterns while whitelisting accepts only known safe values. Whitelisting provides stronger security by default but requires careful enumeration of all legitimate inputs.
XSS attacks inject malicious scripts into web pages viewed by other users. Prevention requires encoding user input and validating all data before rendering it in the browser or sending it to APIs.
SQL injection exploits improper handling of user input in database queries. Parameterized queries and prepared statements prevent attackers from breaking out of the intended SQL structure.
Sample question from this domain above: Q1
XXE vulnerabilities occur when XML parsers process external entities without restriction. Disabling external entity processing in your XML parser is the primary defense against XXE exploitation.
CSRF tricks authenticated users into performing unwanted actions on behalf of an attacker. CSRF tokens tied to user sessions and same-site cookies prevent unauthorized requests from executing.
Encoding transforms data into a different format for safe transmission or storage without cryptographic security. Encryption scrambles data so only holders of the decryption key can read it, while hashing creates a one-way fingerprint for integrity verification.
Brute force attacks systematically guess credentials, requiring rate limiting and account lockout controls. Passwords must be hashed with strong algorithms, salted, and policies must enforce sufficient length and complexity.
Sample question from this domain above: Q5
The OWASP Top 10 lists the most critical security risks in web applications including injection, broken authentication, and sensitive data exposure. Understanding each vulnerability's mechanics and its real-world impact is essential for building secure applications.
The same origin policy restricts scripts from accessing data across different origins and prevents cross-domain attacks. Security headers like Content-Security-Policy, X-Frame-Options and Strict-Transport-Security add layers of protection at the HTTP level.
Sample question from this domain above: Q3
The same origin policy restricts scripts from accessing data across different origins and prevents cross-domain attacks. Security headers like Content-Security-Policy, X-Frame-Options and Strict-Transport-Security add layers of protection at the HTTP level.
TLS certificate misconfiguration including expired or mismatched certificates breaks the trust chain and allows man-in-the-middle attacks. Symmetric ciphers encrypt data using a shared secret while asymmetric ciphers use public and private keys for secure key exchange.
Sample question from this domain above: Q7
SSRF vulnerabilities allow attackers to make the server perform unauthorized requests to internal or external systems. Input validation and restricting the server's ability to reach sensitive internal services prevent exploitation.
IDOR occurs when direct object references like IDs are not properly validated, allowing users to access resources they do not own. Privilege escalation exploits flawed role checks, and parameter manipulation bypasses access controls. Insecure cookies with missing httpOnly or secure flags expose session tokens to theft.
Sample question from this domain above: Q4
File upload vulnerabilities let attackers upload malware or executable code to execute on the server. Validate file types, store uploads outside the web root, disable script execution in upload directories, and enforce size limits.
Code injection attacks insert malicious code that the application then executes with its own privileges. Avoid using user input in code evaluation functions, use parameterized APIs, and validate all input against strict whitelists.
Business logic flaws occur when the application's rules can be exploited to bypass intended safeguards or gain unauthorized benefits. Testing requires understanding the business workflow and finding ways to manipulate the sequence of operations or state transitions.
Directory traversal attacks use path sequences like './' to escape intended directories and access files outside them. Canonicalize and validate file paths, avoid passing user input directly to file operations, and run applications with minimal filesystem permissions.
Sample question from this domain above: Q2
Misconfigured security settings including default credentials, verbose error messages and unnecessary services create exploitable weaknesses. Security baselines, hardening guides, and regular configuration audits prevent these issues.
Sample question from this domain above: Q6
Information disclosure exposes sensitive data through error messages, comments in code or overly verbose responses. Remove debug output in production, handle errors gracefully without revealing internals, and control what information is visible to different user roles.
Using libraries and frameworks with known vulnerabilities introduces exploitable flaws directly into the application. Track dependencies, apply security updates promptly, and use composition analysis tools to detect vulnerable components.
Supply chain attacks compromise applications by exploiting vulnerabilities in dependencies, build processes or distribution channels. Verify package integrity, use dependency pinning, scan for malicious code and monitor upstream projects for security incidents.
Common questions about the exam itself
