Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
In the context of NoSQL injection, which of the following is correct?
Statement A: NoSQL databases provide looser consistency restrictions than traditional SQL databases. By requiring fewer relational constraints and consistency checks, NoSQL databases often offer performance and scaling benefits. Yet these databases are still potentially vulnerable to injection attacks, even if they aren't using the traditional SQL syntax.
Statement B: NoSQL database calls are written in the application's programming language, a custom API call, or formatted according to a common convention (such as XML, JSON, LINQ, etc).
Let's evaluate the two statements about NoSQL injection:
Statement A: NoSQL databases (e.g., MongoDB, Cassandra) are designed for scalability and flexibility, often sacrificing strict consistency for performance (e.g., eventual consistency in distributed systems). Unlike traditional SQL databases, they do not enforce rigid relational constraints, which simplifies scaling but does not eliminate the risk of injection attacks. Even without SQL syntax, NoSQL databases are vulnerable to injection if user input is not sanitized (e.g., in MongoDB, injecting $where or $ne operators). This statement is true.
Statement B: NoSQL database queries are typically written in the application's programming language (e.g., JavaScript for MongoDB), using a custom API (e.g., MongoDB's query API), or formatted in standards like JSON, XML, or LINQ. For example, a MongoDB query might look like db.collection.find({ 'key': input }), where input is a JSON-like structure. This statement accurately describes how NoSQL queries are constructed and is true.
Option A ('A is true, and B is false'): Incorrect, as both statements are true.
Option B ('A is false, and B is true'): Incorrect, as both statements are true.
Option C ('Both A and B are false'): Incorrect, as both statements are true.
Option D ('Both A and B are true'): Correct, as both statements accurately describe NoSQL databases and their vulnerability to injection.
The correct answer is D, aligning with the CAP syllabus under 'NoSQL Injection' and 'Database Security.'
Based on the below-mentioned code snippet, the 'filename' variable is vulnerable to which of the following attacks?
import os
filename = input("Enter the file name:")
path = "/var/www/html/files/" + filename
content = ""
with open(path, 'r') as file:
content = file.read()
print("File content:\n", content)
The code snippet is a Python script that takes user input for a filename, constructs a path by concatenating it with /var/www/html/files/, reads the file content, and prints it. The vulnerability arises because the filename variable is directly used in the path without sanitization or validation, allowing an attacker to manipulate it.
Path Traversal Vulnerability: An attacker can input a value like ../../etc/passwd to navigate outside the intended /var/www/html/files/ directory and access sensitive system files (e.g., /etc/passwd). Since the open() function will attempt to access the resulting path, this is a clear case of Path Traversal if the application runs with sufficient permissions.
Remote Code Execution (RCE): RCE would require the ability to execute arbitrary code, which is not directly possible here. The script only reads files, not executes them, unless the file contains executable code and the server interprets it (e.g., a PHP file on a web server), but this is not implied by the code alone.
Option A ('Path Traversal'): Correct, as the lack of input validation makes the code vulnerable to Path Traversal attacks.
Option B ('Remote Code Execution'): Incorrect, as the code does not execute the file content; it only reads it.
Option C ('Both A and B'): Incorrect, as RCE is not applicable here.
Option D ('None of the above'): Incorrect, as Path Traversal is a valid vulnerability.
The correct answer is A, aligning with the CAP syllabus under 'Path Traversal Attacks' and 'Input Validation.'
After purchasing an item on an e-commerce website, a user can view their order details by visiting the URL:
https://example.com/?order_id=53870
A security researcher pointed out that by manipulating the order_id value in the URL, a user can view arbitrary orders and sensitive information associated with that order_id. This attack is known as:
The scenario describes a vulnerability where a user can manipulate the order_id parameter in the URL (e.g., https://example.com/?order_id=53870) to access other users' order details, indicating a lack of proper access control. This is a classic case of an Insecure Direct Object Reference (IDOR) attack. IDOR occurs when an application exposes a reference to an internal object (e.g., an order ID) that can be manipulated by an unauthorized user to access resources they should not have access to, without validating the user's permissions.
Option A ('Insecure Direct Object Reference'): Correct, as the ability to change order_id to view arbitrary orders fits the definition of IDOR.
Option B ('Session Poisoning'): Incorrect, as session poisoning involves corrupting or altering a user's session data, which is not indicated here.
Option C ('Session Riding OR Cross-Site Request Forgery'): Incorrect, as CSRF involves tricking a user into submitting a request (e.g., via a malicious form), not manipulating a URL parameter directly.
Option D ('Server-Side Request Forgery'): Incorrect, as SSRF involves tricking the server into making unauthorized requests to internal or external resources, which is not the case here.
The correct answer is A, aligning with the CAP syllabus under 'Insecure Direct Object Reference (IDOR)' and 'OWASP Top 10 (A04:2021 - Insecure Design).'
Which of the following is correct?
TLS (Transport Layer Security) certificates are validated by browsers to ensure secure communication. Browsers maintain a trusted store of public keys from known Certifying Authorities (CAs), which are used to verify the digital signature of a TLS certificate presented by a server. This process involves checking the certificate's signature against the CA's public key to confirm its authenticity and validity. If the signature matches and other criteria (e.g., expiration, revocation) are met, the certificate is deemed valid.
Option A ('The browser contains the private key...'): Incorrect, as browsers do not contain private keys of CAs; private keys are kept secret by the CAs themselves.
Option B ('The browser contains the public key...'): Correct, as browsers use CA public keys to validate certificates, enabling differentiation between valid and invalid TLS certificates.
Option C ('The browser contains both the public and private key...'): Incorrect, as browsers only store public keys, not private keys, for security reasons.
Option D ('The browser does not have any mechanism...'): Incorrect, as browsers have robust mechanisms (via CA public keys) to validate TLS certificates.
The correct answer is B, aligning with the CAP syllabus under 'Secure Communication' and 'TLS Configuration.'
Which SQL function can be used to read the contents of a file during manual exploitation of the SQL injection vulnerability in a MySQL database?
SQL injection vulnerabilities allow attackers to manipulate database queries, potentially accessing unauthorized data, including file contents, if the database supports such operations. In MySQL, the LOAD_FILE() function is specifically designed to read the contents of a file on the server where the database is hosted, provided the file exists, the database user has appropriate privileges (e.g., FILE privilege), and the file is readable. For example, SELECT LOAD_FILE('/etc/passwd') could extract the contents of the /etc/passwd file if exploitable.
Option A ('READ_FILE()'): This is not a valid MySQL function.
Option B ('LOAD_FILE()'): This is the correct function for reading file contents in MySQL, making it the right choice for exploitation.
Option C ('FETCH_FILE()'): This is not a recognized MySQL function.
Option D ('GET_FILE()'): This is also not a valid MySQL function.
The correct answer is B, aligning with the CAP syllabus under 'SQL Injection' and 'Database Security.'
60 questions covering all exam domains, starting from $20
Exam domains verified against: Official The SecOps Group CAP exam guide, last checked September 2026.
Blacklisting blocks known malicious patterns while whitelisting accepts only known safe values. Whitelisting provides stronger security by default but requires careful enumeration of all legitimate inputs.
XSS attacks inject malicious scripts into web pages viewed by other users. Prevention requires encoding user input and validating all data before rendering it in the browser or sending it to APIs.
SQL injection exploits improper handling of user input in database queries. Parameterized queries and prepared statements prevent attackers from breaking out of the intended SQL structure.
XXE vulnerabilities occur when XML parsers process external entities without restriction. Disabling external entity processing in your XML parser is the primary defense against XXE exploitation.
CSRF tricks authenticated users into performing unwanted actions on behalf of an attacker. CSRF tokens tied to user sessions and same-site cookies prevent unauthorized requests from executing.
Encoding transforms data into a different format for safe transmission or storage without cryptographic security. Encryption scrambles data so only holders of the decryption key can read it, while hashing creates a one-way fingerprint for integrity verification.
Sample question from this domain above: Q4
Brute force attacks systematically guess credentials, requiring rate limiting and account lockout controls. Passwords must be hashed with strong algorithms, salted, and policies must enforce sufficient length and complexity.
Sample question from this domain above: Q2
The OWASP Top 10 lists the most critical security risks in web applications including injection, broken authentication, and sensitive data exposure. Understanding each vulnerability's mechanics and its real-world impact is essential for building secure applications.
The same origin policy restricts scripts from accessing data across different origins and prevents cross-domain attacks. Security headers like Content-Security-Policy, X-Frame-Options and Strict-Transport-Security add layers of protection at the HTTP level.
TLS certificate misconfiguration including expired or mismatched certificates breaks the trust chain and allows man-in-the-middle attacks. Symmetric ciphers encrypt data using a shared secret while asymmetric ciphers use public and private keys for secure key exchange.
SSRF vulnerabilities allow attackers to make the server perform unauthorized requests to internal or external systems. Input validation and restricting the server's ability to reach sensitive internal services prevent exploitation.
IDOR occurs when direct object references like IDs are not properly validated, allowing users to access resources they do not own. Privilege escalation exploits flawed role checks, and parameter manipulation bypasses access controls. Insecure cookies with missing httpOnly or secure flags expose session tokens to theft.
File upload vulnerabilities let attackers upload malware or executable code to execute on the server. Validate file types, store uploads outside the web root, disable script execution in upload directories, and enforce size limits.
Code injection attacks insert malicious code that the application then executes with its own privileges. Avoid using user input in code evaluation functions, use parameterized APIs, and validate all input against strict whitelists.
Business logic flaws occur when the application's rules can be exploited to bypass intended safeguards or gain unauthorized benefits. Testing requires understanding the business workflow and finding ways to manipulate the sequence of operations or state transitions.
Directory traversal attacks use path sequences like './' to escape intended directories and access files outside them. Canonicalize and validate file paths, avoid passing user input directly to file operations, and run applications with minimal filesystem permissions.
Sample question from this domain above: Q1
Misconfigured security settings including default credentials, verbose error messages and unnecessary services create exploitable weaknesses. Security baselines, hardening guides, and regular configuration audits prevent these issues.
Information disclosure exposes sensitive data through error messages, comments in code or overly verbose responses. Remove debug output in production, handle errors gracefully without revealing internals, and control what information is visible to different user roles.
Using libraries and frameworks with known vulnerabilities introduces exploitable flaws directly into the application. Track dependencies, apply security updates promptly, and use composition analysis tools to detect vulnerable components.
Supply chain attacks compromise applications by exploiting vulnerabilities in dependencies, build processes or distribution channels. Verify package integrity, use dependency pinning, scan for malicious code and monitor upstream projects for security incidents.
Common questions about the exam itself
