Secops-CAP Certified AppSec Practitioner Exam Free Dumps

dumps2025-03-31T10:04:42+08:00

The SecOps-CAP Certified AppSec Practitioner exam is designed to assess a candidate’s expertise in application security, secure coding practices, and threat mitigation strategies. Secops-CAP is an entry-level exam. The exam includes Multiple Choice Questions (MCQs) covering the syllabus. The time duration of the exam is 60 minutes. The exam will be proctored but can be taken online, anytime (on-demand) and from anywhere. Candidates scoring over 60% marks will be deemed to have successfully passed the exam. We provide the latest Certified AppSec Practitioner SecOps-CAP exam dumps, which can ensure you pass the test easily. Free Certified AppSec Practitioner SecOps-CAP exam dumps are available below.

Page 1 of 2

1. Salt is a cryptographically secure random string that is added to a password before it is hashed.

In this context, what is the primary objective of salting?

To defend against dictionary attacks or attacks against hashed passwords using a rainbow table.

To slow down the hash calculation process.

To generate a long password hash that is difficult to crack.

To add a secret message to the password hash.

2. Which of the following directives in a Content-Security-Policy HTTP response header, can be used to prevent a Clickjacking attack?

script-src

object-src

frame-ancestors

base-uri

3. The application is vulnerable to Cross-Site Scripting.

Which of the following exploitation is NOT possible at all?

Steal the user's session identifier stored on a non HttpOnly cookie

Steal the contents from the web page

Steal the contents from the application's database

Steal the contents from the user's keystrokes using keyloggers

4. Which of the following SSL/TLS protocols are considered to be insecure?

SSLv2 and SSLv3

TLSv1.0 and TLSv1.1

Both A and B

SSLv2, SSLv3, TLSv1.0, TLSv1.1, TLSv1.2 and TLSv1.3

5. In the context of the infamous log4j vulnerability (CVE-2021-44228), which vulnerability is exploited in the backend to achieve Remote Code Execution?

JNDI Injection

None of the above

6. In the context of the CORS (Cross-origin resource sharing) misconfiguration, which of the following statements is true?

CORS is exploitable if the value of the HTTP headers are Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: true

CORS is exploitable if the value of the HTTP headers are Access-Control-Allow-Origin: * and Access-Control-Allow-Credentials: false

CORS is exploitable if the value of the HTTP headers is Access-Control-Allow-Origin: * and the value of the Access-Control-Allow-Credentials header is irrelevant

All of the above

7. In the screenshot below, an attacker is attempting to exploit which vulnerability?

POST /upload.php HTTP/1.1

Host: example.com

Cookie: session=xyz123;JSESSIONID=abc123

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) rv:107.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW

Content-Length: 12345

Connection: keep-alive

Content-Disposition: form-data; name="avatar"; filename="malicious.php"

Content-Type: image/jpeg

<?php

phpinfo();

?>

HTTP Desync Attack

File Path Traversal Attack

File Upload Vulnerability

Server-Side Request Forgery

8. In the screenshot below, which of the following is incorrect?

Target: https://example.com

HTTP/1.1 404 Not Found

Date: Fri, 09 Dec 2022 18:03:49 GMT

Server: Apache

Vary: Cookie

X-Powered-By: PHP/5.4.5-5

X-Xss-Protection: 1; mode=block

X-Content-Type-Options: nosniff

Content-Length: 0

Content-Type: text/html; charset=UTF-8

Cookie: JSESSIONID=1234567890ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789; secure; HttpOnly; SameSite=None

The application discloses the framework name and version

The application reveals user-agent details

A cookie is set with HttpOnly and a Secure flag

The application accepts insecure protocol

9. Which of the following is considered as a safe password?

Monday@123

abcdef

Sq0Jh819%ak

1234567890

10. Which SQL function can be used to read the contents of a file during manual exploitation of the SQL injection vulnerability in a MySQL database?

READ_FILE()

LOAD_FILE()

FETCH_FILE()

GET_FILE()

Page 2 of 2

11. Which of the following is correct?

The browser contains the private key of all known Certifying Authorities (CA) and based on that, it differentiates between a valid and an invalid TLS Certificate

The browser contains the public key of all known Certifying Authorities (CA) and based on that it is able to differentiate between a valid and an invalid TLS Certificate

The browser contains both the public and private key of all known Certifying Authorities (CA) and based on that it is able to differentiate between a valid and an invalid TLS Certificate

The browser does not have any mechanism to validate the TLS Certificate

12. What is the name of the WordPress file that contains the database connection information, including the database name, username, and password?

wp-configuration.php

wp-conf.php

wp-secret.php

wp-config.php

13. Based on the screenshot below, which of the following statements is true?

HTTP/1.1 200 OK

Accept-Ranges: bytes

Age: 359987

Cache-Control: max-age=604800

Content-Type: text/html; charset=UTF-8

Date: Fri, 02 Dec 2022 18:33:05 GMT

Expires: Fri, 09 Dec 2022 18:33:05 GMT

Last-Modified: Mon, 28 Nov 2022 14:33:18 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 2.0.50727

Vary: Accept-Encoding

X-Powered-By: ASP.NET

Content-Length: 1256

The application is using an outdated server technology

The application is disclosing the server version

The application is disclosing the version of the framework used

All of the above

14. Based on the below HTTP request, which of the following statements is correct?

POST /changepassword HTTP/2

Host: example.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0

Sec-Fetch-Dest: document

Sec-Fetch-Mode: navigate

Sec-Fetch-Site: same-origin

Cookie: JSESSIONID=38RB5ECV10785B53AF29816E92E2E50

Content-Length: 95

new_password=usher!@22&confirm_password=usher!@22

The change password feature does not validate the user

The change password feature uses basic authorization

The change password feature is vulnerable to Cross-Site Request Forgery attack

All of the above

15. Observe the HTTP request below and identify the vulnerability attempted.

GET /help.php?file=../../../etc/passwd HTTP/1.1

Host: example.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-GB,en;q=0.5

Accept-Encoding: gzip, deflate

Upgrade-Insecure-Requests: 1

Sec-Fetch-Dest: document

Sec-Fetch-Mode: navigate

Sec-Fetch-Site: none

Sec-Fetch-User: ?1

Cookie: JSESSIONID=38RB5ECV10785B53AF29816E92E2E50

Te: trailers

Connection: keep-alive

Cross-Site Request Forgery Vulnerability

Path Traversal Vulnerability

Code Injection Vulnerability

All of the above

16. Scan the code below and identify the vulnerability which is the most applicable for this scenario.

<meta charset="utf-8">

<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

<meta name="description" content="xss">

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.1/css/bootstrap.min.css" integrity="sha384-WskhaSGFgHYWDcbwN70/dfYBj47jz9qbsMId/iRN3ewGhXQFZCSftd1LZCfmhktB" crossorigin="anonymous">

<link rel="shortcut icon" href="/favicon.ico">

<link charset="utf-8" media="all" type="text/css" href="/static/css/main.css" rel="stylesheet">

<script type="text/javascript"

src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>

SQL Injection

Type Juggling

Component with a Known Vulnerability

Server-Side Request Forgery

17. What is the full form of SAML?

Security Assertion Markup Language

Security Authorization Markup Language

Security Assertion Management Language

Secure Authentication Markup Language

18. Under the same-origin policy (also SOP), a web browser permits scripts contained in a web page to

access data in another web page, but only if both web pages have the same origin.

Which of the following pages are in the same origin as that of the below URL?

http://www.example.com/dir/page2.html

http://www.example.com/dir/other.html

http://www.example.com:81/dir/other.html

http://www.example.com/dir/other.html

http://en.example.com/dir/other.html

1 Only

1 and 2

1, 3 and 4

None of the above

Secops-CAP Certified AppSec Practitioner Exam Free Dumps

Secops-CAP Certified AppSec Practitioner Exam Free Dumps

Share this post