Authentic Secops-CAP Dumps (V8.02) - Right Study Guide to Help You Pass

DUMPS
BASE
EXAM DUMPS

THE SECOPS GROUP
secops-CAP
28% OFF Automatically For You

Certified AppSec Practitioner Exam

,1.Salt is a cryptographically secure random string that is added to a password before
it is hashed.
In this context, what is the primary objective of salting?
A. To defend against dictionary attacks or attacks against hashed passwords using a
rainbow table.
B. To slow down the hash calculation process.
C. To generate a long password hash that is difficult to crack.
D. To add a secret message to the password hash.
Answer: A
Explanation:
Salting is a security technique used in password hashing to enhance protection
against specific types of attacks. A salt is a random value added to a password before
hashing, ensuring that even if two users have the same password, their hashed




s
as
outputs will differ. The primary objective of salting is to defend against dictionary




P
ou
attacks and rainbow table attacks. Dictionary attacks involve trying common




Y
passwords from a precomputed list, while rainbow table attacks use precomputed




p
el
H
tables of hash values to reverse-engineer passwords quickly. By adding a unique salt




to
to each password, the hash becomes unique, rendering precomputed rainbow tables

de
ui
ineffective, as an attacker would need to generate a new table for each salt, which is
G
dy
computationally impractical.
tu
S



Option B ("To slow down the hash calculation process") is incorrect because while
ht




techniques like key stretching (e.g., using PBKDF2 or bcrypt) intentionally slow
ig
-R




hashing to counter brute-force attacks, salting itself does not primarily aim to slow the
)
02




process?it focuses on uniqueness. Option C ("To generate a long password hash that
8.
(V




is difficult to crack") is a byproduct of salting but not the primary objective; the length
ps




and difficulty come from the hash function and salt combination, not salting alone.
um
D




Option D ("To add a secret message to the password hash") is incorrect, as a salt is
P
A




not a secret message but a random value, often stored alongside the hash. This
-C
ps




aligns with best practices in authentication security, a key component of the CAP
o
ec




syllabus.
S
ic




Reference: SecOps Group CAP Documents - "Secure Coding Practices,"
nt
he




"Authentication Security," and "Cryptographic Techniques" sections.
ut
A




2.Which of the following directives in a Content-Security-Policy HTTP response
header, can be used to prevent a Clickjacking attack?
A. script-src
B. object-src
C. frame-ancestors
D. base-uri
Answer: C
Explanation:
Clickjacking is an attack where a malicious site overlays a transparent iframe

, containing a legitimate site, tricking users into interacting with it unintentionally (e.g.,
clicking a button). The Content-Security-Policy (CSP) HTTP response header is used
to mitigate various client-side attacks, including clickjacking, through specific
directives. The frame-ancestors directive is the correct choice for preventing
clickjacking. This directive specifies which origins are allowed to embed the webpage
in an iframe, <frame>, or <object>. For example, setting frame-ancestors 'self'
restricts framing to the same origin, effectively blocking external sites from embedding
the page. This is a standard defense mechanism recommended by OWASP and
other security frameworks.
Option A ("script-src") controls the sources from which scripts can be loaded,
addressing XSS (Cross-Site Scripting) vulnerabilities but not clickjacking. Option B
("object-src") restricts the sources of plugins or embedded objects (e.g., Flash), which
is unrelated to iframe-based clickjacking. Option D ("base-uri") defines the base URL




s
as
for relative URLs in the document, offering no protection against framing attacks. The




P
ou
use of CSP with the frame-ancestors directive is a critical topic in the CAP syllabus




Y
under "Security Headers" and "OWASP Top 10" (UI Redressing).




p
el
H
Reference: SecOps Group CAP Documents - "Security Headers," "OWASP Top 10




to
(A07:2021 - Identification and Authentication Failures)," and "Client-Side Security"

de
ui
sections.
G
dy
tu
S
ht




3.The application is vulnerable to Cross-Site Scripting.
ig
-R




Which of the following exploitation is NOT possible at all?
)
02




A. Steal the user's session identifier stored on a non HttpOnly cookie
8.
(V




B. Steal the contents from the web page
ps




C. Steal the contents from the application's database
um
D




D. Steal the contents from the user's keystrokes using keyloggers
P
A




Answer: C
-C
ps




Explanation:
o
ec




Cross-Site Scripting (XSS) is a vulnerability that allows attackers to inject malicious
S
ic




scripts into web pages viewed by other users. These scripts execute in the context of
nt
he




the victim’s browser, enabling various exploitations.
ut
A




Let’s evaluate each option:
Option A ("Steal the user's session identifier stored on a non HttpOnly cookie"): This
is possible with XSS. If a session cookie is not marked as HttpOnly (preventing
JavaScript access), an attacker can use a script to access document.cookie and steal
the session ID, leading to session hijacking.
Option B ("Steal the contents from the web page"): This is also possible. An XSS
payload can manipulate the DOM, extract content (e.g., via innerHTML), and send it
to the attacker, such as through a GET request to a malicious server.
Option C ("Steal the contents from the application's database"): This is not possible
with XSS alone. XSS operates on the client side within the browser’s sandbox and
cannot directly access the server-side database. Database access requires server-