CAP Exam Dumps : Certified AppSec Practitioner Exam

When multiple domain names (e.g., and ) resolve to the same IP address (e.g., 1.3.3.7), a web server hosting multiple applications on that IP must determine which application to serve. This is achieved using theHTTP "Host" header, which is part of the HTTP/1.1 protocol. The client (browser) includes the requested domain (e.g., Host: in the request, allowing the server to route the request to the appropriate virtual host or application configured for that domain. This is a standard practice in virtual hosting.

Option A ("The web server inspects the HTTP 'Host' header sent by the client"): Correct, as the Host header enables the server to distinguish between applications on the same IP.

Option B ("The web server inspects the cookies sent by the client"): Incorrect, as cookies are used for session management or personalization, not for identifying the requested application.

Option C ("The web server inspects the client's SSL certificate"): Incorrect, as SSL certificates are used for encryption and authentication, not for application routing (though they may include the domain name for validation).

Option D ("The web server uses a reverse DNS lookup of the client's IP address"): Incorrect, as reverse DNS lookup resolves an IP to a domain, which is irrelevant for the server determining the requested application.

The correct answer is A, aligning with the CAP syllabus under "Web Server Configuration" and "HTTP Protocol Security."References: SecOps Group CAP Documents - "HTTP Headers," "Virtual Hosting," and "OWASP Web Security Testing Guide" sections.

Cross-Site Request Forgery (CSRF) occurs when an attacker tricks a user’s browser into making an unintended request to a site where the user is authenticated, potentially performing actions like changing a password. Let’s analyze the request:

The request is a POST to /changepassword with a Cookie: JSESSIONID, indicating the user is authenticated via a session. The Content-Length: 95 and payload (new_password=lov3MyPiano23&confirm_password=lov3MyPiano23) suggest a state-changing operation (password change).

CSRF vulnerability arises when the request lacks a unique, unpredictable token to validate its legitimacy, and the server accepts it based solely on the session cookie. The request includes no CSRF token (e.g., in the body or headers like X-CSRF-Token).

The Sec-Fetch-Site: same-origin header indicates the request originates from the samedomain, but this is a browser feature and does not guarantee server-side protection against CSRF from a malicious site (e.g., via a hidden iframe or form submission).

Without a CSRF token, an attacker could craft a malicious HTML page with a form that submits this exact request when a victim visits their site while authenticated to example.com, exploiting the browser’s automatic inclusion of the JSESSIONID cookie. This is a textbook CSRF vulnerability.

Option A ("True"): Correct, as the request lacks a CSRF token, making it vulnerable to CSRF attacks.

Option B ("False"): Incorrect, as the absence of a CSRF token indicates vulnerability.

The correct answer is A, aligning with the CAP syllabus under "Cross-Site Request Forgery (CSRF)" and "Session Management."References: SecOps Group CAP Documents - "CSRF Prevention," "Session Security," and "OWASP CSRF Prevention Cheat Sheet" sections.

Let’s evaluate the two statements about NoSQL injection:

Statement A: NoSQL databases (e.g., MongoDB, Cassandra) are designed for scalability and flexibility, often sacrificing strict consistency for performance (e.g., eventual consistency in distributed systems). Unlike traditional SQL databases, they do not enforce rigid relational constraints, which simplifies scaling but does not eliminate the risk of injection attacks. Even without SQL syntax, NoSQL databases are vulnerable to injection if user input is not sanitized (e.g., in MongoDB, injecting $where or $ne operators). This statement is true.

Statement B: NoSQL database queries are typically written in the application’s programming language (e.g., JavaScript for MongoDB), using a custom API (e.g., MongoDB’s query API), or formatted in standards like JSON, XML, or LINQ. For example, a MongoDB query might look like db.collection.find({ "key": input }), where input is a JSON-like structure. This statement accurately describes how NoSQL queries are constructed and is true.

Option A ("A is true, and B is false"): Incorrect, as both statements are true.

Option B ("A is false, and B is true"): Incorrect, as both statements are true.

Option C ("Both A and B are false"): Incorrect, as both statements are true.

Option D ("Both A and B are true"): Correct, as both statements accurately describe NoSQL databases and their vulnerability to injection.

The correct answer is D, aligning with the CAP syllabus under "NoSQL Injection" and "Database Security."References: SecOps Group CAP Documents - "NoSQL Injection Vulnerabilities," "Database Query Security," and "OWASP Top 10 (A03:2021 - Injection)" sections.