CAP-C01 flashcards
CAP-C01 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Same-origin policy
- A browser rule that permits scripts from one origin to read resources from another only when scheme, host, and port all match.
- Stored XSS
- A cross-site scripting variant where attacker script is persisted server-side and served to every user who views the affected page.
- CSRF token
- A unique, unpredictable value embedded in forms and validated server-side so forged cross-site requests lacking the token are rejected.
- Parameterized query
- A database query where user input is bound as data rather than concatenated into SQL text, preventing injection from altering query structure.
- SSRF
- A flaw where an attacker induces the server to make requests to arbitrary destinations, often reaching internal services or cloud metadata endpoints.
- HTTPOnly cookie
- A cookie attribute that prevents client-side JavaScript from reading the cookie, reducing the impact of cross-site scripting on session theft.
- ARP spoofing
- An attack that sends forged ARP replies to associate an attacker MAC address with a legitimate IP, enabling traffic interception on a local segment.
- Kerberoasting
- An attack requesting Kerberos service tickets for accounts with service principal names, then cracking the encrypted tickets offline to recover passwords.
- Pass-the-hash
- An attack using a captured NTLM password hash to authenticate without knowing the plaintext password, enabling lateral movement across Windows systems.
- LLMNR poisoning
- An attack answering multicast name-resolution requests on a local network to capture NTLM authentication hashes from hosts whose DNS lookup failed.
- 802.1X
- A port-based network access control standard requiring supplicant authentication before a switch port grants network connectivity.
- Network segmentation
- Dividing a network into zones with enforced access controls between them, limiting how far an attacker can move after an initial compromise.
- SMB signing
- A setting that cryptographically signs SMB traffic, preventing relay attacks where an attacker forwards captured authentication to another server.
- DMZ
- A network segment hosting internet-facing services, isolated from the internal network so compromise of exposed hosts does not grant core access.
- DNSSEC
- A set of DNS extensions that cryptographically sign records, letting resolvers verify the origin and integrity of DNS answers.
- BGP hijacking
- An attack where a network announces routes for prefixes it does not own, redirecting traffic destined for the legitimate owner.
- Certificate pinning
- Associating a service with a specific certificate or public key so clients reject any other certificate even if it chains to a trusted CA.
- Filtered port
- A scan result indicating no response or an ICMP unreachable message, meaning a firewall or filter is blocking the probe rather than the port being closed.
- Volumetric DDoS
- An attack flooding a target with high-bandwidth traffic to exhaust link capacity, typically mitigated by upstream scrubbing centers.
- Android app sandbox
- An isolation mechanism assigning each app a unique Linux user ID, restricting its file and process access to its own resources.
- Insecure data storage
- A mobile weakness where sensitive data is written to world-readable files, unencrypted databases, logs, or plain preferences.
- Exported component
- An Android activity, service, or receiver declared accessible to other apps; without permission checks it can be invoked by any installed application.
- iOS keychain
- The platform credential store protecting items with accessibility classes such as WhenUnlocked, which determine whether data is readable while locked.
- Jailbreak detection
- A client-side check for a compromised device; it raises attacker cost but is bypassable and must not be relied on as a security boundary.
- Taint analysis
- A static technique tracing data flow from untrusted sources to dangerous sinks, flagging paths where no sanitizer breaks the flow.
- Hardcoded secret
- Credentials or keys embedded in source code; remediation requires rotating the value because version history retains prior commits.
- Insecure deserialization
- Reconstructing objects from untrusted serialized data, which can trigger code execution or privilege escalation in languages like Java and PHP.
- TOCTOU race
- A flaw where a resource is checked and then used non-atomically, allowing an attacker to change it between the check and the use.
- Command injection
- A vulnerability where untrusted input reaches a shell, letting an attacker append or alter commands executed by the application.
- Shared responsibility model
- A cloud division of duties where the provider secures underlying infrastructure and the customer secures identity, data, and configuration.
- Wildcard IAM policy
- A policy granting all actions or resources, creating excessive privilege that attackers exploit for escalation within a cloud account.
- IMDSv2
- A cloud instance metadata service version requiring a session token, which mitigates credential theft via server-side request forgery.