I85PREP
⌘ K
CAP-C01 study materials
CAP-C01 study resources

CAP-C01 practice questions

One question at a time. Build your CAP-C01 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Web Application Security

Which HTTP response header instructs the browser to only load resources over HTTPS for a specified period?

  1. Strict-Transport-Security Correct answer.
  2. Referrer-Policy
  3. X-Frame-Options
  4. Content-Security-Policy

Explanation

Strict-Transport-Security (HSTS) tells the browser to use HTTPS exclusively for the host for a defined max-age, blocking protocol downgrades. The other headers govern content sources, framing, and referrer leakage rather than transport enforcement.

Question 2Web Application Security

A cookie is set with the attributes HttpOnly and Secure. Which pair of protections does this provide?

  1. It is encrypted at rest and signed against tampering
  2. It is excluded from JavaScript access and only sent over HTTPS Correct answer.
  3. It is bound to the client IP and validated against CSRF tokens
  4. It expires when the tab closes and is limited to one path

Explanation

HttpOnly prevents scripts from reading the cookie via document.cookie, reducing XSS-based theft, while Secure restricts transmission to HTTPS channels. Neither attribute encrypts the value or manages lifetime or CSRF protection.

Question 3Web Application Security

Which practice best mitigates SQL injection in a login form?

  1. Using parameterized queries with bound parameters Correct answer.
  2. Disabling verbose database error messages
  3. Storing passwords with a fast hash like MD5
  4. Escaping single quotes in the username field

Explanation

Parameterized queries separate code from data so user input cannot alter query structure, which is the primary defense against SQL injection. The other options offer defense in depth or address unrelated concerns like password storage.

Question 4Web Application Security

What is the primary goal of Cross-Site Request Forgery (CSRF) attacks?

  1. Intercepting traffic between the client and server
  2. Forcing an authenticated browser to submit a state-changing request Correct answer.
  3. Extracting database contents through crafted queries
  4. Reading the victim's session cookie through injected script

Explanation

CSRF abuses the browser's automatic inclusion of credentials to make a logged-in user unknowingly perform an action. It does not require reading cookies or intercepting traffic.

Question 5Web Application Security

Which encoding should be applied when inserting untrusted data into an HTML element's text content to prevent XSS?

  1. JSON escaping
  2. Base64 encoding
  3. HTML entity encoding Correct answer.
  4. URL encoding

Explanation

HTML entity encoding converts characters like < and & into entities so the browser treats input as text rather than markup. Other encodings are appropriate for different contexts such as URLs or JSON payloads.

Question 6Web Application Security

Which SameSite cookie value provides the strongest protection against cross-site request forgery while still allowing same-site navigation?

  1. SameSite=Lax
  2. SameSite=Default
  3. SameSite=Strict Correct answer.
  4. SameSite=None

Explanation

SameSite=Strict prevents the cookie from being sent on any cross-site request, offering the strongest CSRF mitigation. Lax allows top-level GET navigations, and None disables the restriction.

Question 7Web Application Security

A web application reflects user input into an HTML attribute value delimited by double quotes. Which defense is most appropriate?

  1. HTML entity encoding of quotes and angle brackets Correct answer.
  2. JavaScript string escaping
  3. Applying URL encoding to the entire input
  4. CSS escaping

Explanation

When data is placed inside a quoted HTML attribute, HTML entity encoding of characters such as quotes and angle brackets prevents breaking out of the attribute. Context-specific encoding is required for each insertion point.

Question 8Web Application Security

Which HTTP header is designed to mitigate clickjacking by controlling whether a page can be framed?

  1. Access-Control-Allow-Origin
  2. X-Frame-Options Correct answer.
  3. Content-Type
  4. Cache-Control

Explanation

X-Frame-Options with DENY or SAMEORIGIN prevents the page from being embedded in frames on other origins, mitigating clickjacking. The modern equivalent is the frame-ancestors directive in CSP.

Question 9Web Application Security

An application builds a file path as '/var/data/' + userInput and serves the file. Which vulnerability is most directly introduced?

  1. Path traversal Correct answer.
  2. Open redirect
  3. Server-side request forgery
  4. XML external entity injection

Explanation

Concatenating unsanitized input into a filesystem path allows sequences like ../ to escape the intended directory, which is path traversal. The fix is to normalize and validate the resolved path against an allowlisted base directory.

Question 10Web Application Security

Which control most effectively prevents Server-Side Request Forgery in a feature that fetches a user-supplied URL?

  1. Blocking requests to private IP ranges only
  2. Requiring the user to authenticate before submitting the URL
  3. Logging all fetched URLs for later review
  4. Validating the URL against an allowlist of approved hosts and schemes Correct answer.

Explanation

An allowlist of approved destinations and schemes constrains the server to fetch only intended resources, which is the most robust SSRF defense. Blocklists of private ranges can be bypassed via DNS rebinding, redirects, or alternate address notations.

Question 11Web Application Security

A Content-Security-Policy of default-src 'self' is applied. What effect does this have on inline scripts?

  1. Inline scripts execute only in the top-level document
  2. Inline scripts are allowed only over HTTPS
  3. Inline scripts execute normally because 'self' allows them
  4. Inline scripts are blocked unless a nonce or hash is specified Correct answer.

Explanation

Under CSP, inline scripts are blocked by default unless 'unsafe-inline' or a nonce/hash is present; 'self' only permits same-origin external sources. Nonces or hashes enable specific inline scripts without opening the policy broadly.

Question 12Web Application Security

Which statement correctly describes the difference between stored and reflected XSS?

  1. Stored XSS persists in the server and affects other users; reflected XSS is echoed back in a single response Correct answer.
  2. Stored XSS only affects the attacker's own browser session
  3. Reflected XSS requires authentication while stored XSS does not
  4. Reflected XSS persists in the database until manually removed

Explanation

Stored XSS saves malicious input server-side so it is served to other users, whereas reflected XSS returns input in the immediate response to the same request. Both stem from unencoded output and differ mainly in persistence and delivery.

Question 13Web Application Security

An application sets Access-Control-Allow-Origin to the value of the request's Origin header and enables Access-Control-Allow-Credentials. What is the security impact?

  1. It safely restricts access to the requesting origin
  2. It has no effect because credentials are ignored in CORS
  3. It blocks all cross-origin requests automatically
  4. It allows any origin to read credentialed responses, defeating same-origin protections Correct answer.

Explanation

Reflecting arbitrary origins while allowing credentials lets any site make credentialed cross-origin reads, which undermines the same-origin policy. Safe CORS configurations use an explicit allowlist of trusted origins.

Question 14Web Application Security

Which technique best defends against username enumeration during login?

  1. Requiring CAPTCHA only for unknown usernames
  2. Displaying a distinct message when the username does not exist
  3. Returning identical generic error messages and comparable response times for all failures Correct answer.
  4. Locking out accounts after three failed attempts

Explanation

Uniform error messages and consistent response timing prevent attackers from distinguishing valid from invalid accounts. Differential messages or timing create an enumeration oracle.

Question 15Web Application Security

Which vulnerability arises when an application deserializes untrusted data without integrity checks?

  1. Cross-site scripting in the browser
  2. Insecure deserialization leading to remote code execution Correct answer.
  3. Directory listing exposure
  4. Clickjacking of the login page

Explanation

Insecure deserialization of untrusted input can allow attackers to manipulate object state or trigger gadget chains that result in code execution. Integrity checks or avoiding native deserialization of untrusted data mitigate this risk.

Question 16Web Application Security

A developer wants to prevent open redirects in a login flow that accepts a 'next' parameter. Which approach is most robust?

  1. Checking the Referer header before redirecting
  2. URL-encoding the next parameter before redirecting
  3. Allowing only relative paths that resolve within the application or an allowlist of hosts Correct answer.
  4. Validating that the next parameter starts with a slash

Explanation

Restricting redirects to same-application relative paths or an explicit allowlist of hosts prevents attackers from directing users to external sites. Simple prefix checks can be bypassed with schemes or protocol-relative URLs.

Question 17Web Application Security

Which of the following best describes a DOM-based XSS vulnerability?

  1. Malicious input is stored in the database and rendered later
  2. Client-side JavaScript writes untrusted data into a sink such as innerHTML Correct answer.
  3. An attacker injects script through a compromised third-party library
  4. The server reflects input in an error page without encoding

Explanation

DOM-based XSS occurs entirely in the browser when script reads attacker-controlled data from a source and passes it to a dangerous sink like innerHTML. The server response may be unchanged, so server-side filters alone may not detect it.

Question 18Web Application Security

What is the purpose of the Subresource Integrity (SRI) attribute on a script tag?

  1. To encrypt the resource in transit
  2. To verify the fetched resource matches an expected cryptographic hash Correct answer.
  3. To sandbox the script in an isolated context
  4. To restrict the script to same-origin execution

Explanation

SRI uses a hash to ensure a fetched script or stylesheet matches the expected content, protecting against tampering on CDNs. If the hash does not match, the browser refuses to execute the resource.

Question 19Web Application Security

An application uses client-side validation only for input length and format. What is the primary security concern?

  1. It improves performance but has no security relevance
  2. It prevents all injection attacks by default
  3. Client-side checks can be bypassed, so server-side validation is required Correct answer.
  4. It encrypts the input before transmission

Explanation

Client-side validation is a usability aid; attackers can bypass it by crafting requests directly. Security-relevant validation and encoding must be enforced on the server.

Question 20Web Application Security

Which attack involves injecting malicious content into a web cache so it is served to other users?

  1. Credential stuffing
  2. Cache poisoning Correct answer.
  3. DNS tunneling
  4. Session fixation

Explanation

Web cache poisoning manipulates cached responses so that subsequent users receive attacker-controlled content. It often exploits unkeyed inputs that influence the response.

Question 21Web Application Security

A security team observes that a web application accepts XML input and resolves external entities. Which risk is most significant?

  1. The application may leak session cookies through the Referer header
  2. The application may read local files or make internal network requests Correct answer.
  3. The application may permit open redirects
  4. The application may be vulnerable to clickjacking

Explanation

XML External Entity (XXE) processing allows attackers to reference external entities that can read local files or trigger server-side requests. Disabling external entity resolution and DTDs mitigates the risk.

Question 22Web Application Security

Which combination most effectively mitigates session fixation?

  1. Setting a long session timeout
  2. Storing the session identifier in localStorage
  3. Issuing a new session identifier upon successful authentication Correct answer.
  4. Using predictable session identifiers for easier debugging

Explanation

Rotating the session identifier at authentication invalidates any identifier the attacker may have planted, defeating session fixation. Predictable identifiers and long timeouts worsen the risk.

Question 23Web Application Security

An application allows users to upload files and serves them from the same origin as the main site. Which control most reduces the risk of stored XSS via uploaded files?

  1. Renaming uploaded files with random identifiers
  2. Serving uploads from a separate origin with a restrictive Content-Type and Content-Disposition attachment Correct answer.
  3. Limiting upload size to a few megabytes
  4. Scanning uploads with antivirus only

Explanation

Serving user uploads from a distinct origin and forcing a safe Content-Type with attachment disposition prevents uploaded HTML or script from executing in the application's origin. Random names and size limits do not stop script execution.

Question 24Web Application Security

A Content-Security-Policy includes script-src 'nonce-abc123' 'strict-dynamic'. What is the main effect of 'strict-dynamic'?

  1. It requires all scripts to be served over HTTPS
  2. It restricts scripts to the same origin only
  3. It disables all inline scripts permanently
  4. It allows scripts loaded by an already trusted script to execute without further nonce checks Correct answer.

Explanation

'strict-dynamic' propagates trust from a nonce- or hash-approved script to scripts it dynamically loads, simplifying deployment while blocking injected script tags. It does not remove the need for HTTPS or same-origin rules.

Question 25Web Application Security

Which scenario best illustrates a second-order (stored) injection vulnerability?

  1. User input is echoed unencoded in the same HTTP response
  2. User input is encrypted before storage
  3. User input is rejected by client-side validation
  4. User input is stored safely, then later used unsafely in a query or template Correct answer.

Explanation

Second-order injection occurs when data is stored in one context and later used unsafely in another, such as building a query from a stored profile field. The initial storage may appear safe while the later use is vulnerable.

Question 26Web Application Security

Which HTTP response header instructs browsers to only connect to a site over HTTPS for a specified period?

  1. Strict-Transport-Security Correct answer.
  2. X-Content-Type-Options
  3. Content-Security-Policy
  4. Referrer-Policy

Explanation

Strict-Transport-Security (HSTS) tells the browser to enforce HTTPS for the host for the max-age duration, blocking plaintext fallback. The other headers govern content loading, MIME sniffing, and referrer leakage respectively.

Question 27Web Application Security

A login form submits credentials via GET with the password in the query string. What is the primary security consequence?

  1. The server cannot validate the password field
  2. The request becomes immune to interception on shared networks
  3. The password is encrypted automatically by the browser
  4. Credentials are recorded in browser history, proxy logs, and server access logs Correct answer.

Explanation

Query strings are logged and stored in many places, including browser history and intermediary logs, exposing secrets. Sensitive parameters belong in the request body over HTTPS.

Question 28Web Application Security

Which cookie attribute prevents client-side JavaScript from reading the cookie value?

  1. Domain
  2. HttpOnly Correct answer.
  3. Secure
  4. SameSite=Strict

Explanation

HttpOnly removes the cookie from document.cookie access, limiting theft via script injection. Secure restricts transport to HTTPS, SameSite limits cross-site sending, and Domain scopes the cookie.

Question 29Web Application Security

What is the security purpose of adding a CSRF token to a state-changing form?

  1. To prove the request originated from a page the server issued to that user Correct answer.
  2. To encrypt the form fields in transit
  3. To authenticate the user's password on each request
  4. To prevent SQL injection in the submitted fields

Explanation

A per-session, unpredictable token that the attacker cannot read or guess demonstrates the request came from the legitimate origin. It does not provide encryption, password re-authentication, or input sanitization.

Question 30Web Application Security

An application stores user-supplied HTML in a database and later renders it unescaped in an admin review page. Which vulnerability class does this represent?

  1. Cross-site request forgery
  2. Insecure direct object reference
  3. Reflected cross-site scripting
  4. Stored cross-site scripting Correct answer.

Explanation

Content persisted and later rendered without output encoding executes in the victim's browser, which is stored XSS. Reflected XSS is not persisted, CSRF forges requests, and IDOR concerns object authorization.

Question 31Web Application Security

A developer must render user-controlled text inside an HTML element's body. Which approach most reliably prevents script injection?

  1. Context-aware HTML entity encoding of the output Correct answer.
  2. Replacing all spaces with non-breaking spaces
  3. Converting the input to uppercase
  4. Stripping the substring '<script>' from the input

Explanation

Encoding the five HTML metacharacters for the element-body context neutralizes tags and entities regardless of payload shape. Blocklist filtering and case or spacing changes are trivially bypassed.

Question 32Web Application Security

A web application accepts a numeric 'id' parameter and concatenates it directly into a SQL statement. Which change most directly removes the injection risk?

  1. Using parameterized queries with bound placeholders Correct answer.
  2. Escaping single quotes with a backslash
  3. Restricting the parameter length to three characters
  4. Running the query under a read-only database account

Explanation

Parameterization separates code from data so input can never alter statement structure. Manual escaping is error-prone, length limits do not block valid injections, and least privilege limits impact rather than the flaw.

Question 33Web Application Security

Which mechanism lets a server restrict which origins may read its responses in a browser cross-origin request?

  1. The Accept-Encoding request header
  2. The Content-Type request header
  3. The Access-Control-Allow-Origin response header Correct answer.
  4. The X-Frame-Options response header

Explanation

CORS relies on the Access-Control-Allow-Origin header to declare which origins the browser may expose the response to. X-Frame-Options addresses framing, and Content-Type and Accept-Encoding are unrelated content negotiation headers.

Question 34Web Application Security

An application authenticates users with a session cookie but never regenerates the session identifier at login. Which attack does this most enable?

  1. Cookie tossing via subdomains
  2. Cross-site scripting in the login form
  3. Session fixation Correct answer.
  4. Session replay over TLS

Explanation

If the pre-authentication identifier remains valid after login, an attacker who planted a known identifier can ride the authenticated session. Regenerating the identifier on privilege change prevents this.

Question 35Web Application Security

Which practice best protects password storage if the credential database is stolen?

  1. Storing passwords as Base64-encoded strings
  2. Encrypting passwords with a key stored in the same database
  3. Hashing each password with a unique salt using a slow memory-hard algorithm Correct answer.
  4. Hashing each password with a fast general-purpose hash such as MD5

Explanation

Salted, slow, memory-hard hashing forces per-guess cost and defeats precomputed tables. Fast hashes and reversible encoding offer little resistance to offline cracking.

Question 36Web Application Security

A page includes a third-party script from a CDN. Which control ensures the browser rejects a modified script file?

  1. A Cache-Control header of no-store
  2. An HttpOnly session cookie
  3. A Referrer-Policy of no-referrer
  4. A Subresource Integrity hash on the script tag Correct answer.

Explanation

Subresource Integrity compares the fetched file against a declared cryptographic hash and blocks execution on mismatch. The other options affect referrer leakage, cookie script access, and caching, not file integrity.

Question 37Web Application Security

An application renders a link whose href comes from a user-supplied URL without validation. Which risk is most direct?

  1. Bypassing TLS certificate validation
  2. Reading server-side files outside the web root
  3. Executing arbitrary SQL on the database
  4. Redirecting users to an attacker-controlled site Correct answer.

Explanation

Unvalidated destination URLs enable open redirects used in phishing and token theft. SQL execution, local file read, and TLS bypass arise from different flaws.

Question 38Web Application Security

A site serves user-uploaded SVG files from its own origin with a content type the browser renders inline. Which risk is most significant?

  1. Script embedded in the SVG executes in the site's origin Correct answer.
  2. The SVG breaks the site's stylesheet
  3. The upload consumes excessive storage
  4. The file cannot be downloaded by other users

Explanation

SVG can contain script and, when rendered inline from the application origin, runs with that origin's privileges. Serving uploads from a separate origin or forcing download mitigates this.

Question 39Web Application Security

An application uses a strict allowlist to validate a file path built from user input, resolving the canonical path before comparison. Why is canonicalization performed before the allowlist check?

  1. To verify the file's MIME type
  2. To speed up filesystem reads
  3. To convert the path to a URL-safe encoding
  4. To collapse traversal sequences and symlinks so the comparison reflects the real target Correct answer.

Explanation

Sequences such as '../' and symbolic links can resolve to locations outside the intended directory, so the check must run on the resolved path. Canonicalization is about correctness of the comparison, not performance, encoding, or content typing.

Question 40Web Application Security

A security review finds that authentication decisions are enforced only in the browser's JavaScript, while the API returns full data to any caller. Which principle is most clearly violated?

  1. Server-side enforcement of authorization on every request Correct answer.
  2. Least privilege for database accounts
  3. Fail-safe defaults for error handling
  4. Defense in depth through input validation

Explanation

Authorization must be enforced where the data lives, since clients are fully controllable by users. Client-side checks are usability aids, not security boundaries.

Question 41Internal Network Security

Which security control is designed to detect and block malicious traffic by comparing packets against a database of known attack patterns?

  1. A stateful packet filter
  2. A VLAN access control list
  3. A spanning tree guard
  4. A signature-based intrusion detection system Correct answer.

Explanation

Signature-based detection matches observed traffic against known attack patterns and raises alerts or blocks when a match occurs. The other listed controls enforce reachability or topology rules rather than pattern matching.

Question 42Internal Network Security

In a switched network, what is the primary purpose of DHCP snooping?

  1. To compress DHCP lease information for faster renewal
  2. To filter untrusted DHCP server messages and build a binding table Correct answer.
  3. To encrypt DHCP payloads between client and server
  4. To translate DHCP requests into static ARP entries

Explanation

DHCP snooping designates trusted ports, drops server-originated DHCP messages on untrusted ports, and records client bindings used by other features. It does not encrypt or compress DHCP traffic.

Question 43Internal Network Security

A switch port configured with port security in restrict mode receives a frame from an unknown MAC address. What is the default result?

  1. The frame is dropped and a violation is logged Correct answer.
  2. The new MAC address replaces the oldest learned address
  3. The frame is forwarded and the violation counter increments
  4. The port is placed into the err-disabled state

Explanation

Restrict mode drops frames from unapproved addresses, increments the violation counter, and can generate a log or SNMP trap without shutting the port. Shutdown mode is the one that err-disables the interface.

Question 44Internal Network Security

Which mechanism best mitigates ARP spoofing on an access switch?

  1. Setting the native VLAN to an unused VLAN
  2. Applying storm control to broadcast traffic
  3. Configuring dynamic ARP inspection with DHCP snooping bindings Correct answer.
  4. Enabling BPDU guard on all access ports

Explanation

Dynamic ARP inspection validates ARP packets against trusted DHCP snooping bindings, dropping replies that do not match. The other options address topology loops, broadcast floods, or VLAN tagging rather than ARP integrity.

Question 45Internal Network Security

What does a private VLAN (PVLAN) isolated port allow?

  1. Communication with any port in the primary VLAN
  2. Communication with no other port on the switch
  3. Communication with all ports in the same secondary VLAN
  4. Communication only with the promiscuous port and its own gateway Correct answer.

Explanation

Isolated ports can talk to the promiscuous port but not to other isolated or community ports, which segments hosts sharing a subnet. Community ports can reach each other, and promiscuous ports reach all.

Question 46Internal Network Security

A network engineer wants to prevent a rogue device from becoming the root bridge on access ports. Which feature should be enabled?

  1. UDLD aggressive mode
  2. PortFast
  3. Root guard Correct answer.
  4. Loop guard

Explanation

Root guard keeps a port in a root-inconsistent state if superior BPDUs arrive, preventing downstream devices from taking over as root. The other features address unidirectional links, loop prevention, or convergence speed.

Question 47Internal Network Security

Which statement describes the function of a network access control (NAC) solution?

  1. It assesses endpoint posture before granting network access Correct answer.
  2. It provides content filtering for web traffic
  3. It replaces the need for authentication servers
  4. It encrypts all traffic between access switches

Explanation

NAC evaluates device identity and posture, then places endpoints into appropriate network segments or quarantine. It typically integrates with, rather than replaces, authentication infrastructure.

Question 48Internal Network Security

What is the primary security benefit of segmenting an internal network into VLANs?

  1. It automatically encrypts inter-VLAN traffic
  2. It increases available bandwidth per host
  3. It eliminates the need for access control lists
  4. It reduces the broadcast domain and limits lateral movement Correct answer.

Explanation

VLANs create separate broadcast domains and, with inter-VLAN filtering, constrain how far an attacker can move. They do not encrypt traffic or remove the need for policy enforcement.

Question 49Internal Network Security

Which IEEE standard defines MACsec for hop-by-hop Layer 2 encryption?

  1. 802.1Q
  2. 802.1AE Correct answer.
  3. 802.3ad
  4. 802.1X

Explanation

802.1AE specifies MACsec, which provides confidentiality and integrity on Ethernet links. 802.1X handles port-based authentication and 802.1Q defines VLAN tagging.

Question 50Internal Network Security

An attacker connects a rogue switch and sends crafted BPDUs to influence the spanning tree topology. Which control directly addresses this threat?

  1. Private VLAN isolated ports
  2. Dynamic ARP inspection
  3. DHCP option 82 insertion
  4. BPDU guard on access ports Correct answer.

Explanation

BPDU guard err-disables access ports that receive BPDUs, blocking rogue switches from participating in spanning tree. The other features address ARP integrity, DHCP relay information, and host isolation.