CAP-C01 study guide
CAP-C01 · Work through your exam, one topic at a time.
CAP-C01 is a penetration-testing certification exam offered through The SecOps Group's exam programme, which the company describes as "Perfect for assessing and recruiting pentesters" and "Based on real-world scenarios." It is aimed at security practitioners who want a credential that reflects practical offensive-security work: web application testers, internal and external network testers, mobile application testers, source-code reviewers, and cloud security assessors. The six published domains mirror the consultancy service lines The SecOps Group advertises - web application, internal network, external network, mobile application, source-code analysis, and cloud security assessment - with the heaviest weighting on web and internal network topics. The CAP-C01 study guide has 6 sections and about 1,645 words.
01Web Application Security
Web application testing rewards a methodical mapping of the attack surface before exploitation. Know the OWASP-style failure families: broken access control (IDOR, missing function-level checks, path traversal), injection (SQLi, command injection, template injection, XSS as a client-side injection), authentication and session weaknesses (weak credential policy, predictable tokens, missing rotation on privilege change), and misconfiguration (verbose errors, default accounts, exposed admin interfaces, permissive CORS).
273 words, about 1 min02Internal Network Security
Internal assessments assume a starting foothold or on-network position and focus on lateral movement, credential abuse, and segmentation. Candidates should understand Active Directory fundamentals: Kerberos ticket behavior (including ticket-granting-ticket exposure and service-ticket cracking), NTLM relay preconditions, and why signing and channel binding matter.
270 words, about 1 min03External Network Security
External testing covers the internet-facing footprint: DNS, mail, VPN, remote access, and hosted services. Start with reconnaissance and asset discovery-subdomain enumeration, certificate transparency, and ASN/IP range mapping-then service identification and version fingerprinting.
273 words, about 1 min04Mobile Application Security
Mobile testing splits into client-side and server-side concerns. On the client, candidates must understand platform storage (Keychain/Keystore versus world-readable files and shared preferences), insecure logging, clipboard leakage, and screenshot/screen-recording exposure of sensitive screens.
292 words, about 1 min05Source-Code Analysis
Source review finds flaws static testing misses by tracing data from sources (request parameters, headers, files, environment) to sinks (queries, shell calls, template engines, deserializers, file paths). Candidates must understand taint propagation, sanitizers versus validators, and why a validator that checks format does not make a value safe for a different sink.
272 words, about 1 min06Cloud Security Assessment
Cloud assessments center on identity and configuration rather than hosts. Candidates must understand the shared responsibility model, IAM policy evaluation (explicit deny wins; least privilege; trust policies for role assumption), and the risk of overly permissive roles, wildcard actions, and long-lived access keys.
265 words, about 1 min