CAP-PC ENS study plan

Map the OWASP Top 10 (2021) categories to concrete HTTP request/response evidence a tester would capture during an assessment

Set up a local lab with a deliberately vulnerable web app and a proxy interceptor, then capture and annotate at least 15 distinct request/response pairs

Trace one reflected XSS payload from browser input through server-side templating to rendered output, documenting each transformation point

Identify the differences between stored, reflected, and DOM-based XSS by constructing one working example of each in the lab

Demonstrate and explain SQL injection, blind SQL injection, and parameterized-query remediation in the lab

Exploit and then fix an access-control flaw (IDOR or missing function-level authorization) in a sample application

Configure and bypass a Content Security Policy in the lab to show how CSP mitigates and fails to mitigate XSS

Compare server-side request forgery, insecure deserialization, and file-upload flaws by writing a short risk note for each

Perform manual source review of a deliberately vulnerable application, recording each sink and its untrusted source

Run static analysis tooling on the same codebase and reconcile tool findings against your manual list

Classify at least 20 findings by CWE and assign a severity using a documented rubric

Write a secure-code fix for the three highest-severity findings and verify the fix removes the sink-to-source path

Review infrastructure-as-code and CI/CD configuration files for hardcoded secrets, overly broad IAM permissions, and unencrypted storage

Explain how taint analysis, data-flow analysis, and control-flow analysis differ, and identify which class of bug each catches best

Compare SAST, DAST, SCA, and secret scanning by detection coverage, false-positive profile, and where each fits in a pipeline

Map a sample cloud deployment's trust boundaries and data flows in a threat model

Assess an intentionally misconfigured cloud storage bucket and document the enumeration, access, and remediation steps

Evaluate identity and access management in a cloud lab: identify privilege-escalation paths and over-permissive roles

Audit cloud logging and monitoring coverage, then list which events are missing for detection of the lab's simulated attack

Compare shared-responsibility boundaries across IaaS, PaaS, and SaaS for the same workload

Execute a scoped red-team engagement against the lab environment, from reconnaissance through privilege escalation

Document each attack step with the exact command or request, the evidence captured, and the detection opportunity it created

Assess container and orchestration security in the lab: image provenance, runtime privileges, and network policy gaps

Write detection rules for the three highest-impact attack steps and test that each rule fires on the recorded activity

Explain the OWASP Top 10 for LLM Applications and map each risk to a concrete test procedure

Demonstrate prompt injection (direct and indirect) against a lab LLM application and document the trust boundary crossed

Assess an ML pipeline for training-data poisoning, model theft, and insecure model supply-chain risks

Evaluate an AI system's input/output handling for data leakage, excessive agency, and unsafe output consumption

Re-test every deliverable from weeks 1 through 7 and close gaps in evidence or remediation

Complete two timed mixed-domain practice sets and review every missed item by domain

Build a one-page decision aid that routes an observed symptom to the correct domain and next test

Write a personal weak-area list with the specific concept and the remediation action for each entry