Free The SecOps Group Certified-AppSec-Practitioner Exam Questions

Question 1

Scan the code below and identify the vulnerability which is the most applicable for this scenario.

A : SQL Injection

B : Type Juggling

C : Component with a Known Vulnerability

D : Server-Side Request Forgery

Answer: C

Question 2

Based on the screenshot below, which of the following statements is true?RequestGET /userProfile.php?sessionId=7576572ce164646de967c759643d53031 HTTP/1.1Host: example.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/107.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1Cookie: JSESSIONID=7576572ce164646de967c759643d53031Te: trailersConnection: keep-alivePrettyRaw | Hex | php | curl | ln | PrettyHTTP/1.1 200 OKDate: Fri, 09 Dec 2022 11:42:27 GMTServer: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips PHP/8.0.25X-Powered-By: PHP/8.0.25Content-Length: 12746Content-Type: text/html; charset=UTF-8Connection: keep-aliveSet-Cookie: JSESSIONID=7576572ce164646de967c759643d53031; Path=/; HttpOnly

A : The application uses an insecure channel (non-TLS)

B : The application uses an insecure HTTP method (GET) to send sensitive information

C : The application is vulnerable to Cross-Site Scripting attacks

D : All of the above

Answer: B

Question 3

Based on the below request/response, which of the following statements is true?SendGET/dashboard.php?purl=http://attacker.com HTTP/1.1Host: example.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/107.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1Cookie: JSESSIONID=38RB5ECV10785B53AF29816E92E2E50Te: trailersConnection: keep-alivePrettyRaw | Hex | php | curl | ln | PrettyHTTP/1.1 302 Found 2022-12-03 17:38:18 GMTDate: Sat, 03 Dec 2022 17:38:18 GMTServer: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips PHP/8.0.25X-Powered-By: PHP/8.0.25Content-Length: 0Content-Type: text/html; charset=UTF-8Connection: keep-aliveLocation:http://attacker.comSet-Cookie: JSESSIONID=38C5ECV10785B53AF29816E92E2E50; Path=/; HttpOnly

A : Application is likely to be vulnerable to Open Redirection vulnerability

B : Application is vulnerable to Cross-Site Request Forgery vulnerability

C : Application uses an insecure protocol

D : All of the above

Answer: A

Question 4

In the context of the Race Condition vulnerability, which of the following statements is true?

A : A situation that occurs when two threads access the same resource at the same time.

B : A situation that occurs when two threads access different resources at the same time.

C : A situation that occurs when a single thread unpredictably accesses two resources.

D : A situation that occurs when a single thread predictably accesses two resources.

Answer: A

Question 5

Based on the below request/response, which of the following statements is true?SendGET/dashboard.php?purl=http://attacker.com HTTP/1.1Host: example.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/107.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-GB,en;q=0.5Accept-Encoding: gzip, deflateUpgrade-Insecure-Requests: 1Sec-Fetch-Dest: documentSec-Fetch-Mode: navigateSec-Fetch-Site: noneSec-Fetch-User: ?1Cookie: JSESSIONID=38RB5ECV10785B53AF29816E92E2E50Te: trailersConnection: keep-alivePrettyRaw | Hex | php | curl | ln | PrettyHTTP/1.1 302 Found 2022-12-03 17:38:18 GMTDate: Sat, 03 Dec 2022 17:38:18 GMTServer: Apache/2.4.54 (Unix) OpenSSL/1.0.2k-fips PHP/8.0.25X-Powered-By: PHP/8.0.25Content-Length: 0Content-Type: text/html; charset=UTF-8Connection: keep-aliveLocation:http://attacker.comSet-Cookie: JSESSIONID=38C5ECV10785B53AF29816E92E2E50; Path=/; HttpOnly

A : Application is likely to be vulnerable to Open Redirection vulnerability

B : Application is vulnerable to Cross-Site Request Forgery vulnerability

C : Application uses an insecure protocol

D : All of the above

Answer: A