Free ISC CAP Exam Dumps Questions & Answers

Based on the below HTTP request, which of the following statements is correct?
POST /changepassword HTTP/2
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Cookie: JSESSIONID=38RB5ECV10785B53AF29816E92E2E50 Content-Length: 95 new_password=usher!@22&confirm_password=usher!@22

• A.  All of the above
• B.  The change password feature uses basic authorization
• C.  The change password feature is vulnerable to Cross-Site Request Forgery attack
• D.  The change password feature does not validate the user

Which is the most effective way of input validation to prevent Cross-Site Scripting attacks?

• A.  Using a Web Application Firewall (WAF)
• B.  Blacklisting HTML and other harmful characters
• C.  Whitelisting and allowing only trusted input
• D.  Marking Cookie as HttpOnly

A website administrator forgot to renew the TLS certificate on time and as a result, the application is now displaying a TLS error message. However, on closer inspection, it appears that the error is due to the TLS certificate expiry.
In the scenario described above, which of the following is correct?

• A.  There is an urgency to renew the certificate as the users of the website may get conditioned to ignore TLS warnings and therefore ignore a legitimate warning which could be a real Man-in-the-Middle attack
• B.  There is no urgency to renew the certificate as the communication is still over TLS

In the context of NoSQL injection, which of the following is correct?
Statement A: NoSQL databases provide looser consistency restrictions than traditional SQL databases. By requiring fewer relational constraints and consistency checks, NoSQL databases often offer performance and scaling benefits. Yet these databases are still potentially vulnerable to injection attacks, even if they aren't using the traditional SQL syntax.
Statement B: NoSQL database calls are written in the application's programming language, a custom API call, or formatted according to a common convention (such as XML, JSON, LINQ, etc).

• A.  A is false, and B is true
• B.  Both A and B are true
• C.  A is true, and B is false
• D.  Both A and B are false

Which HTTP header is used by the CORS (Cross-origin resource sharing) standard to control access to resources on a server?

• A.  None of the above
• B.  Access-Control-Request-Headers
• C.  Access-Control-Allow-Headers
• D.  Access-Control-Request-Method