Online Access Free CAP Exam Questions

GraphQL is an open-source data query and manipulation language for APIs, and a query runtime engine. In this context, what is GraphQL Introspection?

• A.A technique for testing the security of the GraphQL API
• B.A technique for testing the compatibility of the GraphQL API with other systems
• C.A technique for testing the performance of the GraphQL API
• D.A technique for discovering the structure of the GraphQL API

After purchasing an item on an e-commerce website, a user can view his order details by visiting the URL:
https://example.com/order_id=53870
A security researcher pointed out that by manipulating the order_id value in the URL, a user can view arbitrary orders and sensitive information associated with that order_id.
Which of the following is correct?

• A.The problem can be solved by implementing a Web Application Firewall (WAF)
• B.None of the above
• C.The root cause of the problem is a weak authorization (Session Management) and by validating a user's privileges, the issue can be fixed
• D.The root cause of the problem is a lack of input validation and by implementing a strong whitelisting, the problem can be solved

A website administrator forgot to renew the TLS certificate on time and as a result, the application is now displaying a TLS error message. However, on closer inspection, it appears that the error is due to the TLS certificate expiry.
In the scenario described above, which of the following is correct?

• A.There is no urgency to renew the certificate as the communication is still over TLS
• B.There is an urgency to renew the certificate as the users of the website may get conditioned to ignore TLS warnings and therefore ignore a legitimate warning which could be a real Man-in-the-Middle attack

Scan the code below and identify the vulnerability which is the most applicable for this scenario.
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<meta name="description" content="xss">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.1/css/bootstrap.min.
css" integrity="sha384-WskhaSGFgHYWDcbwN70/dfYBj47jz9qbsMId
/iRN3ewGhXQFZCSftd1LZCfmhktB" crossorigin="anonymous">
<link rel="shortcut icon" href="/favicon.ico">
<link charset="utf-8" media="all" type="text/css" href="/static/css/main.css" rel="stylesheet">
<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>

• A.Server-Side Request Forgery
• B.Type Juggling
• C.SQL Injection
• D.Component with a Known Vulnerability

Which of the following HTTP response header prevents the client from caching the HTTP response in the most secure manner?

• A.Cache-Control: Private
• B.Content-Security-Policy: no-cache, no-store
• C.Cache-Control: no-cache, no-store
• D.Secure-Cache: Enabled