Free ISC CAP Exam Dumps Questions & Answers

Which SQL function can be used to read the contents of a file during manual exploitation of the SQL injection vulnerability in a MySQL database?

• A.LOAD_FILE()
• B.GET_FILE()
• C.FETCH_FILE()
• D.READ_FILE()

Determine the primary defense against a SQL injection vulnerability

• A.Blacklisting Single Quote Character (')
• B.Prepared Statements with Parameterized Queries
• C.Using a Web Application Firewall (WAF)
• D.Use of NoSQL Database

Salt is a cryptographically secure random string that is added to a password before it is hashed. In this context, what is the primary objective of salting?

• A.To slow down the hash calculation process.
• B.To defend against dictionary attacks or attacks against hashed passwords using a rainbow table.
• C.To generate a long password hash that is difficult to crack.
• D.To add a secret message to the password hash.

After purchasing an item on an e-commerce website, a user can view their order details by visiting the URL:
https://example.com/?order_id=53870
A security researcher pointed out that by manipulating the order_id value in the URL, a user can view arbitrary orders and sensitive information associated with that order_id. This attack is known as:

• A.Insecure Direct Object Reference
• B.Session Riding OR Cross-Site Request Forgery
• C.Session Poisoning
• D.Server-Side Request Forgery

Which of the following is correct?

• A.The browser does not have any mechanism to validate the TLS Certificate
• B.The browser contains the private key of all known Certifying Authorities (CA) and based on that, it differentiates between a valid and an invalid TLS Certificate
• C.The browser contains the public key of all known Certifying Authorities (CA) and based on that it is able to differentiate between a valid and an invalid TLS Certificate
• D.The browser contains both the public and private key of all known Certifying Authorities (CA) and based on that it is able to differentiate between a valid and an invalid TLS Certificate