CAP 試験問題を無料オンラインアクセス

GraphQL is an open-source data query and manipulation language for APIs, and a query runtime engine. In this context, what is GraphQL Introspection?

• A.A technique for testing the performance of the GraphQL API
• B.A technique for discovering the structure of the GraphQL API
• C.A technique for testing the compatibility of the GraphQL API with other systems
• D.A technique for testing the security of the GraphQL API

The payload {{7*7}} can be used for determining which of the following vulnerabilities?

• A.None of the above
• B.Server Side Template Injection (SSTI)
• C.Both 1 and 2
• D.Client-Side Template Injection (CSTI)

Which of the following Google Dorks can be used for finding directory listing on victim-app.com?

• A.intitle:"Index of" site:victim-app.com
• B.None of the above
• C.intext:"Index of" site:victim-app.com
• D.Both A and B

Which is the most effective way of input validation to prevent Cross-Site Scripting attacks?

• A.Whitelisting and allowing only trusted input
• B.Marking Cookie as HttpOnly
• C.Blacklisting HTML and other harmful characters
• D.Using a Web Application Firewall (WAF)

Observe the HTTP request below and identify the vulnerability attempted.
GET /help.php?file=../../../etc/passwd HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip, deflate Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Cookie: JSESSIONID=38RB5ECV10785B53AF29816E92E2E50 Te: trailers Connection: keep-alive

• A.Cross-Site Request Forgery Vulnerability
• B.All of the above
• C.Code Injection Vulnerability
• D.Path Traversal Vulnerability