The SecOps Group CAP Actual Free Exam Questions & Community Discussion

Exam Code/Number: CAP
Exam Name/Title: Certified AppSec Practitioner Exam
Certification Provider: The SecOps Group
Corresponding Certification: AppSec Practitioner

Exam Questions: 60
Updated On: Jul 21, 2026

Question #1

Which of the following Google Dorks can be used for finding directory listing on victim-app.com?

A. None of the above

B. Both A and B

C. intext:"Index of" site:victim-app.com

D. intitle:"Index of" site:victim-app.com

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #2

In the context of the CORS (Cross-origin resource sharing) misconfiguration, which of the following statements is true?

A. All of the above

B. CORS is exploitable if the value of the HTTP headers are Access-Control-Allow-Origin: * and Access- Control-Allow-Credentials: false

C. CORS is exploitable if the value of the HTTP headers is Access-Control-Allow-Origin: * and the value of the Access-Control-Allow-Credentials header is irrelevant

D. CORS is exploitable if the value of the HTTP headers are Access-Control-Allow-Origin: * and Access- Control-Allow-Credentials: true

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #3

A robots.txt file tells the search engine crawlers about the URLs which the crawler can access on your site.
Which of the following is true about robots.txt?

A. Developers must list all sensitive files and directories in this file to secure them

B. None of the above

C. Developers must not list any sensitive files and directories in this file

D. Both A and B

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #4

Which of the following headers helps in preventing the Clickjacking attack?

A. X-Frame-Options

B. Access-Control-Allow-Origin

C. Strict-Transport-Security

D. X-Content-Type-Options

Discussion 0

Correct Answer: A Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #5

Which HTTP header is used by the CORS (Cross-origin resource sharing) standard to control access to resources on a server?

A. Access-Control-Request-Headers

B. None of the above

C. Access-Control-Allow-Headers

D. Access-Control-Request-Method

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #6

In the context of a Dependency Confusion Attack, which of the following files is analyzed for determining potential private packages?

A. requirements.txt

B. None of the above

C. Both A and B

D. package.json

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Download Free The SecOps Group CAP Demo

Simply submit your e-mail address below to get started with our free demo of your The SecOps Group CAP exam.