Testimonials
CAP
CAP
CAP
CAP
Who should take this exam?
CAP is intended to be taken by application security engineers, application developers, SOC analysts, penetration testers, red and blue team members and any appsec enthusiast, who wants to evaluate and advance their knowledge.
What is the format of the exam?
The exam includes Multiple Choice Questions (MCQs) covering the syllabus. The time duration of the exam is 60 minutes. The exam will be proctored but can be taken online, anytime (on-demand) and from anywhere. The exam will cover a variety of questions which are both factual and scenario based. The exam focuses on core concepts and is language or technology agnostic.
What is the pass criteria for the exam?
The pass criteria are as follows:
- Candidates scoring over 60% marks will be deemed to have successfully passed the exam.
- Candidates scoring over 75% marks will be deemed to have passed with a merit.
What is the experience needed to take the exam?
This is an entry-level exam. Candidates should have prior knowledge (both theoretical and practical) of common application security related topics such as the OWASP Top 10 issues, common security misconfigurations, best security practices, defense-in-depth measures as well as an overview of how vulnerabilities can be exploited in the real world scenario.
Note: Professional pentesting is not a hard requirement for this exam.
What will the candidates get?
On completing the exam, each candidate will receive:
- A certificate with their pass/fail and merit status.
- The certificate will contain a code/QR link, which can be used by anyone to validate the certificate.
What is the exam retake policy?
Candidates, who fail the exam, must purchase a new exam voucher to retake the exam.
What are the benefits of this exam?
The exam will allow candidates to demonstrate their understanding of application security topics. This will help them to advance in their career.
How long is the certificate valid for?
The certificate does not have an expiration date. However, the passing certificate will mention the details of the exam such as the exam version and the date. As the exam is updated over time, candidates should retake the newer version as per their convenience.
Who should take this exam?
CAP is intended to be taken by application security engineers, application developers, SOC analysts, penetration testers, red and blue team members and any appsec enthusiast, who wants to evaluate and advance their knowledge.
What is the format of the exam?
The exam includes Multiple Choice Questions (MCQs) covering the syllabus. The time duration of the exam is 60 minutes. The exam will be proctored but can be taken online, anytime (on-demand) and from anywhere. The exam will cover a variety of questions which are both factual and scenario based. The exam focuses on core concepts and is language or technology agnostic.
What is the pass criteria for the exam?
The pass criteria are as follows:
- Candidates scoring over 60% marks will be deemed to have successfully passed the exam.
- Candidates scoring over 75% marks will be deemed to have passed with a merit.
What is the experience needed to take the exam?
This is an entry-level exam. Candidates should have prior knowledge (both theoretical and practical) of common application security related topics such as the OWASP Top 10 issues, common security misconfigurations, best security practices, defense-in-depth measures as well as an overview of how vulnerabilities can be exploited in the real world scenario.
Note: Professional pentesting is not a hard requirement for this exam.
What will the candidates get?
On completing the exam, each candidate will receive:
- A certificate with their pass/fail and merit status.
- The certificate will contain a code/QR link, which can be used by anyone to validate the certificate.
What is the exam retake policy?
Candidates, who fail the exam, must purchase a new exam voucher to retake the exam.
What are the benefits of this exam?
The exam will allow candidates to demonstrate their understanding of application security topics. This will help them to advance in their career.
How long is the certificate valid for?
The certificate does not have an expiration date. However, the passing certificate will mention the details of the exam such as the exam version and the date. As the exam is updated over time, candidates should retake the newer version as per their convenience.
Exam syllabus
The exam will cover the following topics
Input Validation Mechanisms
- Blacklisting
- Whitelisting
Cross-Site Scripting
SQL Injection
XML External Entity attack
Cross-Site Request Forgery
Encoding, Encryption and Hashing
Authentication related Vulnerabilities
- Brute force Attacks
- Password Storage and Password Policy
Understanding of OWASP Top 10 Vulnerabilities
Security Best Practices and Hardening Mechanisms.
- Same Origin Policy
- Security Headers.
TLS security
- TLS Certificate Misconfiguration
- Symmetric and Asymmetric Ciphers
Server-Side Request Forgery
Authorization and Session Management related flaws –
- Insecure Direct Object Reference (IDOR)
- Privilege Escalation
- Parameter Manipulation attacks
- Securing Cookies.
Insecure File Uploads
Code Injection Vulnerabilities
Business Logic Flaws
Directory Traversal Vulnerabilities
Security Misconfigurations.
Information Disclosure.
Vulnerable and Outdated Components.
Common Supply Chain Attacks and Prevention Methods.
