The SecOps Group Certified AppSec Practitioner - CAP Exam Practice Test

Which of the following is a common attack in the context of SAML security?

Which SQL function can be used to read the contents of a file during manual exploitation of the SQL injection vulnerability in a MySQL database?

Under the same-origin policy (also SOP), a web browser permits scripts contained in a web page to access data in another web page, but only if both web pages have the same origin. Which of the following pages are in the same origin as that of the below URL?
http://www.example.com/dir/page2.html
* http://www.example.com/dir/other.html
* http://www.example.com:81/dir/other.html
* http://www.example.com/dir/other.html
* http://en.example.com/dir/other.html

Which of the following directives in a Content-Security-Policy HTTP response header, can be used to prevent a Clickjacking attack?

Multifactor authentication will NOT be able to prevent:

An application's forget password functionality is described below:
The user enters their email address and receives a message on the web page:
"If the email exists, we will email you a link to reset the password"
The user also receives an email saying:
"Please use the link below to create a new password:"
(Note that the developer has included a one-time random token with the 'userId' parameter in the link). So, the link seems like:
https://example.com/reset_password?userId=5298&token=70e7803e-bf53-45e1-8a3f-fb15da7de3a0 Will this mechanism prevent an attacker from resetting arbitrary users' passwords?