Discuss ISC2 CAP Exam Topic 1 Question 88

Based on the screenshot above, which of the following is the most true?

Screenshot

![Login Form]

coder@viewer

User does not exist

[Password field]

Forget password?

[Login button]

Not yet member? Sign now

AThe application is vulnerable to username enumeration

BThe application is vulnerable to brute-force attacks

CThe application does not enforce a strong password policy

DNone of the above

Suggested Answer: C

Get Premium CAP Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

36 comments · newest first

Adelle 10 months ago

I think none of these options really fit the screenshot.

Fannie 11 months ago

Strong password policy isn't mentioned, so that's a concern too.

Shaun 11 months ago

Surprised there's no captcha or lockout feature!

Gerald 11 months ago

I disagree, it could just be a simple login error.

Jenise 11 months ago

Definitely looks like a username enumeration issue.

Kallie 12 months ago

I practiced a similar question where username enumeration was a key point, so I'm leaning towards A, but I could be mistaken.

Quentin 12 months ago

I feel like none of the options really address password strength directly, so maybe D is the right choice?

Valentine 12 months ago

I'm not entirely sure, but I remember something about brute-force attacks being related to repeated login attempts. Is that what option B is about?

Catalina 1 year ago

I think option A might be correct since the message "User does not exist" could indicate that the app reveals whether a username is valid.

Kenneth 1 year ago

I'm a bit confused by the password policy part of the question. I'll need to review the details of the login form to see if I can spot any issues with the password requirements.

Kristofer 1 year ago

Okay, let's see. The application also has a "Forget password?" link, which could potentially be used for brute-force attacks. I'll need to consider that as well.

Marguerita 1 year ago

Hmm, the "User does not exist" message seems a bit concerning. That could indicate a vulnerability to username enumeration. I'll need to think carefully about that one.

Malcolm 1 year ago

This looks like a pretty straightforward security question. I'll start by analyzing the login form and the error message to see if I can identify any vulnerabilities.

Delpha 1 year ago

Hmm, I'm a bit unsure about this one. I need to make sure I understand the differences between rapid elasticity, metered utilization, shared resources, and high availability. Let me think this through carefully.

Jettie 1 year ago

This one seems pretty straightforward. I think the key is to focus on the factors that affect the amount of safety stock a company would hold.

Beatriz 1 year ago

I'm a bit confused here. Conflicts with the Decoupled Contract pattern? I'm not sure about that one. I'll have to think it through.

Billy 1 year ago

Wow, this app is so secure, it doesn't even have a password field. Guess they're going for the 'no password required' approach. Option D is the way to go, for sure.

Herminia 1 year ago

This login page is a security disaster. I bet the password is just 'password123' for every user. Option C is the clear choice here.

Rene 1 year ago

↳ replying to Herminia

User3: I think we should report this to the developers to improve the security of the application.

Nieves 1 year ago

↳ replying to Herminia

User2: Definitely, they should require more complex passwords to prevent easy guessing.

Bulah 1 year ago

↳ replying to Herminia

User1: I agree, the lack of a strong password policy is a huge security risk.

Thomasena 1 year ago

Haha, looks like the devs forgot to include 'Enter password' in the form. How do they expect users to log in without a password field? Option D all the way!

Ashley 1 year ago

↳ replying to Thomasena

They really dropped the ball on this one. Option D for sure.

Timothy 1 year ago

↳ replying to Thomasena

I agree, it's a big security flaw. Option D it is.

Crista 1 year ago

↳ replying to Thomasena

Yeah, that's a major oversight. Option D is definitely the most true.

Cristina 1 year ago

I think option B is the way to go here. The lack of any password policy or lockout mechanism makes this app ripe for brute-force attacks.

Sanda 1 year ago

↳ replying to Cristina

I think we should consider both options A and B. Username enumeration combined with the lack of password policy could make this application very vulnerable.

Coral 1 year ago

↳ replying to Cristina

I see your point, but I still believe option B is the most concerning. Without a strong password policy, brute-force attacks could easily compromise the system.

Myrtie 1 year ago

↳ replying to Cristina

I think option A could also be a possibility. The fact that it explicitly states 'User does not exist' could be used to enumerate valid usernames.

Ona 1 year ago

↳ replying to Cristina

I agree, option B seems like the most accurate choice. Brute-force attacks could easily be carried out on this application.

Angelyn 1 year ago

The application is definitely vulnerable to username enumeration. That message 'User does not exist' is a dead giveaway.

Shonda 1 year ago

↳ replying to Angelyn

User1

Rasheeda 1 year ago

↳ replying to Angelyn

User2

Jamal 2 years ago

I believe the application should enforce a strong password policy to enhance security.

Sylvia 2 years ago

I agree with Troy, the lack of user existence feedback makes it easier for attackers to guess usernames.

Troy 2 years ago

I think the application is vulnerable to brute-force attacks.

ISC2 CAP Exam - Topic 1 Question 88 Discussion