Talib AliCybersecurity Study Guide & Portfolio

Study & Revision

Web & Application Security

Web & Application Security

CompTIA Security+CREST CPSA
Quiz this topicFlashcards for this topic

Taught in the Study Guide:

Evidence labels show where each concept’s recorded learning comes from: classroom sessions, Study Buddy sessions, supplementary Study Guide explanations or a mix. Reviewed revision may go further, so you can study ahead. Available questions do not imply complete topic or exam coverage.

Official syllabus references

CompTIA Security+

Exam version SY0-701 · All 28 numbered objectives represented; detailed bullets and revision content remain partial.

    Related groups: 4.0 · Security operations. Topic organisation is editorial; consult the official specification for full detail.

    CREST CPSA

    Specification 2.5 · All official groups represented; only selected verified skill IDs are catalogued. Detailed skills and revision content remain partial.

    • G1 · Web server operation

    Related groups: G · Web technologies; H · Web testing methodologies; I · Web testing techniques. Topic organisation is editorial; consult the official specification for full detail.

    Web Skimming and Third-Party Scripts

    Evidence: Mixed

    Revision: Available · 2 questions · 0 flashcards

    Exam relevance

    Learning-only · no verified exam mapping

      Reviewed revision scope

      • Classroom (Session 2): the British Airways Magecart incident was discussed as an example of malicious JavaScript interfering with web pages and capturing information entered by users.
      • Supplementary: in web skimming, a script a page loads, whether from the organisation or a supplier, is altered; every visitor’s browser runs it with the same access as the page, so it can copy what customers type and send it to a server the attacker controls while the page keeps working normally.
      • Supplementary: defences include keeping an inventory of the scripts a payment page loads, restricting which sources it may load scripts from, checking that scripts have not changed unexpectedly and monitoring payment pages for tampering.
      Outside the authored revision scope
      • Details of the British Airways incident beyond the classroom summary
      • Writing, testing or analysing skimming code
      • Detailed PCI DSS requirements
      • Unverified exam objectives

      Recorded evidence

      • Classroom (Session 2): the British Airways Magecart incident was discussed as an example of malicious JavaScript interfering with web pages and capturing information entered by users.
      • Supplementary: in web skimming, a script a page loads, whether from the organisation or a supplier, is altered; every visitor’s browser runs it with the same access as the page, so it can copy what customers type and send it to a server the attacker controls while the page keeps working normally.
      • Supplementary: defences include keeping an inventory of the scripts a payment page loads, restricting which sources it may load scripts from, checking that scripts have not changed unexpectedly and monitoring payment pages for tampering.
      • Session 2: Cyber Fundamentals Part 2 — Classroom session record · The CIA Triad; The DAD Triad; Securing Devices; Denial; DDoS Mitigation; Security, Usability and Functionality; Policies, Standards, Procedures and Guidelines
      • Third-Party and Supply-Chain Risk — Supplementary Study Guide explanation · Inheriting risk from others; Example: British Airways and Magecart; Managing supplier risk across the relationship; Accountability stays with the organisation
      Not established by the recorded evidence
      • Details of the British Airways incident beyond the classroom summary
      • Writing, testing or analysing skimming code
      • Detailed PCI DSS requirements
      • Unverified exam objectives

      Reviewed 2026-09-24. Reviewed against the linked Learning Log entries and Study Guide lesson Sources and scope sections. Scope statements are labelled Classroom, Study Buddy or Supplementary. No practical competence, completed assessment or exam alignment is implied.