01. A team has written its security requirements specification. Before design begins, the team walks through the document with business owners, architects and testers to confirm that the requirements are complete, consistent and correctly reflect stakeholder needs.
Which SRE activity is this?
a) Requirements elicitation
b) Requirements validation
c) Requirements specification
d) Requirements analysis
02. A Java web application accepts input from a form field and processes it directly, without checking its format or length.
Which primary risk does this introduce?
a) Session fixation through a session ID kept across login
b) Information disclosure through stack traces sent to the browser
c) Injection attacks such as SQL injection or cross-site scripting
d) Credential theft through password hashes stored without a salt
03. For a Java banking portal, an architect draws a data-flow diagram, identifies the threats against each element and maps every threat to a countermeasure the design must include.
Which activity is this?
a) Threat modeling
b) Secure code review
c) Penetration testing
d) Security requirements elicitation
04. A development team wants to identify security issues in the third-party libraries used by its application during build time.
Which approach should the team implement?
a) DAST scanning of the staging build
b) Manual review of in-house modules
c) Manual penetration testing
d) Software composition analysis
05. A servlet login handler authenticates the user but keeps the session ID issued before login, leaving the application open to session fixation. The session already holds a shopping cart that must survive login.
Which call fixes the flaw while keeping the session's attributes?
a) session.invalidate()
b) request.changeSessionId()
c) session.setMaxInactiveInterval(0)
d) request.getSession(true)
06. To protect a Java application against SQL injection, the team uses parameterized queries, validates input against an allow list, places a web application firewall in front of the application and gives the database account minimal rights.
Which principle does combining these controls represent?
a) Fail-safe defaults
b) Economy of mechanism
c) Complete mediation
d) Defense in depth
07. A Java banking application passes its automated SAST and DAST scans with no high-severity findings. After release, a customer discovers that changing the accountId in a transfer request lets them move money out of another customer's account.
Which activity was MOST likely to catch this flaw before release?
a) Manual review of the transfer authorization code
b) Running the automated DAST scanner with valid credentials
c) Tuning the SAST rule set to reduce false positives
d) Software composition analysis of the payment libraries
08. After a release, testers find that the production build of a Java web application still runs in development mode: detailed exceptions are returned to users and a diagnostic endpoint is reachable.
Which application-level change addresses the root cause?
a) Enforce HTTPS with a CONFIDENTIAL transport guarantee on every URL
b) Place a web application firewall in front of the application
c) Disable development mode in the production build
d) Raise the application log level to DEBUG so endpoint access is recorded
09. A payment service wraps a call that updates a customer's account balance in catch (Exception e) { }. Weeks later, the team finds balances that never changed, and no record of any error exists.
What is the primary problem with this handler?
a) It catches Exception, and so it also traps every Error the JVM throws
b) It swallows the failure, which leaves nothing to detect or investigate
c) It hides the stack trace from the user, which prevents support staff from helping
d) It forces the compiler to treat every checked exception in the block as unchecked
10. Which protocol adds an authentication layer on top of OAuth 2.0 by issuing an ID token that carries the user's identity to the client application?
a) SAML 2.0
b) OAuth 2.0
c) OpenID Connect
d) LDAP
The purpose of this Sample Question Set is to provide you with information about the EC-Council Application Security Engineer - Java exam. These sample questions will make you very familiar with both the type and the difficulty level of the questions on the 312-96 certification test. To get familiar with real exam environment, we suggest you try our Sample EC-Council CASE Java Certification Practice Exam. This sample practice exam gives you the feeling of reality and is a clue to the questions asked in the actual EC-Council Certified Application Security Engineer (CASE) - Java certification exam.
