A Java servlet application uses a custom authentication filter that validates a token in the Authorization header. The filter does not create an HTTP session. A developer wants to implement logout by invalidating the token. What is the best way to do this?

Clear the Authorization header on the client side.

Create a session and invalidate it on logout.

Maintain a server-side token blacklist that is checked on every request.

Use a short token expiration time.

A Java application stores passwords using PBKDF2WithHmacSHA256 with a 16-byte random salt and 10,000 iterations. A security audit recommends increasing the iteration count. What is the primary reason?

To reduce the risk of hash collisions.

To make the salt more unique for each user.

To increase the computational cost of brute-force attacks on stolen hashes.

To make the hash shorter for storage.

A Java application has a login form that returns a JSON response with a field 'error' that contains the exception message from the authentication service. The security team wants to prevent information leakage while still providing useful feedback to the client. What is the best approach?

Return a generic error message and log the detailed exception server-side

Return a generic message but include the exception class name

Return a 500 status with the exception message

Return the exception message but only for known users

Which session management practice is specifically designed to prevent session fixation attacks?

Using the default session ID generated by the container

Regenerating the session ID after successful authentication

Storing the session ID in a URL parameter

In a Java web application, which mechanism is used to automatically invalidate a user's session after a period of inactivity?

Using a JavaScript timer to redirect the user to a logout page

Setting the Cookie max-age attribute to zero

Setting the session timeout in the deployment descriptor or using HttpSession.setMaxInactiveInterval()

Calling HttpSession.invalidate() after every request

EC-CouncilCertified Application Security Engineer (Java)

Domain 4Objective 2

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 4)

Part of the Secure Coding: Authentication and Authorization domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 16–20

16expert · hard
A Java servlet application uses a custom authentication filter that validates a token in the Authorization header. The filter does not create an HTTP session. A developer wants to implement logout by invalidating the token. What is the best way to do this?
Select an answer first
17application · medium
A Java application stores passwords using PBKDF2WithHmacSHA256 with a 16-byte random salt and 10,000 iterations. A security audit recommends increasing the iteration count. What is the primary reason?
Select an answer first
18expert · hard
A Java application has a login form that returns a JSON response with a field 'error' that contains the exception message from the authentication service. The security team wants to prevent information leakage while still providing useful feedback to the client. What is the best approach?
Select an answer first
19foundation · easy
Which session management practice is specifically designed to prevent session fixation attacks?
Select an answer first
20foundation · easy
In a Java web application, which mechanism is used to automatically invalidate a user's session after a period of inactivity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.