A Java web application uses form-based authentication with a username/password login. To mitigate brute-force attacks, the team wants to implement account lockout. Which approach is most effective while minimizing denial-of-service risk?

Lock the account permanently after 3 failed attempts.

Lock the account for 15 minutes after 5 failed attempts, and also implement IP-based throttling.

Only implement IP-based throttling without account lockout.

Delay the response by 2 seconds after each failed attempt without any lockout.

A Java application uses Spring Security with a custom authentication filter that validates a JWT token from the Authorization header. The application also needs to support session-based authentication for legacy clients. The security team requires that both mechanisms work simultaneously and that session fixation is prevented. What is the most appropriate design?

Use only JWT authentication and require all clients to migrate

Use session authentication only and ignore the JWT

Use JWT for API endpoints and session for web pages, but do not invalidate the session on login

Use a filter chain that checks for a valid JWT first, then falls back to session authentication, and on successful session login, invalidate the old session

A Java application uses a session cookie with the Secure flag but not HttpOnly. The application also uses a Content Security Policy (CSP) that disables inline scripts. An attacker finds an XSS vulnerability that allows injecting a script tag from an external domain. What is the most effective additional control to prevent session hijacking?

Add the HttpOnly flag to the session cookie.

Implement IP-based session binding.

Use a different session ID for each request.

EC-CouncilCertified Application Security Engineer (Java)

Domain 4Objective 2

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 5)

Part of the Secure Coding: Authentication and Authorization domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 21–25

21application · medium
A Java web application uses form-based authentication with a username/password login. To mitigate brute-force attacks, the team wants to implement account lockout. Which approach is most effective while minimizing denial-of-service risk?
Select an answer first
22foundation · easy
In a permission-based authorization model, what is the fundamental unit that represents a specific action that can be performed on a resource?
Select an answer first
23expert · hard
A Java application uses Spring Security with a custom authentication filter that validates a JWT token from the Authorization header. The application also needs to support session-based authentication for legacy clients. The security team requires that both mechanisms work simultaneously and that session fixation is prevented. What is the most appropriate design?
Select an answer first
24application · medium
A Java web application uses cookies for session management. The security team wants to reduce the risk of session hijacking via cross-site scripting (XSS). Which cookie attribute is most directly effective?
Select an answer first
25expert · hard
A Java application uses a session cookie with the Secure flag but not HttpOnly. The application also uses a Content Security Policy (CSP) that disables inline scripts. An attacker finds an XSS vulnerability that allows injecting a script tag from an external domain. What is the most effective additional control to prevent session hijacking?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 5)

Questions 21–25

A Java web application uses form-based authentication with a username/password login. To mitigate brute-force attacks, the team wants to implement account lockout. Which approach is most effective while minimizing denial-of-service risk?

In a permission-based authorization model, what is the fundamental unit that represents a specific action that can be performed on a resource?

A Java web application uses cookies for session management. The security team wants to reduce the risk of session hijacking via cross-site scripting (XSS). Which cookie attribute is most directly effective?

Keep studying — Secure Coding: Authentication and Authorization