Which authorization model assigns permissions to users based on the roles they hold, where roles are typically defined by job functions?

Discretionary Access Control (DAC)

Attribute-Based Access Control (ABAC)

Role-Based Access Control (RBAC)

A Java application uses Spring Security with method security. The requirement is that only users with the 'MANAGER' role can approve expense reports, but any authenticated user can view their own reports. Which annotation should be used on the approve method?

@PreAuthorize("hasRole('MANAGER')")

@PostAuthorize("hasRole('MANAGER')")

A Java enterprise application needs to authenticate users who access it from a corporate network. The users already have valid X.509 certificates issued by the company's internal CA. The application is deployed on a Tomcat server. Which authentication mechanism is most appropriate?

Certificate-based authentication using mutual TLS

HTTP Basic authentication over HTTPS

Form-based authentication with a username/password database

OAuth2 with an external identity provider

A Java web application uses a session cookie to maintain user state. The application is deployed over HTTPS. The security team wants to ensure the session cookie is not accessible to client-side scripts and is only sent over secure connections. Which configuration should be applied to the session cookie?

Set the cookie domain to the application's domain

Set the Secure and HttpOnly flags

Set the SameSite attribute to Strict

Set the cookie path to the application root

A Java application uses RBAC with roles such as 'USER' and 'ADMIN'. The security team wants to implement a more granular permission-based model where a user can have a role but also be denied a specific permission. For example, an 'ADMIN' role might be denied the 'export' permission for certain data. Which approach best supports this requirement?

Use only role checks and do not allow any exceptions

Use RBAC with a separate permission table and add a deny rule that overrides allow rules

Use a permission-based model where permissions are assigned directly to users, ignoring roles

EC-CouncilCertified Application Security Engineer (Java)

Domain 4Objective 2

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 6)

Part of the Secure Coding: Authentication and Authorization domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 26–30

26foundation · easy
Which authorization model assigns permissions to users based on the roles they hold, where roles are typically defined by job functions?
Select an answer first
27application · medium
A Java application uses Spring Security with method security. The requirement is that only users with the 'MANAGER' role can approve expense reports, but any authenticated user can view their own reports. Which annotation should be used on the approve method?
Select an answer first
28application · medium
A Java enterprise application needs to authenticate users who access it from a corporate network. The users already have valid X.509 certificates issued by the company's internal CA. The application is deployed on a Tomcat server. Which authentication mechanism is most appropriate?
Select an answer first
29application · medium
A Java web application uses a session cookie to maintain user state. The application is deployed over HTTPS. The security team wants to ensure the session cookie is not accessible to client-side scripts and is only sent over secure connections. Which configuration should be applied to the session cookie?
Select an answer first
30expert · hard
A Java application uses RBAC with roles such as 'USER' and 'ADMIN'. The security team wants to implement a more granular permission-based model where a user can have a role but also be denied a specific permission. For example, an 'ADMIN' role might be denied the 'export' permission for certain data. Which approach best supports this requirement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 6)

Questions 26–30

Which authorization model assigns permissions to users based on the roles they hold, where roles are typically defined by job functions?

A Java application uses Spring Security with method security. The requirement is that only users with the 'MANAGER' role can approve expense reports, but any authenticated user can view their own reports. Which annotation should be used on the approve method?

A Java enterprise application needs to authenticate users who access it from a corporate network. The users already have valid X.509 certificates issued by the company's internal CA. The application is deployed on a Tomcat server. Which authentication mechanism is most appropriate?

Keep studying — Secure Coding: Authentication and Authorization