A Java web application is vulnerable to privilege escalation because a user can change their role by modifying a hidden form field. The application uses a session-based login. What is the most effective way to prevent this attack?

Use JavaScript to prevent the user from changing the field

Store the user's role in the session after authentication and never trust client-supplied role values

Encode the role in the session cookie

Use a hidden form field to carry the role but validate it against the database

Why is it essential to use a unique random salt when hashing each user's password?

To make the hash algorithm faster

To allow the password to be recovered if forgotten

To ensure that identical passwords produce different hash values

To encrypt the password before hashing

A Java servlet application uses a filter to perform authentication. The filter checks for a valid session and redirects to a login page if absent. After login, the servlet calls request.changeSessionId(). What is the primary purpose of this call?

To extend the session timeout after login.

To prevent session fixation by ensuring the session ID changes after authentication.

To invalidate all other sessions for the user.

EC-CouncilCertified Application Security Engineer (Java)

Domain 4Objective 2

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 7)

Part of the Secure Coding: Authentication and Authorization domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 31–35

31foundation · easy
Which Spring Security component is responsible for processing an authentication request, such as validating a username and password, and producing an Authentication object that is stored in the SecurityContext?
Select an answer first
32expert · hard
A Java web application is vulnerable to privilege escalation because a user can change their role by modifying a hidden form field. The application uses a session-based login. What is the most effective way to prevent this attack?
Select an answer first
33foundation · easy
Why is it essential to use a unique random salt when hashing each user's password?
Select an answer first
34foundation · easy
In a Java EE application, which standard annotation can be placed on a method to restrict access to users holding a specific role?
Select an answer first
35application · medium
A Java servlet application uses a filter to perform authentication. The filter checks for a valid session and redirects to a login page if absent. After login, the servlet calls request.changeSessionId(). What is the primary purpose of this call?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 7)

Questions 31–35

Which Spring Security component is responsible for processing an authentication request, such as validating a username and password, and producing an Authentication object that is stored in the SecurityContext?

A Java web application is vulnerable to privilege escalation because a user can change their role by modifying a hidden form field. The application uses a session-based login. What is the most effective way to prevent this attack?

Why is it essential to use a unique random salt when hashing each user's password?

In a Java EE application, which standard annotation can be placed on a method to restrict access to users holding a specific role?

A Java servlet application uses a filter to perform authentication. The filter checks for a valid session and redirects to a login page if absent. After login, the servlet calls request.changeSessionId(). What is the primary purpose of this call?

Keep studying — Secure Coding: Authentication and Authorization