Which error message is most appropriate to display to a user when a login attempt fails because the username does not exist?

The username you entered does not exist

Access denied due to account lockout

Which defensive technique is specifically designed to mitigate brute-force attacks on a login form?

Storing passwords in plain text

Account lockout after a threshold of failed attempts

A Java web application's authentication filter catches exceptions and returns a 500 error page with a stack trace. The security team wants to prevent information leakage. What is the best practice?

Disable error handling entirely

Log the stack trace server-side and return a generic error page

Redirect to the login page on any error

Return the stack trace to the client for easier debugging

EC-CouncilCertified Application Security Engineer (Java)

Domain 4Objective 2

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 9)

Part of the Secure Coding: Authentication and Authorization domain, which makes up ~11% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–9 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 41–45

41foundation · easy
Which Spring Security annotation can be used to restrict access to a method based on a role, such as requiring the 'ADMIN' role?
Select an answer first
42foundation · easy
Which error message is most appropriate to display to a user when a login attempt fails because the username does not exist?
Select an answer first
43foundation · easy
Which defensive technique is specifically designed to mitigate brute-force attacks on a login form?
Select an answer first
44application · medium
A Java web application's authentication filter catches exceptions and returns a 500 error page with a stack trace. The security team wants to prevent information leakage. What is the best practice?
Select an answer first
45foundation · easy
In a Java servlet application, which component is commonly used to intercept an HTTP request before it reaches a servlet so that authentication logic can be applied consistently across multiple endpoints?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Authentication and Authorization Defensive Techniques in Java CASEJAVA Practice Questions (Page 9)

Questions 41–45

Which Spring Security annotation can be used to restrict access to a method based on a role, such as requiring the 'ADMIN' role?

Which error message is most appropriate to display to a user when a login attempt fails because the username does not exist?

Which defensive technique is specifically designed to mitigate brute-force attacks on a login form?

A Java web application's authentication filter catches exceptions and returns a 500 error page with a stack trace. The security team wants to prevent information leakage. What is the best practice?

In a Java servlet application, which component is commonly used to intercept an HTTP request before it reaches a servlet so that authentication logic can be applied consistently across multiple endpoints?

Keep studying — Secure Coding: Authentication and Authorization