A Java application decrypts data using an AES key derived from a user-supplied password. The password is passed directly to the key-derivation function without any validation. What is the most important input validation to add?

Convert the password to uppercase before deriving the key.

Ensure the password contains at least one special character.

Trim whitespace from the password before use.

Enforce a minimum password length and reject passwords that are too short.

A Java application's login endpoint returns 'User not found' when the username is invalid and 'Invalid password' when the password is wrong. An attacker uses this to enumerate valid usernames. Which defensive coding change is most appropriate?

Return a generic 'Invalid credentials' message for both cases.

Log the username and password to the server for debugging.

Return 'User not found' only after a failed password attempt.

Use a different error message for each user to confuse attackers.

A Java web application encrypts session cookies using AES in ECB mode with a hard-coded key. A penetration tester demonstrates that identical plaintext blocks produce identical ciphertext blocks, allowing an attacker to manipulate the cookie. Which combination of changes addresses the root cause?

Switch to AES-GCM with a randomly generated IV and store the key in a hardware security module (HSM).

Use AES-CTR with a nonce derived from the username and store the key in the database.

Keep AES-ECB but add a padding oracle check before decryption.

Use AES-CBC with a static IV and embed the key in the application configuration file.

EC-CouncilCertified Application Security Engineer (Java)

Domain 5Objective 3

Cryptographic Attacks and Defensive Coding CASEJAVA Practice Questions (Page 5)

Part of the Secure Coding: Cryptography domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 21–25

21application · medium
A Java application decrypts data using an AES key derived from a user-supplied password. The password is passed directly to the key-derivation function without any validation. What is the most important input validation to add?
Select an answer first
22foundation · easy
Which security property is most directly compromised when an attacker exploits a weak MAC (Message Authentication Code) to forge a valid tag for a modified message?
Select an answer first
23application · medium
A Java application's login endpoint returns 'User not found' when the username is invalid and 'Invalid password' when the password is wrong. An attacker uses this to enumerate valid usernames. Which defensive coding change is most appropriate?
Select an answer first
24application · medium
A Java web application encrypts session cookies using AES in ECB mode with a hard-coded key. A penetration tester demonstrates that identical plaintext blocks produce identical ciphertext blocks, allowing an attacker to manipulate the cookie. Which combination of changes addresses the root cause?
Select an answer first
25foundation · easy
Which of the following algorithms is considered cryptographically insecure and should be avoided in modern applications?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Cryptographic Attacks and Defensive Coding CASEJAVA Practice Questions (Page 5)

Questions 21–25

A Java application decrypts data using an AES key derived from a user-supplied password. The password is passed directly to the key-derivation function without any validation. What is the most important input validation to add?

Which security property is most directly compromised when an attacker exploits a weak MAC (Message Authentication Code) to forge a valid tag for a modified message?

A Java application's login endpoint returns 'User not found' when the username is invalid and 'Invalid password' when the password is wrong. An attacker uses this to enumerate valid usernames. Which defensive coding change is most appropriate?

A Java web application encrypts session cookies using AES in ECB mode with a hard-coded key. A penetration tester demonstrates that identical plaintext blocks produce identical ciphertext blocks, allowing an attacker to manipulate the cookie. Which combination of changes addresses the root cause?

Which of the following algorithms is considered cryptographically insecure and should be avoided in modern applications?

Keep studying — Secure Coding: Cryptography