A Java application accepts a base64-encoded ciphertext from a client and decrypts it. An attacker sends a malformed base64 string that causes the decoder to throw an exception revealing internal class names. Which defensive coding practice is most directly needed?

Log the exception and continue processing the next request.

Validate and sanitize the input before passing it to the decoder, and catch exceptions without exposing details.

Use a different base64 decoder that is faster.

Encrypt the base64 string again before decoding.

Which of the following is a best practice for handling exceptions in cryptographic code?

Log the detailed exception internally but return a generic error message to the user

Return the full stack trace to the user for transparency

Use the same error message for all errors, but log nothing

Ignore all exceptions and continue processing

A Java application needs to generate a secret key for AES-256 encryption. The developer uses `new Random()` to generate the key bytes. Which change should be made to ensure the key is cryptographically secure?

Use a fixed string converted to bytes as the key.

Use `Math.random()` to generate the key bytes.

Use `SecureRandom` to generate the key bytes.

Use the current timestamp as the seed for `Random` and generate bytes.

A Java service accepts a base64-encoded AES key from a request header and uses it to decrypt incoming payloads. An attacker submits a malformed key that causes the service to throw a detailed exception revealing the key length and algorithm. Which defensive coding practice should be applied?

Use the key as-is without decoding and rely on the JVM's default exception handling.

Convert the key to a string and trim whitespace before decryption.

Validate the decoded key length and algorithm against an allowlist, and return a generic error.

Base64-decode the key and catch all exceptions, logging the full stack trace for debugging.

EC-CouncilCertified Application Security Engineer (Java)

Domain 5Objective 3

Cryptographic Attacks and Defensive Coding CASEJAVA Practice Questions (Page 8)

Part of the Secure Coding: Cryptography domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 2–3 from this objective — we provide 43 practice questions to prepare you well beyond it. (estimate)

43questions here

9free pages

7concepts

Questions 36–40

36application · medium
A Java application accepts a base64-encoded ciphertext from a client and decrypts it. An attacker sends a malformed base64 string that causes the decoder to throw an exception revealing internal class names. Which defensive coding practice is most directly needed?
Select an answer first
37foundation · easy
Which of the following is a best practice for handling exceptions in cryptographic code?
Select an answer first
38application · easy
A Java application needs to generate a secret key for AES-256 encryption. The developer uses `new Random()` to generate the key bytes. Which change should be made to ensure the key is cryptographically secure?
Select an answer first
39foundation · easy
Which cryptographic attack involves an attacker systematically trying all possible keys until the correct one is found?
Select an answer first
40application · medium
A Java service accepts a base64-encoded AES key from a request header and uses it to decrypt incoming payloads. An attacker submits a malformed key that causes the service to throw a detailed exception revealing the key length and algorithm. Which defensive coding practice should be applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.