A Java application accepts a file path from the user to download a file from a server directory. The security review found that an attacker could use URL-encoded characters (e.g., %2e%2e%2f) to traverse directories. What should the developer do to prevent this bypass?

Canonicalize the input path to its absolute form and then validate that it starts with the allowed directory.

Use a blacklist to remove percent signs and dots from the input.

Replace all occurrences of '..' with an empty string in the input path.

Validate the input using a regex that allows only alphanumeric characters and underscores.

A Java application has a form with a 'phone' field. The team wants to validate that the input is a valid US phone number. They are considering using a validation framework like Hibernate Validator. Which approach is most appropriate?

Use a @Pattern annotation with a regex that matches the expected phone number format.

Use no validation because the field is only used for display.

Use client-side JavaScript to check the input length.

Use a blacklist that rejects any input containing letters or symbols.

A Java servlet filters user input by removing the substring 'script' to prevent XSS. A tester submits the value '%73%63%72%69%70%74' and the attack succeeds. What is the most likely reason the filter failed?

The input was URL-encoded and the filter did not canonicalize it before applying the blacklist.

The filter removed the substring only once, but the payload contained it twice.

The filter used a whitelist instead of a blacklist, allowing the encoded payload.

The filter was applied only on the client side, not on the server side.

A Java web application has a login form. The team wants to prevent SQL injection in the username field. Which layered approach is most effective?

Use client-side JavaScript to block characters like ' and ; before form submission.

Use a blacklist that removes common SQL keywords like SELECT, UNION, and OR from the input.

Use a database stored procedure that concatenates the input into a dynamic SQL string.

Use prepared statements with parameterized queries, server-side whitelist validation, and an application firewall that inspects SQL patterns.

A Java web application displays user-generated content in an HTML page. The content is stored in a database and later rendered using a template engine. The security team wants to prevent XSS without losing the ability to display line breaks and basic formatting. What is the best approach?

Use a blacklist to remove script tags and event handlers.

Use a whitelist-based sanitizer that allows only safe HTML tags like and , and encode everything else.

Remove all HTML tags from the content before storing it.

Encode the entire content using HTML entity encoding before rendering.

EC-CouncilCertified Application Security Engineer (Java)

Domain 3Objective 1

Input Validation Approaches and Filtering CASEJAVA Practice Questions (Page 2)

Part of the Secure Coding: Input Validation domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 3–4 from this objective — we provide 39 practice questions to prepare you well beyond it. (estimate)

39questions here

8free pages

5concepts

Questions 6–10

6application · medium
A Java application accepts a file path from the user to download a file from a server directory. The security review found that an attacker could use URL-encoded characters (e.g., %2e%2e%2f) to traverse directories. What should the developer do to prevent this bypass?
Select an answer first
7expert · easy
A Java application has a form with a 'phone' field. The team wants to validate that the input is a valid US phone number. They are considering using a validation framework like Hibernate Validator. Which approach is most appropriate?
Select an answer first
8application · medium
A Java servlet filters user input by removing the substring 'script' to prevent XSS. A tester submits the value '%73%63%72%69%70%74' and the attack succeeds. What is the most likely reason the filter failed?
Select an answer first
9application · medium
A Java web application has a login form. The team wants to prevent SQL injection in the username field. Which layered approach is most effective?
Select an answer first
10application · medium
A Java web application displays user-generated content in an HTML page. The content is stored in a database and later rendered using a template engine. The security team wants to prevent XSS without losing the ability to display line breaks and basic formatting. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.