A company runs a Java-based e-commerce platform. A penetration test reveals a SQL injection vulnerability in the product search feature. The team must decide between two mitigations: (1) implement prepared statements, or (2) deploy a WAF with a rule to block SQL injection patterns. Which consideration is most important when choosing the mitigation?

Prepared statements are only effective for MySQL, not other databases

A WAF provides better performance than prepared statements

A WAF is easier to deploy and requires no code changes, making it the preferred choice

Prepared statements eliminate the vulnerability at the source, while a WAF only filters known patterns and can be bypassed

A user is tricked into visiting a malicious website while logged into a banking application. The malicious site automatically submits a form to the banking app that transfers funds, leveraging the user's active session. Which attack is this, and which defense is most effective?

Cross-site request forgery (CSRF); anti-CSRF token

Session fixation; regenerate session ID

SQL injection; prepared statements

Cross-site scripting (XSS); input validation

A Java application deserializes objects from a message queue. An attacker sends a crafted object that triggers a long-running computation, causing the application to hang. Which impact does this attack have, and which vulnerability class is it?

Integrity loss; broken access control

Confidentiality loss; injection

Non-repudiation loss; security misconfiguration

Availability loss; insecure deserialization

EC-CouncilCertified Application Security Engineer (Java)

Domain 1Objective 2

Most Common Application-Level Attacks CASEJAVA Practice Questions (Page 10)

Part of the Application Security Foundations domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

5concepts

Questions 46–48

46expert · hard
A company runs a Java-based e-commerce platform. A penetration test reveals a SQL injection vulnerability in the product search feature. The team must decide between two mitigations: (1) implement prepared statements, or (2) deploy a WAF with a rule to block SQL injection patterns. Which consideration is most important when choosing the mitigation?
Select an answer first
47application · medium
A user is tricked into visiting a malicious website while logged into a banking application. The malicious site automatically submits a form to the banking app that transfers funds, leveraging the user's active session. Which attack is this, and which defense is most effective?
Select an answer first
48expert · hard
A Java application deserializes objects from a message queue. An attacker sends a crafted object that triggers a long-running computation, causing the application to hang. Which impact does this attack have, and which vulnerability class is it?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Most Common Application-Level Attacks CASEJAVA Practice Questions (Page 10)

Questions 46–48

A user is tricked into visiting a malicious website while logged into a banking application. The malicious site automatically submits a form to the banking app that transfers funds, leveraging the user's active session. Which attack is this, and which defense is most effective?

A Java application deserializes objects from a message queue. An attacker sends a crafted object that triggers a long-running computation, causing the application to hang. Which impact does this attack have, and which vulnerability class is it?

Keep studying — Application Security Foundations