A Java web application has a search feature that reflects user input without encoding, and it also uses a cookie to store a serialized user object. An attacker can exploit both issues. Which of the following are appropriate mitigations? Select all that apply.

Validate and filter serialized data before deserialization

Use a signed or encrypted token instead of a serialized object in the cookie

Disable JavaScript in the admin's browser

Add a WAF rule to block any request containing ' '

Apply context-aware output encoding to the search results

A web application reflects user input in an HTML page without encoding it. An attacker crafts a URL that, when clicked by a victim, executes JavaScript in the victim's browser. Which attack is this?

Cross-site request forgery (CSRF)

A Java application uses an XML parser to process uploaded files. An attacker uploads a file with an external entity that references a local file, causing the server to include its contents in the response. Which attack is this, and what is a primary mitigation?

XSS; encode the XML content before displaying

Command injection; sanitize the file name

Insecure deserialization; use a safe deserialization library

XXE (XML External Entity); disable external entity resolution in the XML parser

A team is implementing a login form and wants to prevent brute-force attacks. They also need to avoid locking out legitimate users. Which approach balances security and usability?

Lock the account after 3 failed attempts permanently

Implement rate limiting with exponential backoff and CAPTCHA after repeated failures

Disable the login form after any failed attempt

Use a simple password policy with no additional controls

A Java application uses a custom logging mechanism that concatenates user input directly into log messages. An attacker injects ` ` characters to forge log entries, misleading security analysts. Which vulnerability class does this attack belong to, and what is a key mitigation?

SQL injection; use parameterized queries for logging

Broken access control; restrict access to log files

Log Injection; sanitize and encode user input before logging

Cross-site scripting; output encode the log messages

EC-CouncilCertified Application Security Engineer (Java)

Domain 1Objective 2

Most Common Application-Level Attacks CASEJAVA Practice Questions (Page 5)

Part of the Application Security Foundations domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

5concepts

Questions 21–25

21expert · hard · select all that apply
A Java web application has a search feature that reflects user input without encoding, and it also uses a cookie to store a serialized user object. An attacker can exploit both issues. Which of the following are appropriate mitigations? Select all that apply.
Select an answer first
22foundation · easy
A web application reflects user input in an HTML page without encoding it. An attacker crafts a URL that, when clicked by a victim, executes JavaScript in the victim's browser. Which attack is this?
Select an answer first
23application · medium
A Java application uses an XML parser to process uploaded files. An attacker uploads a file with an external entity that references a local file, causing the server to include its contents in the response. Which attack is this, and what is a primary mitigation?
Select an answer first
24application · medium
A team is implementing a login form and wants to prevent brute-force attacks. They also need to avoid locking out legitimate users. Which approach balances security and usability?
Select an answer first
25application · medium
A Java application uses a custom logging mechanism that concatenates user input directly into log messages. An attacker injects ` ` characters to forge log entries, misleading security analysts. Which vulnerability class does this attack belong to, and what is a key mitigation?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.