A development team is building a public-facing Java web application that will handle sensitive user data. They must decide on a session management strategy to prevent session hijacking and fixation. Which combination of controls is most effective?

Rely on client-side storage (localStorage) for session tokens

Use secure cookies with HttpOnly and Secure flags, regenerate session ID after login, and implement idle timeout

Use a long random session ID and store it in a URL parameter

Use a fixed session ID for the entire user lifetime

A developer is reviewing code that uses `Runtime.exec()` to run a system command with user-supplied input. An attacker submits `; rm -rf /` as part of the input. Which attack is this, and what is the best mitigation?

Path traversal; validate the file path

SQL injection; use prepared statements

Command injection; avoid `Runtime.exec()` with user input and use an allow-list of commands

A development team is fixing a stored XSS vulnerability in a comment feature. They must choose between (A) encoding output on the server side, or (B) sanitizing input with a library. The application also supports rich text formatting (bold, links) in comments. Which approach is more appropriate?

Client-side JavaScript encoding before submission

Server-side output encoding only, which will strip all HTML tags

Input sanitization with an allowlist of safe HTML tags and attributes

Disable all HTML rendering and display plain text

A Java application uses a third-party library that is known to be vulnerable to deserialization attacks. The library is widely used across the application, and replacing it would require significant refactoring. The security team must decide on a mitigation strategy. Which approach is most appropriate?

Implement a global input validation filter that blocks serialized data

Apply a security patch or upgrade to a patched version of the library

Disable deserialization entirely in the application

Use a WAF to block deserialization payloads

A Java application processes XML from untrusted sources. The team must choose between two mitigations: (A) disable DTDs entirely, or (B) allow DTDs but block external entities. The application has a legacy feature that relies on internal DTD subsets for validation. Which option best balances security and functionality?

Switch to a different XML parser that ignores DTDs by default

Disable DTDs entirely, breaking the legacy feature

Allow DTDs but disable external entities and external DTDs

Keep current parser settings and add a WAF rule to block XML payloads

EC-CouncilCertified Application Security Engineer (Java)

Domain 1Objective 2

Most Common Application-Level Attacks CASEJAVA Practice Questions (Page 6)

Part of the Application Security Foundations domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

5concepts

Questions 26–30

26expert · hard
A development team is building a public-facing Java web application that will handle sensitive user data. They must decide on a session management strategy to prevent session hijacking and fixation. Which combination of controls is most effective?
Select an answer first
27application · medium
A developer is reviewing code that uses `Runtime.exec()` to run a system command with user-supplied input. An attacker submits `; rm -rf /` as part of the input. Which attack is this, and what is the best mitigation?
Select an answer first
28expert · hard
A development team is fixing a stored XSS vulnerability in a comment feature. They must choose between (A) encoding output on the server side, or (B) sanitizing input with a library. The application also supports rich text formatting (bold, links) in comments. Which approach is more appropriate?
Select an answer first
29expert · hard
A Java application uses a third-party library that is known to be vulnerable to deserialization attacks. The library is widely used across the application, and replacing it would require significant refactoring. The security team must decide on a mitigation strategy. Which approach is most appropriate?
Select an answer first
30expert · hard
A Java application processes XML from untrusted sources. The team must choose between two mitigations: (A) disable DTDs entirely, or (B) allow DTDs but block external entities. The application has a legacy feature that relies on internal DTD subsets for validation. Which option best balances security and functionality?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Most Common Application-Level Attacks CASEJAVA Practice Questions (Page 6)

Questions 26–30

A development team is building a public-facing Java web application that will handle sensitive user data. They must decide on a session management strategy to prevent session hijacking and fixation. Which combination of controls is most effective?

A developer is reviewing code that uses `Runtime.exec()` to run a system command with user-supplied input. An attacker submits `; rm -rf /` as part of the input. Which attack is this, and what is the best mitigation?

A development team is fixing a stored XSS vulnerability in a comment feature. They must choose between (A) encoding output on the server side, or (B) sanitizing input with a library. The application also supports rich text formatting (bold, links) in comments. Which approach is more appropriate?

Keep studying — Application Security Foundations