A financial application processes sensitive transactions. A security audit reveals that the application is vulnerable to both CSRF and stored XSS. The team must prioritize fixes due to limited resources. Which attack should be addressed first, considering the potential impact on confidentiality, integrity, and availability?

Neither, because they are low-risk for a financial application

Both equally, because they have the same impact

CSRF, because it directly modifies financial data without user interaction

Stored XSS, because it can steal session tokens and lead to full account compromise

An attacker sends a request to a Java servlet that includes a 'Role' header set to 'admin'. The servlet checks the header to determine authorization. Which vulnerability is being exploited, and what is the root cause?

SQL injection; lack of parameterized queries

Cross-site scripting; lack of output encoding

Broken Access Control; trusting client-supplied data for authorization decisions

Which of the following is the most effective general mitigation against SQL injection?

Using prepared statements with parameterized queries

Storing passwords as plaintext for easier debugging

Disabling client-side JavaScript

Using HTTPS for all communications

A financial application accepts a serialized Java object from a cookie to store user preferences. An attacker modifies the cookie to include a malicious gadget chain, and the server deserializes it, leading to remote code execution. Which vulnerability class does this attack belong to, and what is the most direct impact?

Security Misconfiguration; availability loss only

Broken Access Control; confidentiality breach

Insecure Deserialization; complete compromise of confidentiality, integrity, and availability

Injection; integrity loss due to modified data

A team is hardening a Java web application that allows users to upload profile images. They want to prevent attackers from uploading malicious files that could be executed on the server. Which combination of controls is most effective?

Rely on client-side JavaScript to check file type before upload

Validate file content, use a whitelist of MIME types, and serve files from a separate domain with Content-Disposition

Allow only image extensions and store files outside the web root

Store files in a database as BLOBs and retrieve them with a servlet that sets no headers

EC-CouncilCertified Application Security Engineer (Java)

Domain 1Objective 2

Most Common Application-Level Attacks CASEJAVA Practice Questions (Page 9)

Part of the Application Security Foundations domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 48 practice questions to prepare you well beyond it. (estimate)

48questions here

10free pages

5concepts

Questions 41–45

41expert · hard
A financial application processes sensitive transactions. A security audit reveals that the application is vulnerable to both CSRF and stored XSS. The team must prioritize fixes due to limited resources. Which attack should be addressed first, considering the potential impact on confidentiality, integrity, and availability?
Select an answer first
42application · medium
An attacker sends a request to a Java servlet that includes a 'Role' header set to 'admin'. The servlet checks the header to determine authorization. Which vulnerability is being exploited, and what is the root cause?
Select an answer first
43foundation · easy
Which of the following is the most effective general mitigation against SQL injection?
Select an answer first
44application · medium
A financial application accepts a serialized Java object from a cookie to store user preferences. An attacker modifies the cookie to include a malicious gadget chain, and the server deserializes it, leading to remote code execution. Which vulnerability class does this attack belong to, and what is the most direct impact?
Select an answer first
45application · medium
A team is hardening a Java web application that allows users to upload profile images. They want to prevent attackers from uploading malicious files that could be executed on the server. Which combination of controls is most effective?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Most Common Application-Level Attacks CASEJAVA Practice Questions (Page 9)

Questions 41–45

An attacker sends a request to a Java servlet that includes a 'Role' header set to 'admin'. The servlet checks the header to determine authorization. Which vulnerability is being exploited, and what is the root cause?

Which of the following is the most effective general mitigation against SQL injection?

A team is hardening a Java web application that allows users to upload profile images. They want to prevent attackers from uploading malicious files that could be executed on the server. Which combination of controls is most effective?

Keep studying — Application Security Foundations