A Java application is deployed using a CI/CD pipeline. The security team wants to ensure that security checks are integrated into the pipeline without slowing down development significantly. Which of the following approaches best balances security and development speed?

Run static application security testing (SAST) on every commit and dynamic application security testing (DAST) on nightly builds.

Run all security tests manually before each release.

Run SAST only before release and skip DAST to save time.

Run DAST on every commit and SAST only before release.

During a security design review of a Java microservices architecture, the reviewer notices that each microservice has its own database and that service-to-service communication uses mutual TLS. However, the review also finds that all services share the same service account for database access. Which of the following is the most important finding to address?

The shared service account violates the principle of least privilege because any compromised service can access all databases.

Each microservice having its own database is a design flaw that should be consolidated.

The design review should focus on external threats, not internal service-to-service communication.

Mutual TLS is unnecessary because the services are on a private network.

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 2

Secure Application Design and Architecture CASEJAVA Practice Questions (Page 1)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 1–5

1expert · hard
A Java application is deployed using a CI/CD pipeline. The security team wants to ensure that security checks are integrated into the pipeline without slowing down development significantly. Which of the following approaches best balances security and development speed?
Select an answer first
2foundation · easy
An application displays a user's credit card number in a format like 'XXXX-XXXX-XXXX-1234'. Which data protection technique is being used?
Select an answer first
3foundation · easy
When integrating a third-party payment API, which security control is essential to ensure that only authorized requests are accepted?
Select an answer first
4application · medium
During a security design review of a Java microservices architecture, the reviewer notices that each microservice has its own database and that service-to-service communication uses mutual TLS. However, the review also finds that all services share the same service account for database access. Which of the following is the most important finding to address?
Select an answer first
5foundation · easy
A security architect is designing a new application and wants to ensure that each user account is granted only the permissions necessary to perform its job functions. Which security design principle is being applied?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Secure Application Design and Architecture CASEJAVA Practice Questions (Page 1)

Questions 1–5

A Java application is deployed using a CI/CD pipeline. The security team wants to ensure that security checks are integrated into the pipeline without slowing down development significantly. Which of the following approaches best balances security and development speed?

An application displays a user's credit card number in a format like 'XXXX-XXXX-XXXX-1234'. Which data protection technique is being used?

When integrating a third-party payment API, which security control is essential to ensure that only authorized requests are accepted?

A security architect is designing a new application and wants to ensure that each user account is granted only the permissions necessary to perform its job functions. Which security design principle is being applied?

Keep studying — Security Requirements and Secure Design