A Java application integrates with a third-party REST API to retrieve customer data. The integration must ensure that the API key is protected and that the data exchanged is encrypted. Which design approach best meets these requirements?

Store the API key in a secure vault and use TLS for all communication with the third-party API.

Embed the API key in the application code and rely on HTTPS for security.

Use a shared API key for all customers and encrypt the data at rest only.

Transmit the API key in the URL query string and use HTTP for simplicity.

During a security design review of a Java application, the team discovers that the application uses a single shared database account with full administrative privileges for all queries. Which recommendation best addresses the identified risk?

Encrypt the database connection string to protect the shared credentials.

Keep the shared account but restrict access to the database server by IP address.

Create separate database accounts with the least privileges required for each application function.

Use the shared account only for read operations and create a new admin account for writes.

A Java application is deployed to a production environment. The operations team wants to ensure that configuration files containing credentials are not exposed. Which deployment design control is most effective?

Use environment-specific configuration files stored outside the application's web root and restrict file permissions.

Use the same configuration file for all environments to simplify deployment.

Place configuration files in the web root for easy access by the application.

Embed credentials in the application's JAR file to keep them internal.

What is a key security consideration when designing session management?

Storing session identifiers in the URL

Generating session identifiers with sufficient entropy

Using predictable session identifiers

Setting a long session timeout to keep users logged in

Why should error messages shown to users not contain detailed stack traces or database queries?

To reduce the size of the error messages

To make the error messages more user-friendly

To prevent information leakage that could aid an attacker

To comply with accessibility standards

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 2

Secure Application Design and Architecture CASEJAVA Practice Questions (Page 5)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 21–25

21application · medium
A Java application integrates with a third-party REST API to retrieve customer data. The integration must ensure that the API key is protected and that the data exchanged is encrypted. Which design approach best meets these requirements?
Select an answer first
22application · medium
During a security design review of a Java application, the team discovers that the application uses a single shared database account with full administrative privileges for all queries. Which recommendation best addresses the identified risk?
Select an answer first
23application · medium
A Java application is deployed to a production environment. The operations team wants to ensure that configuration files containing credentials are not exposed. Which deployment design control is most effective?
Select an answer first
24foundation · easy
What is a key security consideration when designing session management?
Select an answer first
25foundation · easy
Why should error messages shown to users not contain detailed stack traces or database queries?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.