What is the purpose of operational monitoring in a secure deployment?

To improve the user interface of the application

To detect and respond to security incidents in a timely manner

To automate the deployment process

To reduce the need for security testing

A Java-based customer portal allows users to view their own orders. The design team proposes a single 'Customer' role with full access to all order-related endpoints, arguing that the UI hides unauthorized data. As the security architect, which design change best aligns with secure design principles?

Use a shared service account for all database queries and filter results in the presentation layer.

Rely on the UI to hide unauthorized orders and add client-side JavaScript validation to prevent users from viewing other orders.

Create a separate 'Admin' role that can access all orders, and keep the 'Customer' role with no authorization checks.

Add an authorization check in each service method that verifies the authenticated user owns the requested order before returning data.

A business requirement states: 'The application must allow users to log in using their corporate credentials.' Which security requirement should be derived to ensure secure authentication?

The application must integrate with the corporate identity provider using SAML 2.0 or OIDC.

The application must store user passwords in a database.

The application must allow users to change their passwords frequently.

The application must display a login form to users.

A business requirement states: 'Users must be able to recover their password via email.' As a security analyst, you need to derive a testable security requirement. Which statement is the most testable and traceable?

Users must be able to reset their password without any security questions.

The password reset process must be easy for users to complete.

The password reset link must expire within 30 minutes and can only be used once.

The system should send a password reset email to the user.

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 2

Secure Application Design and Architecture CASEJAVA Practice Questions (Page 6)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 26–30

26foundation · easy
What is the purpose of operational monitoring in a secure deployment?
Select an answer first
27application · medium
A Java-based customer portal allows users to view their own orders. The design team proposes a single 'Customer' role with full access to all order-related endpoints, arguing that the UI hides unauthorized data. As the security architect, which design change best aligns with secure design principles?
Select an answer first
28application · medium
A business requirement states: 'The application must allow users to log in using their corporate credentials.' Which security requirement should be derived to ensure secure authentication?
Select an answer first
29application · medium
A business requirement states: 'Users must be able to recover their password via email.' As a security analyst, you need to derive a testable security requirement. Which statement is the most testable and traceable?
Select an answer first
30foundation · easy
A security analyst is using a threat modeling approach that assigns ratings to threats based on Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. Which methodology is being used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Secure Application Design and Architecture CASEJAVA Practice Questions (Page 6)

Questions 26–30

What is the purpose of operational monitoring in a secure deployment?

A business requirement states: 'The application must allow users to log in using their corporate credentials.' Which security requirement should be derived to ensure secure authentication?

A business requirement states: 'Users must be able to recover their password via email.' As a security analyst, you need to derive a testable security requirement. Which statement is the most testable and traceable?

A security analyst is using a threat modeling approach that assigns ratings to threats based on Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability. Which methodology is being used?

Keep studying — Security Requirements and Secure Design