A Java application stores credit card numbers and must comply with PCI DSS. The design team proposes encrypting all credit card numbers with a single static key stored in the application's configuration file. Which design change is most appropriate?

Encrypt the credit card numbers with a key derived from the user's password.

Use a key management service (KMS) with key rotation and separate keys for production and non-production environments.

Use a hardcoded key in the source code for simplicity.

Store the key in a plaintext file in the application's home directory.

Which of the following is a best practice for securely integrating a third-party component?

Trust the component by default and skip security checks.

Use the component's default credentials for simplicity.

Disable all security controls to improve performance.

Validate and sanitize all data received from the component.

A Java-based e-commerce application is being designed. The business requires that customers can browse products without logging in, but must authenticate to place an order. The security team wants to ensure that even if the web tier is compromised, the database credentials cannot be used to directly access the customer database. Which combination of design decisions best satisfies these requirements?

Implement a public browse mode with anonymous sessions, require login only at checkout, and store database credentials in a separate secrets vault accessed only by the service tier.

Allow anonymous browsing but store database credentials in the web tier's environment variables so they are not in code.

Use a single shared database account for all tiers and rely on network firewalls to protect the database.

Require login for all pages, including browsing, and store database credentials in the web tier's configuration file for simplicity.

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 2

Secure Application Design and Architecture CASEJAVA Practice Questions (Page 7)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 31–35

31foundation · easy
A threat modeling team is categorizing threats based on Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Which threat modeling methodology are they using?
Select an answer first
32expert · hard
A Java application stores credit card numbers and must comply with PCI DSS. The design team proposes encrypting all credit card numbers with a single static key stored in the application's configuration file. Which design change is most appropriate?
Select an answer first
33foundation · easy
Which of the following is a best practice for securely integrating a third-party component?
Select an answer first
34application · medium
A Java-based e-commerce application is being designed. The business requires that customers can browse products without logging in, but must authenticate to place an order. The security team wants to ensure that even if the web tier is compromised, the database credentials cannot be used to directly access the customer database. Which combination of design decisions best satisfies these requirements?
Select an answer first
35foundation · easy
Which secure architecture pattern ensures that data transmitted between a client and a server is protected from eavesdropping and tampering?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Secure Application Design and Architecture CASEJAVA Practice Questions (Page 7)

Questions 31–35

A threat modeling team is categorizing threats based on Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. Which threat modeling methodology are they using?

A Java application stores credit card numbers and must comply with PCI DSS. The design team proposes encrypting all credit card numbers with a single static key stored in the application's configuration file. Which design change is most appropriate?

Which of the following is a best practice for securely integrating a third-party component?

Which secure architecture pattern ensures that data transmitted between a client and a server is protected from eavesdropping and tampering?

Keep studying — Security Requirements and Secure Design