During a security design review, which of the following is a key activity?

Reviewing the architecture for compliance with security standards

Installing security patches on servers

Writing code for the application

Running penetration tests against the production environment

A Java application is being designed with a global error handler that returns error messages to users. The security team wants to prevent information leakage while still supporting auditability. Which design is most appropriate?

Return generic error messages to users and log detailed error information, including stack traces, in a secure log with restricted access.

Disable all error logging to avoid storing sensitive information.

Log only the error message without any context to protect user privacy.

Return the full stack trace to users to help them understand the error.

A Java application's error handling currently returns detailed stack traces to users. The security review recommends a change. Which approach best balances usability and security?

Show the same generic error to users and log nothing.

Log detailed errors server-side and return generic error messages to users.

Return the full stack trace to users to help them report issues.

Disable all error logging to prevent sensitive data from being stored.

What is a best practice for logging security-relevant events?

Log only successful events to reduce noise.

Log all user input, including passwords, for debugging purposes.

Include sufficient detail to support auditability without logging sensitive data.

Store logs in a publicly accessible location for transparency.

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 2

Secure Application Design and Architecture CASEJAVA Practice Questions (Page 8)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 52 practice questions to prepare you well beyond it. (estimate)

52questions here

11free pages

10concepts

Questions 36–40

36foundation · easy
During a security design review, which of the following is a key activity?
Select an answer first
37application · medium
A Java application is being designed with a global error handler that returns error messages to users. The security team wants to prevent information leakage while still supporting auditability. Which design is most appropriate?
Select an answer first
38application · medium
A Java application's error handling currently returns detailed stack traces to users. The security review recommends a change. Which approach best balances usability and security?
Select an answer first
39foundation · easy
What is a best practice for logging security-relevant events?
Select an answer first
40foundation · easy
Which data protection mechanism is used to protect sensitive data at rest in a database?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.