When displaying an error message for invalid input, what should be avoided?

Using a consistent error format

Logging the error on the server side

Providing a generic message like 'Invalid input format'

Including the exact input value in the error message

A Java application has a search feature that accepts a 'q' parameter. The search is performed against a database using a LIKE query. The team wants to prevent SQL injection while allowing users to search for any text. Which approach is most appropriate?

Use a blacklist to remove SQL keywords from the input.

Use a whitelist that only allows alphanumeric characters.

Escape single quotes in the input and concatenate it into the query.

Use a prepared statement with the search term as a bound parameter.

What is the primary purpose of input validation in a Java application?

To encrypt all data transmitted between client and server

To automatically fix any incorrect data entered by users

To ensure that all user input is stored in a database

To prevent malicious or malformed data from causing security vulnerabilities or data corruption

A Java application has a legacy module that uses SimpleDateFormat to parse user-supplied dates. The module is single-threaded, but the team plans to make it multi-threaded. They also need to reject invalid dates like 2023-02-30. What is the best approach?

Create a new SimpleDateFormat instance for each thread.

Replace SimpleDateFormat with LocalDate.parse() and catch DateTimeParseException.

Use a regex to validate the date format and then parse with SimpleDateFormat.

Keep using SimpleDateFormat but synchronize access to it.

What is the recommended way to handle invalid input in a Java web application?

Catch the exception, log the error, and return a user-friendly error message

Ignore the invalid input and continue processing

Automatically modify the input to make it valid

Throw a generic exception and let the application crash

EC-CouncilCertified Application Security Engineer (Java)

Domain 3Objective 2

Secure Coding Practices for Input Validation in Java CASEJAVA Practice Questions (Page 2)

Part of the Secure Coding: Input Validation domain, which makes up ~9% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~5–7 in this domain), expect 3–4 from this objective — we provide 35 practice questions to prepare you well beyond it. (estimate)

35questions here

7free pages

6concepts

Questions 6–10

6foundation · easy
When displaying an error message for invalid input, what should be avoided?
Select an answer first
7application · medium
A Java application has a search feature that accepts a 'q' parameter. The search is performed against a database using a LIKE query. The team wants to prevent SQL injection while allowing users to search for any text. Which approach is most appropriate?
Select an answer first
8foundation · easy
What is the primary purpose of input validation in a Java application?
Select an answer first
9expert · hard
A Java application has a legacy module that uses SimpleDateFormat to parse user-supplied dates. The module is single-threaded, but the team plans to make it multi-threaded. They also need to reject invalid dates like 2023-02-30. What is the best approach?
Select an answer first
10foundation · easy
What is the recommended way to handle invalid input in a Java web application?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.