A Java application is deployed on a WebLogic server. A new critical patch is released by the vendor. The change advisory board requires that the patch be tested in a staging environment before production deployment. However, the staging environment is not an exact replica of production, and the application has a complex dependency tree. What is the best approach to minimize the risk of the patch causing issues in production?

Test the patch in staging, then apply it to production during the next maintenance window with a rollback plan

Apply the patch to production directly and monitor for issues, as testing in a non-identical staging environment is unreliable

Apply the patch to production and immediately run a full regression test suite

Skip the patch and wait for the next major release, as minor patches are not worth the risk

Which practice is a key element of secure configuration during the deployment of a Java application?

Disabling unnecessary features and services on the application server

Storing database credentials in plain text within the application's configuration file

Enabling directory listing on the web server to simplify troubleshooting

Using default administrator passwords for the application server

Which maintenance activity directly helps preserve the security posture of a deployed Java application?

Granting all developers administrative access to the production server

Regularly reviewing and updating firewall rules to allow only necessary traffic

Disabling the application's authentication to simplify user access

Increasing the application's logging level to DEBUG permanently

A Java application server has multiple configuration files that contain sensitive settings. The security team wants to ensure that any unauthorized change is detected. Which practice should be implemented?

Make the configuration files read-only for all users, including the application service account.

Store configuration files in a shared network location with no access controls.

Review the configuration files manually every year.

Use a file integrity monitoring tool to alert on changes to the configuration files.

A Java application is suspected of being compromised. The incident response team needs to determine the scope of the breach. Which action is most important to perform first?

Collect and preserve logs and forensic data from the affected systems.

Restore the application from backup to resume service quickly.

Immediately shut down all affected systems to stop the attack.

Notify all customers about the potential breach.

EC-CouncilCertified Application Security Engineer (Java)

Domain 8Objective 2

Secure Deployment and Maintenance CASEJAVA Practice Questions (Page 2)

Part of the Security Testing and Secure Deployment domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 3–5 from this objective — we provide 36 practice questions to prepare you well beyond it. (estimate)

36questions here

8free pages

7concepts

Questions 6–10

6application · medium
A Java application is deployed on a WebLogic server. A new critical patch is released by the vendor. The change advisory board requires that the patch be tested in a staging environment before production deployment. However, the staging environment is not an exact replica of production, and the application has a complex dependency tree. What is the best approach to minimize the risk of the patch causing issues in production?
Select an answer first
7foundation · easy
Which practice is a key element of secure configuration during the deployment of a Java application?
Select an answer first
8foundation · easy
Which maintenance activity directly helps preserve the security posture of a deployed Java application?
Select an answer first
9application · medium
A Java application server has multiple configuration files that contain sensitive settings. The security team wants to ensure that any unauthorized change is detected. Which practice should be implemented?
Select an answer first
10expert · hard
A Java application is suspected of being compromised. The incident response team needs to determine the scope of the breach. Which action is most important to perform first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.