Which mitigation strategy is most appropriate for a threat involving spoofing of user identities?

Use logging and monitoring to detect unauthorized access

Use encryption to protect data in transit

Implement strong authentication mechanisms such as multi-factor authentication

Implement input validation to prevent injection attacks

Which mitigation strategy is most effective against tampering threats to data in transit?

Using TLS to encrypt and integrity-protect the data

Using a web application firewall (WAF)

Implementing role-based access control

Adding input validation on the server side

After completing a threat model for a Java application, the security team needs to communicate the findings to non-technical stakeholders, including business executives. What is the most effective way to present the threat model results?

Provide a summary that maps threats to business impact and recommended mitigations.

Share the full data flow diagram and all technical details.

Only list the threats with their STRIDE categories.

Send the raw threat model document without any summary.

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 3

Threat Modeling CASEJAVA Practice Questions (Page 1)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 1–5

1foundation · easy
Which threat modeling methodology focuses on the business impact and provides a risk-centric approach with a seven-step process?
Select an answer first
2foundation · easy
Which mitigation strategy is most appropriate for a threat involving spoofing of user identities?
Select an answer first
3foundation · easy
Which mitigation strategy is most effective against tampering threats to data in transit?
Select an answer first
4application · medium
After completing a threat model for a Java application, the security team needs to communicate the findings to non-technical stakeholders, including business executives. What is the most effective way to present the threat model results?
Select an answer first
5foundation · easy
In the STRIDE model, what does the 'S' stand for?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Threat Modeling CASEJAVA Practice Questions (Page 1)

Questions 1–5

Which threat modeling methodology focuses on the business impact and provides a risk-centric approach with a seven-step process?

Which mitigation strategy is most appropriate for a threat involving spoofing of user identities?

Which mitigation strategy is most effective against tampering threats to data in transit?

After completing a threat model for a Java application, the security team needs to communicate the findings to non-technical stakeholders, including business executives. What is the most effective way to present the threat model results?

In the STRIDE model, what does the 'S' stand for?

Keep studying — Security Requirements and Secure Design