A team is creating a data flow diagram (DFD) for a Java application that allows users to upload and share documents. The application uses an S3 bucket for storage and a separate authentication service. Which element should be identified as an entry point in the DFD?

The authentication service's user database

The internal network between the application and the S3 bucket

The S3 bucket where documents are stored

The document upload HTTP endpoint

A team is reviewing a data flow diagram (DFD) for a Java application that processes credit card payments. The DFD shows a process 'Payment Processor' that receives data from a 'User Browser' and sends data to a 'Payment Gateway'. Which element in the DFD is most likely to be a trust boundary?

Between the Payment Processor and the Payment Gateway

Inside the Payment Processor process

Between the User Browser and the Payment Processor

Which of the following is an example of a trust boundary in a typical web application?

The point where the web server passes data to the application server

The application's logging mechanism

The database connection string used by the application

The boundary between the user's browser and the web server

A security analyst is using attack trees to model threats to a Java application's authentication mechanism. The root goal is 'Attacker gains access to a user account.' Which of the following is a valid child node for this attack tree?

Brute-force the user's password

Encrypt the user's password in transit

Log all authentication attempts

Implement multi-factor authentication

Which statement best describes a key benefit of integrating threat modeling into the secure software development lifecycle?

It replaces the need for security requirements gathering in the early phases

It eliminates the need for security testing during the later phases of development

It guarantees that the application will be free of all security vulnerabilities

It helps developers understand the system's attack surface and design mitigations before code is written

EC-CouncilCertified Application Security Engineer (Java)

Domain 2Objective 3

Threat Modeling CASEJAVA Practice Questions (Page 5)

Part of the Security Requirements and Secure Design domain, which makes up ~19% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–15 in this domain), expect 3–5 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

9concepts

Questions 21–25

21application · medium
A team is creating a data flow diagram (DFD) for a Java application that allows users to upload and share documents. The application uses an S3 bucket for storage and a separate authentication service. Which element should be identified as an entry point in the DFD?
Select an answer first
22application · medium
A team is reviewing a data flow diagram (DFD) for a Java application that processes credit card payments. The DFD shows a process 'Payment Processor' that receives data from a 'User Browser' and sends data to a 'Payment Gateway'. Which element in the DFD is most likely to be a trust boundary?
Select an answer first
23foundation · easy
Which of the following is an example of a trust boundary in a typical web application?
Select an answer first
24application · medium
A security analyst is using attack trees to model threats to a Java application's authentication mechanism. The root goal is 'Attacker gains access to a user account.' Which of the following is a valid child node for this attack tree?
Select an answer first
25foundation · easy
Which statement best describes a key benefit of integrating threat modeling into the secure software development lifecycle?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.