Why is application security important in the software development lifecycle?

It guarantees that the application will never be compromised by an attacker

It is only required for applications that handle financial data

It helps reduce the cost and impact of security vulnerabilities by addressing them early in development

It ensures that the application meets all functional requirements

What is the primary purpose of threat modeling in application security?

To write secure code by following coding standards

To perform penetration testing on a live application

To identify and prioritize potential threats and vulnerabilities in an application

To monitor application logs for suspicious activity

A Java web application accepts a product ID from a URL query parameter and uses it directly in a SQL query. During a threat modeling session, the team identifies this as a high-risk entry point. Which of the following is the most effective control to implement first?

Use prepared statements with parameterized queries

Add a Web Application Firewall (WAF) in front of the application

Validate the product ID against a whitelist of allowed characters

Encode the product ID using HTML entity encoding

EC-CouncilCertified Application Security Engineer (Java)

Domain 1Objective 1

Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 2)

Part of the Application Security Foundations domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 6–10

6application · easy
A security team is using STRIDE to threat model a new Java microservice. Which of the following is a STRIDE threat category?
Select an answer first
7application · easy
A security analyst is mapping the attack surface of a Java application. Which of the following is an example of an attack surface entry point?
Select an answer first
8foundation · easy
Why is application security important in the software development lifecycle?
Select an answer first
9foundation · easy
What is the primary purpose of threat modeling in application security?
Select an answer first
10application · medium
A Java web application accepts a product ID from a URL query parameter and uses it directly in a SQL query. During a threat modeling session, the team identifies this as a high-risk entry point. Which of the following is the most effective control to implement first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 2)

Questions 6–10

A security team is using STRIDE to threat model a new Java microservice. Which of the following is a STRIDE threat category?

A security analyst is mapping the attack surface of a Java application. Which of the following is an example of an attack surface entry point?

Why is application security important in the software development lifecycle?

What is the primary purpose of threat modeling in application security?

A Java web application accepts a product ID from a URL query parameter and uses it directly in a SQL query. During a threat modeling session, the team identifies this as a high-risk entry point. Which of the following is the most effective control to implement first?

Keep studying — Application Security Foundations