An application exposes a debugging endpoint that shows system properties and environment variables. This endpoint is accessible without authentication. Which attack surface reduction technique should be applied?

Remove or disable the debugging endpoint in production

Rate-limit requests to the endpoint

Move the endpoint to a different URL

Add more logging to the endpoint

A Java web application has a login form that is vulnerable to brute-force attacks. The team wants to implement a control that balances security and user experience. Which control is most appropriate?

Use CAPTCHA on every login attempt

Implement progressive delay with exponential backoff after failed attempts

Disable the login form and use only SSO

Implement account lockout after a small number of failed attempts

A Java web application is being redesigned. The security team wants to implement defense in depth. They have already implemented input validation and output encoding. Which additional control would best complement these to provide a layered defense against XSS?

Content Security Policy (CSP) header

EC-CouncilCertified Application Security Engineer (Java)

Domain 1Objective 1

Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 3)

Part of the Application Security Foundations domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 11–15

11expert · medium
A Java web application uses a session management mechanism that generates session IDs using a predictable algorithm. An attacker can predict the session ID of a legitimate user and impersonate them. Which attack vector is being exploited?
Select an answer first
12expert · medium
A Java web application has an API endpoint that allows users to retrieve their own profile information. The endpoint uses the user ID from the session to query the database. However, a security review finds that the endpoint also accepts a user ID parameter from the request, which overrides the session value. Which attack is this vulnerability most likely to enable?
Select an answer first
13application · medium
An application exposes a debugging endpoint that shows system properties and environment variables. This endpoint is accessible without authentication. Which attack surface reduction technique should be applied?
Select an answer first
14expert · hard
A Java web application has a login form that is vulnerable to brute-force attacks. The team wants to implement a control that balances security and user experience. Which control is most appropriate?
Select an answer first
15expert · medium
A Java web application is being redesigned. The security team wants to implement defense in depth. They have already implemented input validation and output encoding. Which additional control would best complement these to provide a layered defense against XSS?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 3)

Questions 11–15

A Java web application uses a session management mechanism that generates session IDs using a predictable algorithm. An attacker can predict the session ID of a legitimate user and impersonate them. Which attack vector is being exploited?

An application exposes a debugging endpoint that shows system properties and environment variables. This endpoint is accessible without authentication. Which attack surface reduction technique should be applied?

A Java web application has a login form that is vulnerable to brute-force attacks. The team wants to implement a control that balances security and user experience. Which control is most appropriate?

A Java web application is being redesigned. The security team wants to implement defense in depth. They have already implemented input validation and output encoding. Which additional control would best complement these to provide a layered defense against XSS?

Keep studying — Application Security Foundations