Which attack vector occurs when an attacker tricks a user's browser into sending an unwanted request to a web application in which the user is authenticated?

Cross-Site Request Forgery (CSRF)

A Java application has a large attack surface due to many legacy endpoints. The team wants to reduce risk without breaking existing clients. Which approach is most effective?

Immediately remove all legacy endpoints

Gradually deprecate and remove unused endpoints while adding authentication to remaining ones

Keep all endpoints but add a WAF

Move all endpoints to a new domain

A software development team is adopting a new SDLC process. They want to integrate security activities early in the lifecycle to reduce the cost and impact of vulnerabilities. Which approach best reflects the importance of application security in the SDLC?

Performing security testing only after the application is deployed

Using only automated security tools at the end of each sprint

Conducting threat modeling during the design phase and security code reviews during development

Relying solely on the security team to find vulnerabilities after release

EC-CouncilCertified Application Security Engineer (Java)

Domain 1Objective 1

Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 5)

Part of the Application Security Foundations domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 21–25

21foundation · easy
Which attack vector occurs when an attacker tricks a user's browser into sending an unwanted request to a web application in which the user is authenticated?
Select an answer first
22expert · hard
A Java application has a large attack surface due to many legacy endpoints. The team wants to reduce risk without breaking existing clients. Which approach is most effective?
Select an answer first
23foundation · easy
Which security principle states that a user or process should be granted only the minimum privileges necessary to perform its function?
Select an answer first
24application · easy
A threat modeling team is using the DREAD model to evaluate a Java application's risks. Which of the following is a DREAD rating category?
Select an answer first
25application · medium
A software development team is adopting a new SDLC process. They want to integrate security activities early in the lifecycle to reduce the cost and impact of vulnerabilities. Which approach best reflects the importance of application security in the SDLC?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 5)

Questions 21–25

Which attack vector occurs when an attacker tricks a user's browser into sending an unwanted request to a web application in which the user is authenticated?

A Java application has a large attack surface due to many legacy endpoints. The team wants to reduce risk without breaking existing clients. Which approach is most effective?

Which security principle states that a user or process should be granted only the minimum privileges necessary to perform its function?

A threat modeling team is using the DREAD model to evaluate a Java application's risks. Which of the following is a DREAD rating category?

A software development team is adopting a new SDLC process. They want to integrate security activities early in the lifecycle to reduce the cost and impact of vulnerabilities. Which approach best reflects the importance of application security in the SDLC?

Keep studying — Application Security Foundations