Which attack vector involves inserting malicious code into a query or command that is then executed by the application?

Cross-Site Request Forgery (CSRF)

A development team is starting a new Java project. Management wants to ensure security is considered throughout the SDLC. Which approach best aligns with application security fundamentals?

Perform a security review only after the application is deployed

Integrate security activities into each phase of the SDLC

Use only automated tools and skip manual review

Rely on the operations team to handle all security

A team is threat modeling a Java application that processes payment data. They have limited time and need to focus on the most critical threats. Which approach is most effective?

Use only DREAD and skip threat identification

Use STRIDE to identify all possible threats, then prioritize using DREAD

Rely on automated scanning tools only

Use only STRIDE and fix all identified threats

EC-CouncilCertified Application Security Engineer (Java)

Domain 1Objective 1

Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 7)

Part of the Application Security Foundations domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 31–35

31foundation · easy
Which attack vector involves inserting malicious code into a query or command that is then executed by the application?
Select an answer first
32application · medium
A Java application allows users to upload profile pictures. The application stores the files in a public directory and serves them directly. An attacker uploads a file with a .jsp extension containing malicious code. Which attack vector is most directly exploited?
Select an answer first
33application · medium
A development team is starting a new Java project. Management wants to ensure security is considered throughout the SDLC. Which approach best aligns with application security fundamentals?
Select an answer first
34expert · hard
A team is threat modeling a Java application that processes payment data. They have limited time and need to focus on the most critical threats. Which approach is most effective?
Select an answer first
35foundation · easy
Which of the following is a common threat modeling methodology?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.

Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 7)

Questions 31–35

Which attack vector involves inserting malicious code into a query or command that is then executed by the application?

A Java application allows users to upload profile pictures. The application stores the files in a public directory and serves them directly. An attacker uploads a file with a .jsp extension containing malicious code. Which attack vector is most directly exploited?

A development team is starting a new Java project. Management wants to ensure security is considered throughout the SDLC. Which approach best aligns with application security fundamentals?

A team is threat modeling a Java application that processes payment data. They have limited time and need to focus on the most critical threats. Which approach is most effective?

Which of the following is a common threat modeling methodology?

Keep studying — Application Security Foundations