What is the primary purpose of application security in the software development lifecycle?

To ensure that applications are free of all possible vulnerabilities before release

To replace functional testing with security testing to save time

To perform a single security review after the application is fully developed

To identify, fix, and prevent security vulnerabilities throughout the design, development, deployment, and maintenance phases

A security analyst is performing a risk assessment for a Java web application. They identify a vulnerability that allows an attacker to read the database credentials from the application's configuration file. The likelihood of exploitation is low because the configuration file is not publicly accessible, but the impact is high because the credentials would allow full database access. How should this risk be prioritized?

Defer the risk assessment until the vulnerability is exploited

Medium priority because the likelihood is low but the impact is high

High priority because the impact is high

Low priority because the likelihood is low

A Java application uses a shared database account with broad privileges. The team wants to reduce the risk of SQL injection. Which approach best applies the principle of least privilege?

Create separate database accounts with only the necessary permissions for each application function

Add a WAF to block SQL injection attempts

Use a single account but restrict it to read-only access

Encrypt all data in the database

What is the attack surface of an application?

The list of all users who have access to the application

The number of security vulnerabilities found in the application

The sum of all entry points through which an attacker can interact with the application

The total number of lines of code in the application

A Java web application allows users to submit comments that are displayed to other users without any sanitization. An attacker posts a comment containing a malicious script. What type of attack is this?

Cross-Site Request Forgery (CSRF)

EC-CouncilCertified Application Security Engineer (Java)

Domain 1Objective 1

Understanding Application Security, Threats, and Attacks CASEJAVA Practice Questions (Page 8)

Part of the Application Security Foundations domain, which makes up ~14% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 2–4 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

6concepts

Questions 36–40

36foundation · easy
What is the primary purpose of application security in the software development lifecycle?
Select an answer first
37application · medium
A security analyst is performing a risk assessment for a Java web application. They identify a vulnerability that allows an attacker to read the database credentials from the application's configuration file. The likelihood of exploitation is low because the configuration file is not publicly accessible, but the impact is high because the credentials would allow full database access. How should this risk be prioritized?
Select an answer first
38expert · hard
A Java application uses a shared database account with broad privileges. The team wants to reduce the risk of SQL injection. Which approach best applies the principle of least privilege?
Select an answer first
39foundation · easy
What is the attack surface of an application?
Select an answer first
40application · easy
A Java web application allows users to submit comments that are displayed to other users without any sanitization. An attacker posts a comment containing a malicious script. What type of attack is this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASEJAVA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASEJAVA” is a trademark of its owner, used for identification only.