A team has an abuse case where an attacker can brute-force user passwords. They need to define a security use case. The application must support legacy users who cannot use multi-factor authentication (MFA). Which security use case best mitigates the abuse case while accommodating legacy users?

Disable password authentication entirely and use single sign-on (SSO).

Implement account lockout after a number of failed attempts, with a lockout duration and a way to unlock via email.

Require MFA for all users, including legacy users.

Log all login attempts and review them monthly.

A team is deriving security use cases from an abuse case where an attacker performs a man-in-the-middle attack on a web application's login process. Which security use case best mitigates this specific abuse case?

The system shall enforce HTTPS with a valid certificate and use HSTS to prevent protocol downgrade.

The system shall display the last login time to the user.

The system shall lock the account after five failed login attempts.

The system shall require a minimum password length of 12 characters.

A team has identified an abuse case where an attacker can perform a denial-of-service by sending many requests to a public API. They need to define a security use case. Which option is the most direct security use case?

The system must log all API requests and responses.

The system must rate-limit requests per API key and IP address.

The system must require users to complete a CAPTCHA for every request.

The system must use a content delivery network (CDN) to cache responses.

An organization is adopting a secure SDLC and wants to ensure that abuse cases and security use cases are not just documentation artifacts. The security team plans to integrate them into the development process. Which action best achieves this integration?

Create a comprehensive security requirements document and store it in the project's wiki for reference.

Require the security team to sign off on the design after the architecture is complete.

Add security use cases as acceptance criteria for user stories and include abuse cases in threat modeling sessions during each sprint.

Use abuse cases to generate test data for the QA team to use in manual testing.

Why is it important to integrate abuse and security use cases into the overall system design?

To eliminate the need for security testing

To satisfy regulatory compliance without any additional effort

To document the system's performance metrics

To ensure that security requirements are addressed as part of the system's functional behavior

EC-CouncilCertified Application Security Engineer (.NET)

Domain 2Objective 2

Abuse Case and Security Use Case Modeling CASENET Practice Questions (Page 2)

Part of the Security Requirements and Secure Design domain, which makes up ~21% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~11–17 in this domain), expect 2–2 from this objective — we provide 46 practice questions to prepare you well beyond it. (estimate)

46questions here

10free pages

7concepts

Questions 6–10

6expert · hard
A team has an abuse case where an attacker can brute-force user passwords. They need to define a security use case. The application must support legacy users who cannot use multi-factor authentication (MFA). Which security use case best mitigates the abuse case while accommodating legacy users?
Select an answer first
7application · medium
A team is deriving security use cases from an abuse case where an attacker performs a man-in-the-middle attack on a web application's login process. Which security use case best mitigates this specific abuse case?
Select an answer first
8application · medium
A team has identified an abuse case where an attacker can perform a denial-of-service by sending many requests to a public API. They need to define a security use case. Which option is the most direct security use case?
Select an answer first
9application · medium
An organization is adopting a secure SDLC and wants to ensure that abuse cases and security use cases are not just documentation artifacts. The security team plans to integrate them into the development process. Which action best achieves this integration?
Select an answer first
10foundation · easy
Why is it important to integrate abuse and security use cases into the overall system design?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.