10 free EC-Council 312-96 CASE Java practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 49 questions. Work through them, then open each answer to check your reasoning.
Get all 49 questions (US$39) · Download these 10 as a PDF
Question 1
Sam, an application security engineer working in INFRA INC., was conducting a secure code review on an application developed in Java. He found that the developer has used a piece of code as shown in the following screenshot.
Identify the security mistakes that the developer has coded?
Show answer and explanation
Correct answer: D. He is attempting to use blacklist input validation approach
The code implements a blacklist validation approach by checking if the username contains any of a predefined list of dangerous strings ('<SCRIPT>', 'SELECT', 'UNION', 'WHERE', '</SCRIPT>', '>', '<'). Blacklist validation attempts to block known bad inputs rather than allowing only known good inputs. This is a weaker security approach because it can be bypassed through encoding, case variation, or novel attack vectors not included in the blacklist. The developer is explicitly listing dangerous patterns to reject, which is the defining characteristic of blacklist validation.
Why the other options are wrong
- A. This is server-side validation code written in Java (JSP), not client-side validation which would occur in the browser.
- B. Whitelist validation would allow only known good inputs; this code instead rejects known bad inputs, making it a blacklist approach.
- C. While the code contains string literals, it is not using regular expressions (regex patterns); it uses the String.contains() method for simple string matching.
Question 2
Identify the type of attack depicted in the following figure.
Show answer and explanation
Correct answer: C. Parameter Tampering Attack
The figure shows multiple browser windows with URLs where query parameters have been modified to change application behavior. In the first two examples, the 'debit' parameter values are changed (2500 and 1500), and in the last two examples, the 'status' parameter is altered (from 'view' to 'delete'). These modifications to URL parameters directly affect the server-side application logic without the user having proper authorization. This is characteristic of parameter tampering attacks, where an attacker manipulates request parameters to bypass security controls, modify data, or execute unauthorized actions. The attacker is directly changing values that should not be modifiable by the client side.
Why the other options are wrong
- A. SQL Injection attacks involve inserting malicious SQL code into input fields or parameters; these URLs show straightforward parameter value changes without any SQL syntax.
- B. Session Fixation attacks involve forcing a user to use a specific session ID; these examples show parameter manipulation within normal URL structures, not session ID manipulation.
- D. Denial-of-Service attacks aim to overwhelm resources and make services unavailable; these requests are attempting to modify application data and behavior, not to exhaust system resources.
Question 3
According to secure logging practices, programmers should ensure that logging processes are not disrupted by:
Show answer and explanation
Correct answer: D. Throwing incorrect exceptions
Secure logging processes should not be disrupted by throwing incorrect exceptions, as this can cause the logging mechanism itself to fail or behave unpredictably. Throwing exceptions during logging operations can prevent critical security events from being recorded. Catching, re-throwing, or catching multiple times are exception handling techniques that may be necessary for proper control flow, but throwing exceptions indiscriminately disrupts the logging process itself.
Why the other options are wrong
- A. Catching incorrect exceptions is a defensive programming practice that prevents disruption of logging.
- B. Multiple catching of incorrect exceptions, while redundant, does not inherently disrupt logging processes.
- C. Re-throwing exceptions can be part of proper exception handling and does not necessarily disrupt logging.
Question 4
Which of the threat classification model is used to classify threats during threat modeling process?
Show answer and explanation
Correct answer: B. STRIDE
STRIDE is the standard threat classification model used during the threat modeling process. It categorizes threats into six types: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. This model is widely adopted in secure development lifecycles for identifying and analyzing potential threats to system security.
Why the other options are wrong
- A. RED is not a recognized threat classification model for threat modeling.
- C. DREAD is a risk assessment model used for prioritizing threats, not the primary classification model.
- D. SMART is a goal-setting framework, not a threat classification model.
Question 5
Which line of the following example of Java Code can make application vulnerable to a session attack?
Show answer and explanation
Correct answer: C. Line No. 4
Line 4 sets the cookie's max age to 3600 seconds (1 hour) without setting the HttpOnly or Secure flags. The absence of the HttpOnly flag makes the session cookie vulnerable to cross-site scripting (XSS) attacks, as JavaScript can access the cookie value. The absence of the Secure flag means the cookie will be transmitted over unencrypted HTTP connections, exposing it to man-in-the-middle attacks. Additionally, no SameSite attribute is set, leaving the application vulnerable to cross-site request forgery (CSRF) attacks. These omissions represent critical session security vulnerabilities.
Why the other options are wrong
- A. Line 1 correctly declares the class as a servlet; the class declaration itself is not a vulnerability.
- B. Line 3 creates a cookie with a descriptive name and concatenates a value, which is not inherently vulnerable; the vulnerability lies in missing security attributes.
- D. Line 5 correctly adds the cookie to the response; adding the cookie itself is not the vulnerability, the issue is what security properties were or were not set on that cookie.
Question 6
Alice, a Server Administrator (Tomcat), wants to ensure that Tomcat can be shut down only by the user who owns the Tomcat process.
Select the appropriate setting of the CATALINA_HOME/conf in server.xml that will enable him to do so.
Show answer and explanation
Correct answer: C. < server port="-1" shutdown="SHUTDOWN" >
Setting the port to -1 disables the shutdown port entirely, preventing remote shutdown attempts. The shutdown attribute with a value like 'SHUTDOWN' defines the command string, but with port=-1, no remote connection can issue this command, ensuring only the process owner on the local system can shut down Tomcat. This is the most secure configuration for restricting shutdown privileges.
Why the other options are wrong
- A. An empty port attribute will use the default port, allowing remote shutdown attempts.
- B. While port=-1 disables the shutdown port, an empty shutdown attribute is incomplete and unclear.
- D. Port 8080 is typically used for HTTP traffic, not shutdown, and allows remote shutdown access.
Question 7
Which of the following method will help you check if DEBUG level is enabled?
Show answer and explanation
Correct answer: A. isDebugEnabled()
The isDebugEnabled() method is the standard logging API method used to check whether DEBUG level logging is currently enabled before performing debug logging operations. This follows Java naming conventions for boolean-checking methods and is implemented across major logging frameworks like Log4j and SLF4J.
Why the other options are wrong
- B. EnableDebug() uses incorrect camelCase formatting and is not a standard logging method.
- C. IsEnableDebug() uses incorrect naming convention (prefix 'Is' instead of 'is') and is not a standard method.
- D. DebugEnabled() lacks the 'is' prefix standard for boolean checking methods and is not recognized.
Question 8
Which of the following elements in web.xml file ensures that cookies will be transmitted over an encrypted channel?
Show answer and explanation
Correct answer: D. < connector SSLEnabled="true" / >
The connector element with SSLEnabled="true" ensures that cookies and all communications are transmitted over an encrypted SSL/TLS channel. This is the correct attribute and value for enabling SSL on a Tomcat connector to secure cookie transmission.
Why the other options are wrong
- A. IsSSLEnabled is not the correct attribute name for Tomcat connectors.
- B. EnableSSL is not the standard Tomcat attribute; the correct attribute is SSLEnabled.
- C. SSLEnabled="false" explicitly disables SSL, preventing encrypted transmission of cookies.
Question 9
In which phase of secure development lifecycle the threat modeling is performed?
Show answer and explanation
Correct answer: D. Design phase
Threat modeling is performed during the design phase of the secure development lifecycle. This early phase allows architects and developers to identify, analyze, and mitigate potential security threats before code is written, making it the most cost-effective time to address security issues.
Why the other options are wrong
- A. Coding phase is too late; threats should be identified before development begins.
- B. Testing phase occurs after implementation and allows only reactive fixes.
- C. Deployment phase is far too late to perform effective threat modeling and design changes.
Question 10
Identify the type of attack depicted in the figure below:
Show answer and explanation
Correct answer: B. Cross-Site Request Forgery (CSRF) attack
The diagram depicts a CSRF attack where an attacker sends a phishing email (step 3) to trick a legitimate user into making an unwanted request. The user has an active session with the trusted server (evidenced by the session cookie set in step 2), and when the user unknowingly requests a page from the malicious server (step 4), the browser automatically includes the valid session cookie, causing the trusted server to execute malicious code (step 6) under the user's authenticated context. This is the defining characteristic of CSRF: exploiting the user's existing trust relationship with a server to perform unauthorized actions.
Why the other options are wrong
- A. XSS attacks involve injecting malicious script into web pages viewed by users; this diagram shows exploitation of authentication trust, not script injection vulnerabilities.
- C. SQL injection attacks target database query manipulation through input fields; this attack focuses on session hijacking and request forgery, not database interaction.
- D. Denial-of-Service attacks aim to overwhelm servers with traffic; this attack executes malicious code on a trusted server using a legitimate user's session, not flooding the network.
That was 10 of 49.
The full EC-Council 312-96 CASE Java pack has all 49 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.