EC-Council 312-96 CASE Java Exam Practice Questions
US$39
Every question with the correct answer and why the other options are wrong.
Card, Apple Pay, Google Pay or PayPal. Your PDF is prepared and emailed to you after checkout, usually within a few hours.
Three of the 49 questions in this pack
Question 1
Alice works as a Java developer in Fygo software Services Ltd. He is given the responsibility to design a bookstore website for one of their clients. This website is supposed to store articles in .pdf format. Alice is advised by his superior to design ArticlesList.jsp page in such a way that it should display a list of all the articles in one page and should send a selected filename as a query string to redirect users to articledetails.jsp page. Alice wrote the following code on page load to read the file name. String myfilename = request.getParameter("filename"); String txtFileNameVariable = myfilename; String locationVariable = request.getServletContext().getRealPath("/"); String PathVariable = ""; PathVariable = locationVariable + txtFileNameVariable; BufferedInputStream bufferedInputStream = null; Path filepath = Paths.get(PathVariable); After reviewing this code, his superior pointed out the security mistake in the code and instructed him not repeat the same in future. Can you point the type of vulnerability that may exist in the above code?
Show answer and explanation
Correct answer: D. Directory Traversal vulnerability
The code constructs a file path by directly concatenating user-supplied input (filename parameter) with a base directory path without any validation or sanitization. An attacker could supply malicious input such as '../../../etc/passwd' or similar path traversal sequences to access files outside the intended directory, compromising system security. This is a classic Directory Traversal vulnerability.
Why the other options are wrong
- A. URL Tampering involves modifying URLs to manipulate application behavior, but the core issue here is unauthorized file system access through path manipulation, not general URL manipulation.
- B. Form Tampering refers to modifying form data before submission, whereas this vulnerability occurs in server-side file path processing based on query parameters.
- C. XSS vulnerability involves injecting malicious scripts into web pages viewed by other users; this code processes file paths, not user-generated content displayed to other clients.
Question 2
In a certain website, a secure login feature is designed to prevent brute-force attack by implementing account lockout mechanism. The account will automatically be locked after five failed attempts. This feature will not allow the users to login to the website until their account is unlocked. However, there is a possibility that this security feature can be abused to perform __________ attack.
Show answer and explanation
Correct answer: D. Denial-of-Service (DoS)
An account lockout mechanism designed to prevent brute-force attacks can be abused by attackers to perform a Denial-of-Service attack. An attacker can intentionally make repeated failed login attempts using valid usernames to lock legitimate users' accounts, preventing authorized users from accessing their accounts. This transforms a security feature into a vector for account unavailability.
Why the other options are wrong
- A. Failure to Restrict URL addresses improper access control on URL endpoints, not related to account lockout mechanisms being weaponized.
- B. Broken Authentication typically refers to weaknesses in authentication implementation itself, not misuse of authentication security features to deny service.
- C. Unvalidated Redirects and Forwards involves improper redirection handling, which is unrelated to how account lockout policies can be exploited.
Question 3
According to secure logging practices, programmers should ensure that logging processes are not disrupted by:
Show answer and explanation
Correct answer: D. Throwing incorrect exceptions
Secure logging processes must not be disrupted by throwing incorrect exceptions during logging operations. When exceptions are thrown improperly during logging, they can interrupt the logging chain and prevent critical security events from being recorded. Options A, B, and C involve catching or re-throwing exceptions, which are legitimate exception handling techniques that maintain logging integrity. However, throwing incorrect exceptions directly disrupts the logging process and violates secure logging principles.
Why the other options are wrong
- A. Catching incorrect exceptions is a valid exception handling practice that prevents logging disruption.
- B. Multiple catching of exceptions is a standard error handling technique that maintains logging continuity.
- C. Re-throwing exceptions allows proper exception propagation while maintaining the logging audit trail.
1 review for EC-Council 312-96 CASE Java Exam Practice Questions
Only logged in customers who have purchased this product may leave a review.
How much of the EC-Council 312-96 CASE Java bank is free?
49 questions in the bankEach step includes the one before, so buying only adds new questions.
- You are here10questionsFree sampleThree on this page, all ten as a PDF.Download the sample
- 1224% of the bankPractice pageFree on the site, every answer explained.Go to the practice page
- 24the first half of the packHalf PackFree by email, as one PDF, every answer explained.Get the Half Pack
- 49100%, the whole bankFull pack, US$39Plus the questions-only PDF, monthly updates, refund if you fail.Get the full pack
What’s in the EC-Council 312-96 CASE Java pack
- 49 questions mapped to the CASE Java exam blueprint
- Answers and explanations for every question, including the wrong options
- A questions-only PDF for timed practice runs
- Delivered by email shortly after checkout
- Free monthly updates for as long as the exam is live
- Pass or your money back
A 312-96 attempt costs US$450. This pack is US$39, paid once.
What makes the CASE Java hard
312-96 is the Java edition of EC-Council's Certified Application Security Engineer, the developer-facing exam in a catalogue that is otherwise aimed at attackers and defenders. It follows the software development lifecycle from requirements to deployment, and most questions show a servlet, a JDBC call or a Spring configuration and ask what is wrong with it or which fix closes the hole.
Eligibility is the official CASE training or two years of software or security experience with a US$100 application fee. The exam itself is 50 questions in two hours with a 70% pass mark.
The ten CASE modules follow the lifecycle, and the secure-coding modules carry the weight: input validation with whitelisting and parameterised queries, authentication and authorization with Java EE security and Spring Security, cryptography with the JCA and JCE, session management, and error handling and logging that does not leak. Static and dynamic application security testing and secure deployment round out the blueprint. The exam rewards developers who have actually fixed these bugs, since the distractors are the plausible half-fixes.
About the exam
312-96 (Certified Application Security Engineer, Java, CASE Java) validates the security skills and knowledge required throughout the software development lifecycle to build secure Java applications. It covers application security threats, security requirements, secure design, secure coding for input validation, authentication and authorization, cryptography, session management and error handling, application security testing, and secure deployment. Eligibility is official CASE training, or two years of experience in the information security or software domain with a US$100 application fee.
Questions before you buy
How quickly do I receive it?
Your PDF is prepared and sent to your email address after checkout, and you get a confirmation as soon as it is on its way.
Are updates included?
Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.
What if I fail the exam?
We refund the pack, or swap it for any other pack if you would rather keep studying. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.
What is your pass rate?
99% of customers who prepare with a CertStash pack pass. If you do not, we refund the pack, or swap it for another pack.
Can I share it with colleagues?
Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.
Related products
-
EC-Council 312-49v11 CHFI v11
452 questionsUpdated Nov 20265.0 (2) US$39 -
EC-Council 312-85 CTIA v2
88 questionsUpdated Nov 20265.0 (1) US$39 -
EC-Council 312-40 CCSE v2
147 questionsUpdated Nov 20264.5 (2) US$39 -
EC-Council 312-39v2 CSA v2
196 questionsUpdated Nov 20265.0 (1) US$39
Keone –
I've been writing Java for years, but the CASE exam requires a very specific security mindset. This updated 312-96 dump was brilliant for reviewing input validation techniques, proper implementation of Java Cryptography Architecture, and identifying session management flaws. A fantastic tool to ensure you pass. I passed my 312-96 Certified Application Security Engineer (CASE) JAVA exam successfully!