12 free EC-Council 312-96 CASE Java practice questions from the CertStash pack of 49, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 12 free here, all 49 in the pack, and each step includes the one before it.
Get all 49 questions (US$39) · Download the first 10 as a PDF
Question 1
Alice works as a Java developer in Fygo software Services Ltd. He is given the responsibility to design a bookstore website for one of their clients. This website is supposed to store articles in .pdf format. Alice is advised by his superior to design ArticlesList.jsp page in such a way that it should display a list of all the articles in one page and should send a selected filename as a query string to redirect users to articledetails.jsp page. Alice wrote the following code on page load to read the file name. String myfilename = request.getParameter("filename"); String txtFileNameVariable = myfilename; String locationVariable = request.getServletContext().getRealPath("/"); String PathVariable = ""; PathVariable = locationVariable + txtFileNameVariable; BufferedInputStream bufferedInputStream = null; Path filepath = Paths.get(PathVariable); After reviewing this code, his superior pointed out the security mistake in the code and instructed him not repeat the same in future. Can you point the type of vulnerability that may exist in the above code?
Show answer and explanation
Correct answer: D. Directory Traversal vulnerability
The code constructs a file path by directly concatenating user-supplied input (filename parameter) with a base directory path without any validation or sanitization. An attacker could supply malicious input such as '../../../etc/passwd' or similar path traversal sequences to access files outside the intended directory, compromising system security. This is a classic Directory Traversal vulnerability.
Why the other options are wrong
- A. URL Tampering involves modifying URLs to manipulate application behavior, but the core issue here is unauthorized file system access through path manipulation, not general URL manipulation.
- B. Form Tampering refers to modifying form data before submission, whereas this vulnerability occurs in server-side file path processing based on query parameters.
- C. XSS vulnerability involves injecting malicious scripts into web pages viewed by other users; this code processes file paths, not user-generated content displayed to other clients.
Question 2
In a certain website, a secure login feature is designed to prevent brute-force attack by implementing account lockout mechanism. The account will automatically be locked after five failed attempts. This feature will not allow the users to login to the website until their account is unlocked. However, there is a possibility that this security feature can be abused to perform __________ attack.
Show answer and explanation
Correct answer: D. Denial-of-Service (DoS)
An account lockout mechanism designed to prevent brute-force attacks can be abused by attackers to perform a Denial-of-Service attack. An attacker can intentionally make repeated failed login attempts using valid usernames to lock legitimate users' accounts, preventing authorized users from accessing their accounts. This transforms a security feature into a vector for account unavailability.
Why the other options are wrong
- A. Failure to Restrict URL addresses improper access control on URL endpoints, not related to account lockout mechanisms being weaponized.
- B. Broken Authentication typically refers to weaknesses in authentication implementation itself, not misuse of authentication security features to deny service.
- C. Unvalidated Redirects and Forwards involves improper redirection handling, which is unrelated to how account lockout policies can be exploited.
Question 3
According to secure logging practices, programmers should ensure that logging processes are not disrupted by:
Show answer and explanation
Correct answer: D. Throwing incorrect exceptions
Secure logging processes must not be disrupted by throwing incorrect exceptions during logging operations. When exceptions are thrown improperly during logging, they can interrupt the logging chain and prevent critical security events from being recorded. Options A, B, and C involve catching or re-throwing exceptions, which are legitimate exception handling techniques that maintain logging integrity. However, throwing incorrect exceptions directly disrupts the logging process and violates secure logging principles.
Why the other options are wrong
- A. Catching incorrect exceptions is a valid exception handling practice that prevents logging disruption.
- B. Multiple catching of exceptions is a standard error handling technique that maintains logging continuity.
- C. Re-throwing exceptions allows proper exception propagation while maintaining the logging audit trail.
Question 4
Which of the threat classification model is used to classify threats during threat modeling process?
Show answer and explanation
Correct answer: B. STRIDE
STRIDE is the standard threat classification model used during the threat modeling process. STRIDE is an acronym representing six threat categories: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. This framework systematically helps identify and categorize threats during security design analysis.
Why the other options are wrong
- A. RED is not a recognized threat classification model used in threat modeling.
- C. DREAD is a risk rating model used to prioritize threats after identification, not for classifying threats during modeling.
- D. SMART is a goal-setting framework unrelated to threat classification in security modeling.
Question 5
Alice, a Server Administrator (Tomcat), wants to ensure that Tomcat can be shut down only by the user who owns the Tomcat process. Select the appropriate setting of the CATALINA_HOME/conf in server.xml that will enable him to do so.
Show answer and explanation
Correct answer: C. < server port="-1" shutdown="SHUTDOWN" >
Setting the server port to -1 disables the shutdown port entirely, allowing Tomcat to be shut down only through the operating system process owned by the Tomcat user. When port is set to -1, the shutdown command cannot be executed remotely, restricting shutdown operations to the process owner only. The SHUTDOWN value specifies the shutdown command string, and together these settings ensure only the owning user can terminate the server.
Why the other options are wrong
- A. An empty port attribute does not provide proper security; it requires a value to be secure.
- B. Port -1 without a shutdown command value is incomplete and does not establish the proper shutdown mechanism.
- D. Port 8080 opens a shutdown listener on a standard port, allowing unauthorized remote shutdown attempts.
Question 6
Which of the following method will help you check if DEBUG level is enabled?
Show answer and explanation
Correct answer: A. isDebugEnabled()
The isDebugEnabled() method follows Java logging framework conventions (such as SLF4J and Log4j) for checking if a specific log level is enabled. This method returns a boolean value indicating whether DEBUG level logging is currently active, allowing developers to avoid expensive operations when the debug level is not enabled.
Why the other options are wrong
- B. EnableDebug() uses incorrect method naming convention with capital E and does not follow Java naming standards.
- C. IsEnableDebug() violates Java naming conventions by starting with a capital letter and uses unclear naming.
- D. DebugEnabled() is not a recognized method name in standard logging frameworks for checking debug status.
Question 7
Which of the following elements in web.xml file ensures that cookies will be transmitted over an encrypted channel?
Show answer and explanation
Correct answer: D. < connector SSLEnabled="true" / >
The connector element with SSLEnabled="true" ensures that cookies are transmitted over an encrypted HTTPS channel rather than unencrypted HTTP. This setting activates SSL/TLS encryption for the connector, protecting sensitive cookie data from interception during transmission.
Why the other options are wrong
- A. IsSSLEnabled is not a valid connector attribute in Tomcat configuration.
- B. EnableSSL is not a recognized connector attribute in standard web server configurations.
- C. SSLEnabled="false" explicitly disables SSL, allowing cookies to transmit unencrypted over HTTP.
Question 8
In which phase of secure development lifecycle the threat modeling is performed?
Show answer and explanation
Correct answer: D. Design phase
Threat modeling is performed during the Design phase of the secure development lifecycle. At this stage, architects and security professionals analyze system design to identify potential threats before implementation begins. Performing threat modeling early in the design phase allows for security controls to be integrated from the ground up rather than added reactively later.
Why the other options are wrong
- A. Threat modeling occurs before the Coding phase; performing it during coding is too late for architectural changes.
- B. Threat modeling during Testing phase is reactive; issues should be identified during Design to prevent development of vulnerable code.
- C. Threat modeling during Deployment phase is too late to influence system architecture or development practices.
Question 9
Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp < form Id="form1" method="post" action="SearchProperty.jsp" > < input type="text" id=''txt_Search" name="txt_Search" placeholder="Search Property..." / > < input type="Submit" Id="Btn_Search" value="Search" / > < /form > However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?
Show answer and explanation
Correct answer: A. He should write code like out. Write ("You Searched for: " +ESAPI.encoder().encodeForHTML(search));
Using ESAPI.encoder().encodeForHTML() properly mitigates XSS vulnerabilities by encoding user input before rendering it in HTML context. This function converts dangerous characters (such as < > " and &) into their HTML entity equivalents, preventing the browser from interpreting user input as executable code. This is the secure approach to handling untrusted user data in output.
Why the other options are wrong
- B. Using toString() on request parameters provides no protection against XSS; the input is written directly without encoding.
- C. Writing request parameters directly to output without any encoding or sanitization allows XSS attacks to execute.
- D. This option has incomplete syntax and provides no encoding mechanism to prevent XSS exploitation.
Question 10
Jacob, a Security Engineer of the testing team, was inspecting the source code to find security vulnerabilities. Which type of security assessment activity Jacob is currently performing?
Show answer and explanation
Correct answer: D. SAST
SAST (Static Application Security Testing) is the assessment activity that involves inspecting source code to identify security vulnerabilities without executing the application. Jacob is performing manual code review, which is a form of static analysis that examines code structure, logic, and potential security flaws before runtime.
Why the other options are wrong
- A. SCST is not a recognized security assessment methodology or acronym.
- B. DAST (Dynamic Application Security Testing) involves testing a running application, not inspecting source code.
- C. CAST is not a standard security assessment classification in the industry.
Question 11
A US-based ecommerce company has developed their website www.ec-sell.com to sell their products online. The website has a feature that allows their customer to search products based on the price. Recently, a bug bounty has discovered a security flaw in the Search page of the website, where he could see all products from the database table when he altered the website URL http://www.ec-sell.com/products.jsp?val=100 to http://www.ec-sell.com/products.jsp?val=200 OR '1'='1 -. The product.jsp page is vulnerable to
Show answer and explanation
Correct answer: C. SQL Injection attack
The URL manipulation where val=200 OR '1'='1' is appended to the search parameter demonstrates SQL Injection. The attacker modified the SQL query logic by inserting SQL syntax into the parameter, causing the WHERE clause condition to always evaluate as true ('1'='1'), thereby returning all records from the database. This is a classic SQL Injection attack exploiting improper input validation and parameterized query handling. Session Hijacking involves stealing session tokens. CSRF involves forging requests. Brute force involves repeated authentication attempts.
Why the other options are wrong
- A. Session Hijacking attacks steal or intercept valid session tokens; this scenario involves manipulating query parameters to alter database queries.
- B. Cross Site Request Forgery involves tricking users into making unintended requests on their behalf; this involves direct parameter manipulation of a single request.
- D. Brute force attacks involve repeated attempts to guess credentials or keys; this involves inserting SQL syntax to bypass query logic with a single crafted request.
Question 12
Which line of the following example of Java Code can make application vulnerable to a session attack?
Show answer and explanation
Correct answer: C. Line No. 4
Line 4 sets the cookie's max age to 3600 seconds without setting the HttpOnly flag. Without HttpOnly, the cookie remains accessible to JavaScript and client-side scripts, making it vulnerable to cross-site scripting (XSS) attacks where an attacker can steal the session cookie. The missing HttpOnly attribute is the critical vulnerability in this code that enables session hijacking attacks.
Why the other options are wrong
- A. Line 1 correctly declares the servlet class and is not inherently vulnerable.
- B. Line 3 creates and names the cookie appropriately; concatenating a value is standard practice and not a vulnerability.
- D. Line 5 correctly adds the cookie to the response; this is the proper method to send cookies to the client.
That was 12 of 49.
The full EC-Council 312-96 CASE Java pack has all 49 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 24 free as one PDF by email. Get the Half Pack →