New 2024 312-96 Dumps for Application Security Certified Exam Questions and Answer
Realistic Verified 312-96 exam dumps Q&As - 312-96 Free Update
EC-Council CASE Java Exam Certification Details:
| Sample Questions | EC-Council CASE Java Sample Questions |
| Schedule Exam | Pearson VUE OREC-Council Store,ECC Exam Center |
| Exam Code | 312-96 |
| Duration | 120 mins |
| Books / Training | Master Class |
| Exam Name | EC-Council Certified Application Security Engineer (CASE) - Java |
EC-Council 312-96 Exam Syllabus Topics:
| Topic | Details | Weights |
|---|---|---|
| Secure Coding Practices for Input Validation | - Understand the need of input validation -Explain data validation techniques -Explain data validation in strut framework -Explain data validation in Spring framework -Demonstrate the knowledge of common input validation errors -Demonstrate the knowledge of common secure coding practices for input validation | 8% |
| Secure Coding Practices for Authentication and Authorization | - Understand authentication concepts -Explain authentication implementation in Java -Demonstrate the knowledge of authentication weaknesses and prevention -Understand authorization concepts -Explain Access Control Model -Explain EJB authorization -Explain Java Authentication and Authorization (JAAS) -Demonstrate the knowledge of authorization common mistakes and countermeasures -Explain Java EE security -Demonstrate the knowledge of authentication and authorization in Spring Security Framework -Demonstrate the knowledge of defensive coding practices against broken authentication and authorization | 4% |
| Understanding Application Security, Threats, and Attacks | -Understand the need and benefits of application security -Demonstrate the understanding of common application-level attacks -Explain the causes of application-level vulnerabilities -Explain various components of comprehensive application security -Explain the need and advantages of integrating security in Software Development Life Cycle (SDLQ) -Differentiate functional vs security activities in SDLC -Explain Microsoft Security Development Lifecycle (SDU) -Demonstrate the understanding of various software security reference standards, models, and frameworks | 18% |
| Secure Coding Practices for Session Management | - Explain session management in Java -Demonstrate the knowledge of session management in Spring framework -Demonstrate the knowledge of session vulnerabilities and their mitigation techniques -Demonstrate the knowledge of best practices and guidelines for secure session management | 10% |
| Static and Dynamic Application Security 'resting (SAST & DAST) | - Understand Static Application Security Testing (SAST) -Demonstrate the knowledge of manual secure code review techniques for most common vulnerabilities -Explain Dynamic Application Security Testing -Demonstrate the knowledge of Automated Application Vulnerability Scanning Toolsfor DAST -Demonstrate the knowledge of Proxy-based Security Testing Tools for DAST | 8% |
NEW QUESTION # 26
Oliver is a web server admin and wants to configure the Tomcat server in such a way that it should not serve index pages in the absence of welcome files. Which of the following settings in CATALINA_HOME/conf/ in web.xml will solve his problem?
- A. < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > disable < /param-value> < /init-param > < load-on-startup > 1 < /load-on-startup> < /servlet >
- B. < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name>< param-value> 0 < /param value>< /init-param > < init-param > < param-name> listings < /param-name > < param-value > enable < /param-value > < /init-param > < load-on-startup> 1 < /load-on-startup > < /servlet >
- C. < servlet > < servlet-name > default < /servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name > < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > false < /param-value > < /init-param > < load-on-startup > 1 < /load-on-startup > < servlet >
- D. < servlet > < servlet-name > default < servlet-name > < servlet-class > org.apache.catalina.servlets.DefaultServlet < /servlet-class > < init-param > < param-name > debug < /param-name> < param-value > 0 < /param-value > < /init-param > < init-param > < param-name > listings < /param-name > < param-value > true < /param-value > < /init-param > < load-on-startup > l < /load-on-startup > < /servlet >
Answer: A
NEW QUESTION # 27
Which of the following configurations can help you avoid displaying server names in server response header?
- A. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName=" disable" redirectPort="8443" / >
- B. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" Server = " " redirectPort="8443" / >
- C. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" ServerName ="null " redirectPort="8443'' / >
- D. < Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort= "8443" / >
Answer: A
NEW QUESTION # 28
Which of the following configuration settings in server.xml will allow Tomcat server administrator to impose limit on uploading file based on their size?
- A. < connector... maxFileLimit="file size" / >
- B. < connector... maxFileSize="file size" / >
- C. < connector... maxPostSize="file size" / >
- D. < connector... maxPostSize="0"/>
Answer: C
NEW QUESTION # 29
Which of the following Spring Security Framework configuration setting will ensure the protection from session fixation attacks by not allowing authenticated user to login again?
- A. session-fixation-protection ="newSessionlD"
- B. session-fixation-protection ="enabled"
- C. session-fixation-protection =".
- D. session-fixation-protection =".
Answer: D
NEW QUESTION # 30
Identify the type of attack depicted in the figure below:
- A. Directory traversal attack
- B. Parameter/form attack
- C. Session fixation attack
- D. SQL injection attack
Answer: C
NEW QUESTION # 31
Alice, a security engineer, was performing security testing on the application. He found that users can view the website structure and file names. As per the standard security practices, this can pose a serious security risk as attackers can access hidden script files in your directory. Which of the following will mitigate the above security risk?
- A. < int-param > < param-name>listinqs < param-value>false < /init-param >
- B. < int-param > < param-name>directory-listinqs < param-value>true < /init-param >
- C. < int-param > < param-name>listinqs < param-value>true < /init-param
- D. < int param > < param-name>directorv-listinqs < param-value>false < /init-param >
Answer: D
NEW QUESTION # 32
The threat modeling phase where applications are decomposed and their entry points are reviewed from an attacker's perspective is known as ________
- A. Attack Surface Evaluation
- B. Threat Identification
- C. Impact Analysis
- D. Threat Classification
Answer: A
NEW QUESTION # 33
Thomas is not skilled in secure coding. He neither underwent secure coding training nor is aware of the consequences of insecure coding. One day, he wrote code as shown in the following screenshot. He passed 'false' parameter to setHttpOnly() method that may result in the existence of a certain type of vulnerability. Identify the attack that could exploit the vulnerability in the above case.
- A. Client-Side Scripts Attack
- B. Denial-of-Service attack
- C. SQL Injection Attack
- D. Directory Traversal Attack
Answer: A
NEW QUESTION # 34
Identify the formula for calculating the risk during threat modeling.
- A. RISK = PROBABILITY * DAMAGE POTENTIAL
- B. IRISK = PROBABILITY * VULNERABILITY
- C. RISK = PROBABILITY "Attack
- D. RISK = PROBABILITY " ASSETS
Answer: A
NEW QUESTION # 35
Which of the following authentication mechanism does J2EE support?
- A. Http Basic, Form Based, Client/Server Mutual, HTTP Digest Authentication
- B. Role Based, Http Basic, Windows, Http Digest Authentication
- C. Http Basic, Form Based, Client/Server Mutual, Role Based Authentication
- D. Windows, Form based. Role Based, Client/Server Mutual Authentication
Answer: A
NEW QUESTION # 36
Which of the following relationship is used to describe security use case scenario?
- A. Threatens Relationship
- B. Extend Relationship
- C. Include Relationship
- D. Mitigates Relationship
Answer: B
NEW QUESTION # 37
Alice works as a Java developer in Fygo software Services Ltd. He is given the responsibility to design a bookstore website for one of their clients. This website is supposed to store articles in .pdf format. Alice is advised by his superior to design ArticlesList.jsp page in such a way that it should display a list of all the articles in one page and should send a selected filename as a query string to redirect users to articledetails.jsp page.
Alice wrote the following code on page load to read the file name.
String myfilename = request.getParameter("filename");
String txtFileNameVariable = myfilename;
String locationVariable = request.getServletContext().getRealPath("/"); String PathVariable = ""; PathVariable = locationVariable + txtFileNameVariable; BufferedInputStream bufferedInputStream = null; Path filepath = Paths.get(PathVariable); After reviewing this code, his superior pointed out the security mistake in the code and instructed him not repeat the same in future. Can you point the type of vulnerability that may exist in the above code?
- A. URL Tampering vulnerability
- B. Directory Traversal vulnerability
- C. Form Tampering vulnerability
- D. XSS vulnerability
Answer: B
NEW QUESTION # 38
The developer wants to remove the HttpSessionobject and its values from the client' system.
Which of the following method should he use for the above purpose?
- A. isValidateQ
- B. sessionlnvalidateil
- C. Invalidate(session JSESSIONID)
- D. invalidateQ
Answer: D
NEW QUESTION # 39
Which line of the following example of Java Code can make application vulnerable to a session attack?
- A. Line No. 5
- B. Line No. 1
- C. Line No. 3
- D. Line No. 4
Answer: C
NEW QUESTION # 40
Which of the risk assessment model is used to rate the threats-based risk to the application during threat modeling process?
- A. SMART
- B. RED
- C. DREAD
- D. STRIDE
Answer: D
NEW QUESTION # 41
James is a Java developer working INFR INC. He has written Java code to open a file, read it line by line and display its content in the text editor. He wants to ensure that any unhandled exception raised by the code should automatically close the opened file stream. Which of the following exception handling block should he use for the above purpose?
- A. Try-Catch-Finally block
- B. Try-Catch-Resources block
- C. Try-With-Resources block
- D. Try-Catch block
Answer: C
NEW QUESTION # 42
In a certain website, a secure login feature is designed to prevent brute-force attack by implementing account lockout mechanism. The account will automatically be locked after five failed attempts. This feature will not allow the users to login to the website until their account is unlocked. However, there is a possibility that this security feature can be abused to perform __________ attack.
- A. Denial-of-Service [Do
- B. Failure to Restrict URL
- C. Unvalidated Redirects and Forwards
- D. Broken Authentication
Answer: A
NEW QUESTION # 43
Identify the type of encryption depicted in the following figure.
- A. Hashing
- B. Symmetric Encryption
- C. Asymmetric Encryption
- D. Digital Signature
Answer: B
NEW QUESTION # 44
Stephen is a web developer in the InterCall Systems. He was working on a Real Estate website for one of his clients. He was given a task to design a web page with properties search feature. He designed the following searchpage.jsp
< form Id="form1" method="post" action="SearchProperty.jsp" >
< input type="text" id=''txt_Search" name="txt_Search" placeholder="Search Property..." / >
< input type="Submit" Id="Btn_Search" value="Search" / >
< /form >
However, when the application went to security testing phase, the security tester found an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?
- A. He should write code like out.write ("You Searched for:" + request.qetParameterf'txt Search"));
- B. He should write code like out.write (("You Searched for:" +(search));
- C. He should write code like out.write ("You Searched for:" + request.qetParameter("search"l.toStrinq(ll;
- D. He should write code like out-Write ("You Searched for:" +ESAPI.encoder().encodeForHTML(search));
Answer: D
NEW QUESTION # 45
......
Use Real 312-96 Dumps - 100% Free 312-96 Exam Dumps: https://certkiller.passleader.top/ECCouncil/312-96-exam-braindumps.html