HikeLetter | PMP Training & Certification Online Course | Project Management Learning

Overview

Course Description

Certification: Certified Application Security Engineer (CASE .NET)
Provider: EC-Council
Exam code: 312-95
Exam duration: 2 hours
Question count: 50 multiple-choice questions
Passing score: 70%
Exam fee (USD): $550 for the listed remote-proctored voucher; candidates taking the exam without official
training may also need a $100 eligibility application fee, subject to EC-Council rules

Course Questions

10 Questions

A team is defining requirements for a new customer portal. When should security requirements be identified?

A. Only after a penetration test B. During requirements gathering and throughout the SDLC C. Only after production deployment D. After the first security incident

A design review identifies an unauthenticated endpoint that can access sensitive records. What should the team do?

A. Document the threat, assess risk, and design an authorization control before release B. Wait for a customer to report abuse C. Hide the endpoint name D. Rely only on a web application firewall

An application builds SQL statements by concatenating user input. What is the strongest primary remediation?

A. Use parameterized queries and appropriate input validation B. Hide error messages only C. Rename the database table D. Encode all input with Base64

A web application displays user-supplied comments in an HTML page. Which control helps prevent cross-site scripting?

A. Context-appropriate output encoding and safe templating B. Trust all submitted HTML C. Disable database backups D. Use longer session timeouts

Which approach best protects an application from online password guessing?

A. Rate limiting, monitoring, and appropriately designed authentication controls B. Unlimited login attempts C. Shared user accounts D. Storing passwords in source code

How should an application store user passwords?

A. Plaintext in a database B. A unique salt and a suitable password-hashing function such as Argon2id, scrypt, or bcrypt C. Reversible encryption with a hard-coded key D. In application logs

A user changes a record ID in a URL and can view another customer's invoice. What weakness is most likely?

A. Broken object-level authorization / insecure direct object reference B. Insufficient image compression C. DNS caching D. Missing CSS

What is a strong practice for a web application's session cookie?

A. Use Secure, HttpOnly, and appropriate SameSite attributes, with TLS B. Store the session token in a URL C. Use a predictable session ID D. Never expire sessions

A banking application relies only on a browser's automatically attached session cookie for sensitive state-changing actions. Which mitigation is relevant?

A. Anti-CSRF tokens or equivalent robust request-origin defenses B. Allow all cross-origin requests C. Disable authorization checks D. Use a larger logo

A developer uses a custom encryption algorithm for customer data. What is the best recommendation?

A. Replace it with a well-reviewed standard algorithm and a secure key-management design B. Keep it secret and publish no documentation C. Use a fixed key for all customers D. Store the key in the same public repository as the code

₹2999.00 ₹999.00

Enroll Now

Certified Application Security Engineer (CASE .NET)