CASE .NET - Certified Application Security Engineer (.NET) — Questions and Answers

Question 1: A production Java web app returns full stack traces to users when an exception occurs. What is the most appropriate deployment fix?

Wrap every method in an empty catch block
Enable verbose logging in the browser console
Configure a generic custom error page and log details server-side (Correct answer)
Move the stack trace into an HTML comment

Correct answer: Configure a generic custom error page and log details server-side

Generic error pages stop information leakage, and server-side logs keep the details available for troubleshooting.

Question 2: What are appropriate file permissions for application log files?

Executable by all users
Append/write for the application account and read access restricted to authorized administrators (Correct answer)
World-readable so developers can troubleshoot
Stored in the public web directory with read-only permissions

Correct answer: Append/write for the application account and read access restricted to authorized administrators

Least privilege on logs prevents unauthorized reading or modification of sensitive audit data.

Question 3: What is Multi-Factor Authentication (MFA)?

Simultaneously logging in from multiple trusted devices
Using multiple passwords for a single account login
Relying exclusively on biometric verification
Requiring two or more verification factors from different categories to authenticate (Correct answer)

Correct answer: Requiring two or more verification factors from different categories to authenticate

MFA requires credentials from two or more independent factor categories — knowledge, possession, and inherence — to verify identity.

Question 4: A application security engineer professional discovers a discrepancy during professional ethics & standards review. What is the most appropriate immediate action?

Engaging stakeholders collaboratively to align goals and expectations (Correct answer)
Accepting all stakeholder requests without prioritization
Limiting communication to written reports only
Working independently to avoid conflicting opinions

Correct answer: Engaging stakeholders collaboratively to align goals and expectations

Engaging stakeholders collaboratively to align goals and expectations is the correct approach because effective professional ethics & standards in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 5: A new regulation impacts app security engineer testing procedures. What should a CASE professional do first?

Delegating compliance oversight to administrative staff
Interpreting regulations loosely to allow maximum flexibility
Ensuring compliance with current regulatory requirements and standards (Correct answer)
Complying only with regulations that have enforcement mechanisms

Correct answer: Ensuring compliance with current regulatory requirements and standards

Ensuring compliance with current regulatory requirements and standards is the correct approach because effective app security engineer testing in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 6: What does Privileged Access Management (PAM) address?

Auditing network packet traffic for anomalies
Tracking standard user login frequency and patterns
Managing password storage for regular user accounts
Securing, managing, and monitoring accounts with elevated administrative permissions (Correct answer)

Correct answer: Securing, managing, and monitoring accounts with elevated administrative permissions

PAM solutions control and audit privileged account access to critical infrastructure, reducing risk from insider threats and compromised administrative credentials.

Question 7: What should happen on the server when a user clicks 'Logout'?

Only the client cookie is deleted
The server-side session is invalidated and the cookie is cleared (Correct answer)
The session is kept for 24 hours for convenience
The user is redirected without any session changes

Correct answer: The server-side session is invalidated and the cookie is cleared

Deleting only the client cookie leaves the server-side session valid, so a stolen ID could be replayed. Proper logout invalidates the session on the server.

Question 8: Which coding practice weakens security in exception handling?

Using empty catch blocks that swallow exceptions (Correct answer)
Releasing resources in finally blocks
Catching specific exception types
Logging exceptions with correlation IDs

Correct answer: Using empty catch blocks that swallow exceptions

Empty catch blocks hide failures, can leave the application in an inconsistent or insecure state, and remove evidence of attacks.

Question 9: Which of these should NEVER be written to application logs?

Plaintext passwords and full session tokens (Correct answer)
Authorization failure events
Source IP addresses of requests
Failed login timestamps

Correct answer: Plaintext passwords and full session tokens

Logs are often widely accessible and kept for a long time. Passwords, session tokens, card numbers and similar secrets must never be logged, or should be masked.

Question 10: What is the primary benefit of implementing threat modeling in the early stages of development?

It ensures all threats are eliminated
It reduces the cost of fixing security issues (Correct answer)
It increases software complexity
It replaces penetration testing

Correct answer: It reduces the cost of fixing security issues

Early threat modeling reduces the cost and effort of fixing security vulnerabilities compared to addressing them post-deployment.

Question 11: An attacker modifies a hidden form field containing a product price before submission. Which STRIDE category best fits?

Information Disclosure
Repudiation
Spoofing
Tampering (Correct answer)

Correct answer: Tampering

Unauthorized modification of data in transit or in the client is tampering.

Question 12: An exception is thrown during an authorization check. Following the fail-secure principle, what should happen?

Retry the check indefinitely until it succeeds
Grant read-only access as a compromise
Grant access so availability is preserved
Deny access and log the failure (Correct answer)

Correct answer: Deny access and log the failure

Fail-secure (fail-closed) means denying access by default when a security control errors out.

Question 13: Which login failure message best prevents username enumeration?

"The password you entered is incorrect."
"Your account is locked after 3 attempts with this username."
"Invalid username or password." (Correct answer)
"No account exists with that username."

Correct answer: "Invalid username or password."

A generic message does not reveal whether the username or the password was wrong.

Question 14: What does the SameSite=Strict cookie attribute mainly protect against?

Buffer overflows
Brute-force password attacks
SQL injection
Cross-site request forgery (CSRF) (Correct answer)

Correct answer: Cross-site request forgery (CSRF)

SameSite=Strict stops the browser from sending the cookie on cross-site requests. That blocks most CSRF attacks, which depend on the victim's cookies being attached automatically.

Question 15: Which of the following SHOULD be recorded in a security log?

A failed login attempt with timestamp, username, and source IP (Correct answer)
The user's plaintext password on failed login
The full session token for tracing
The full credit card number used in a transaction

Correct answer: A failed login attempt with timestamp, username, and source IP

Security events should be logged with context, but never secrets like passwords, tokens, or full card numbers.

Question 16: What key length does AES-256 use?

512 bits
128 bits
256 bits (Correct answer)
192 bits

Correct answer: 256 bits

AES-256 uses a 256-bit key, providing the highest security level among AES variants.

Question 17: During a communication & stakeholder engagement audit, which documentation is most critical to have readily available?

Conducting root cause analysis to identify underlying systemic issues (Correct answer)
Blaming individual team members for process failures
Addressing symptoms without investigating deeper causes
Accepting recurring problems as unavoidable

Correct answer: Conducting root cause analysis to identify underlying systemic issues

Conducting root cause analysis to identify underlying systemic issues is the correct approach because effective communication & stakeholder engagement in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 18: At which SDLC phase is it most cost-effective to define security requirements?

During maintenance
During requirements gathering at the start (Correct answer)
After deployment
During penetration testing

Correct answer: During requirements gathering at the start

Fixing security defects costs far more the later they are found. Defining security requirements at the start builds security in rather than adding it afterwards.

Question 19: Which cookie attribute stops client-side scripts from reading the session cookie?

Domain
SameSite
HttpOnly (Correct answer)
Secure

Correct answer: HttpOnly

HttpOnly blocks JavaScript access through document.cookie, which limits session theft through XSS. Secure only restricts the cookie to HTTPS.

Question 20: Why is automated security testing important in application development?

It replaces security best practices
It eliminates the need for manual testing
It ensures consistent and efficient vulnerability detection (Correct answer)
It is only useful for small applications

Correct answer: It ensures consistent and efficient vulnerability detection

Automated security testing helps quickly identify vulnerabilities in large applications and ensures consistent testing across code changes.

Question 21: Which set of fields forms a minimal useful security audit record?

Only the HTTP status code
Browser user-agent and screen resolution
User identity, timestamp, event type, resource affected, and outcome (Correct answer)
The user's password hash and IP address

Correct answer: User identity, timestamp, event type, resource affected, and outcome

Audit records should answer who, what, when, where, and whether it succeeded.

Question 22: What is the primary characteristic of symmetric encryption?

It hashes data without a key
It uses different keys for encryption and decryption
It uses the same key for both encryption and decryption (Correct answer)
It generates digital signatures only

Correct answer: It uses the same key for both encryption and decryption

Symmetric encryption uses a single shared secret key for both encrypting and decrypting data.

Question 23: What should a production application show users when an unhandled exception occurs?

The server's internal IP and framework version
The full stack trace for transparency
A generic error message, with details logged on the server only (Correct answer)
The SQL query that failed

Correct answer: A generic error message, with details logged on the server only

Detailed errors leak information an attacker can use, such as stack traces, queries and versions. Users should get a generic message, while the details go to secure server-side logs.

Question 24: Why is symmetric encryption preferred over asymmetric for bulk data encryption?

It does not require key exchange
It provides stronger security guarantees
It is significantly faster and more efficient for large volumes (Correct answer)
It supports digital signatures

Correct answer: It is significantly faster and more efficient for large volumes

Symmetric encryption is computationally faster than asymmetric encryption, making it suitable for encrypting large datasets.

Question 25: A application security engineer professional discovers a discrepancy during risk management & mitigation review. What is the most appropriate immediate action?

Limiting communication to written reports only
Engaging stakeholders collaboratively to align goals and expectations (Correct answer)
Working independently to avoid conflicting opinions
Accepting all stakeholder requests without prioritization

Correct answer: Engaging stakeholders collaboratively to align goals and expectations

Engaging stakeholders collaboratively to align goals and expectations is the correct approach because effective risk management & mitigation in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 26: Which scenario would require a application security engineer professional to escalate a app security engineer testing concern?

Using feedback solely for personnel evaluations
Discouraging critical feedback to maintain team morale
Creating feedback mechanisms that encourage continuous improvement (Correct answer)
Collecting feedback only during formal review periods

Correct answer: Creating feedback mechanisms that encourage continuous improvement

Creating feedback mechanisms that encourage continuous improvement is the correct approach because effective app security engineer testing in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 27: Which scenario would require a application security engineer professional to escalate a app security engineer secure deployment concern?

Using feedback solely for personnel evaluations
Discouraging critical feedback to maintain team morale
Creating feedback mechanisms that encourage continuous improvement (Correct answer)
Collecting feedback only during formal review periods

Correct answer: Creating feedback mechanisms that encourage continuous improvement

Creating feedback mechanisms that encourage continuous improvement is the correct approach because effective app security engineer secure deployment in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 28: An application builds a file path from a user-supplied filename. Which attack is most likely if the input is not validated?

Clickjacking
Path (directory) traversal (Correct answer)
Session fixation
Cross-site request forgery

Correct answer: Path (directory) traversal

Without validation, sequences like '../' let an attacker step out of the intended directory and read or write arbitrary files on the server.

Question 29: What security risk do orphaned accounts pose?

Former employees or decommissioned systems may retain unauthorized access through unclosed accounts (Correct answer)
They consume excessive disk storage on directory servers
They create duplicate identity entries in the directory
They cause measurable authentication performance degradation

Correct answer: Former employees or decommissioned systems may retain unauthorized access through unclosed accounts

Orphaned accounts — accounts not linked to active users or systems — remain usable and represent unauthorized access vectors if not promptly disabled.

Question 30: What distinguishes an advanced application security engineer practitioner's approach to professional ethics & standards from that of a novice?

Rotating responsibilities randomly to promote flexibility
Creating competition between teams to drive performance
Establishing cross-functional teams with clearly defined roles (Correct answer)
Assigning all responsibilities to a single department

Correct answer: Establishing cross-functional teams with clearly defined roles

Establishing cross-functional teams with clearly defined roles is the correct approach because effective professional ethics & standards in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 31: What is the primary objective of risk management & mitigation within the CASE professional framework?

Analyzing data systematically using validated assessment tools (Correct answer)
Relying on informal observations and anecdotal reports
Copying approaches used by competitors without adaptation
Making assumptions based on previous experience alone

Correct answer: Analyzing data systematically using validated assessment tools

Analyzing data systematically using validated assessment tools is the correct approach because effective risk management & mitigation in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 32: What distinguishes an advanced application security engineer practitioner's approach to quality assurance & compliance from that of a novice?

Creating competition between teams to drive performance
Assigning all responsibilities to a single department
Rotating responsibilities randomly to promote flexibility
Establishing cross-functional teams with clearly defined roles (Correct answer)

Correct answer: Establishing cross-functional teams with clearly defined roles

Establishing cross-functional teams with clearly defined roles is the correct approach because effective quality assurance & compliance in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 33: What is the security benefit of removing sample applications and unused modules from a production application server?

It enables stronger password hashing
It removes the need for TLS
It reduces the attack surface (Correct answer)
It increases the session timeout

Correct answer: It reduces the attack surface

Sample apps and unused modules often contain known vulnerabilities, so removing them shrinks what attackers can target.

Question 34: What distinguishes an advanced application security engineer practitioner's approach to communication & stakeholder engagement from that of a novice?

Establishing cross-functional teams with clearly defined roles (Correct answer)
Creating competition between teams to drive performance
Assigning all responsibilities to a single department
Rotating responsibilities randomly to promote flexibility

Correct answer: Establishing cross-functional teams with clearly defined roles

Establishing cross-functional teams with clearly defined roles is the correct approach because effective communication & stakeholder engagement in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 35: What is the primary defense against SQL injection in Java or .NET applications?

HTML-encoding all input
Using stored procedures that concatenate user input
Using parameterized queries (PreparedStatement / SqlParameter) (Correct answer)
Limiting input length to 50 characters

Correct answer: Using parameterized queries (PreparedStatement / SqlParameter)

Parameterized queries keep the query structure separate from the data, so user input can never be read as SQL. A stored procedure that builds dynamic SQL by concatenating input is still vulnerable.

Question 36: What is the best defense against session fixation?

Encrypting the username cookie
Using a longer session timeout
Storing the session ID in the URL
Issuing a new session ID immediately after successful authentication (Correct answer)

Correct answer: Issuing a new session ID immediately after successful authentication

In session fixation, the attacker plants a known session ID before the victim logs in. Issuing a new ID at login makes the planted ID useless.

Question 37: What is the most common mistake professionals make when implementing app security engineer testing strategies?

Developing contingency plans for high-probability risk scenarios (Correct answer)
Creating contingency plans for every possible scenario regardless of probability
Transferring all risk to external partners through contracts
Responding to problems only after they occur

Correct answer: Developing contingency plans for high-probability risk scenarios

Developing contingency plans for high-probability risk scenarios is the correct approach because effective app security engineer testing in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 38: Which technique helps provide tamper-evidence for audit logs to support non-repudiation?

Cryptographic hash chaining or digital signing of log entries (Correct answer)
Compressing logs with gzip
Rotating logs every hour
Storing logs as plain text on the same server

Correct answer: Cryptographic hash chaining or digital signing of log entries

Hash chains or signatures make any modification or deletion of entries detectable.

Question 39: What does OpenID Connect (OIDC) add on top of OAuth 2.0?

An identity and authentication layer providing standardized user identity via ID tokens (Correct answer)
A network access control protocol
A firewall authentication standard
An encryption standard for REST API payloads

Correct answer: An identity and authentication layer providing standardized user identity via ID tokens

OIDC extends OAuth 2.0 with a standardized authentication layer, introducing ID tokens that carry verified user identity claims.

Question 40: What is a directory service in enterprise identity management?

A routing table listing network IP address assignments
An event logging system capturing all authentication activities
A system for defining and enforcing firewall access rules
A centralized database that stores, organizes, and provides access to user, group, and resource identity information (Correct answer)

Correct answer: A centralized database that stores, organizes, and provides access to user, group, and resource identity information

Directory services such as Active Directory or LDAP store and manage organizational identity data including user accounts, group memberships, and resource access policies.

Question 41: Which information disclosed in a verbose stack trace is most useful to an attacker?

Framework/library versions, internal file paths, and query structure (Correct answer)
The current date
The page's CSS file names
The user's preferred language

Correct answer: Framework/library versions, internal file paths, and query structure

Versions, paths, and query details help attackers find known vulnerabilities and craft targeted exploits.

Question 42: What does cryptographic key management encompass?

Encrypting all keys with a single master password
Creating strong user passwords only
Rotating user account credentials quarterly
Administering keys through their full lifecycle including generation, storage, rotation, and destruction (Correct answer)

Correct answer: Administering keys through their full lifecycle including generation, storage, rotation, and destruction

Key management covers the entire cryptographic key lifecycle: generation, distribution, storage, rotation, and secure destruction.

Question 43: During a professional ethics & standards audit, which documentation is most critical to have readily available?

Addressing symptoms without investigating deeper causes
Accepting recurring problems as unavoidable
Conducting root cause analysis to identify underlying systemic issues (Correct answer)
Blaming individual team members for process failures

Correct answer: Conducting root cause analysis to identify underlying systemic issues

Conducting root cause analysis to identify underlying systemic issues is the correct approach because effective professional ethics & standards in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

Question 44: Why is static application security testing (SAST) beneficial?

It slows down development
It only works after deployment
It identifies security flaws in source code early (Correct answer)
It replaces penetration testing

Correct answer: It identifies security flaws in source code early

SAST analyzes source code early in the development process to detect security issues before deployment.

Question 45: What is a JSON Web Token (JWT)?

A type of X.509 digital certificate
A compact, self-contained token for securely transmitting signed claims between parties (Correct answer)
A firewall rule configuration format
A database field encryption standard for JSON data

Correct answer: A compact, self-contained token for securely transmitting signed claims between parties

A JWT is a compact, digitally signed token encoding claims that can be verified because the signature ensures tamper detection.

Question 46: What is the purpose of secure session management?

To increase session timeout duration
To keep sessions active indefinitely
To allow multiple simultaneous logins from different locations
To protect user sessions from hijacking and unauthorized access (Correct answer)

Correct answer: To protect user sessions from hijacking and unauthorized access

Secure session management ensures that user sessions are protected from hijacking, fixation, and other unauthorized access risks.

Question 47: An attacker submits input containing CR/LF characters so that fake entries appear in the log file. What is this attack called?

Session hijacking
Log injection (log forging) (Correct answer)
XML external entity attack
Clickjacking

Correct answer: Log injection (log forging)

Log injection uses newline characters to forge log entries, which can mislead investigators. The defense is to sanitize or encode user data before it is logged.

Question 48: Why is putting session IDs in URLs (URL rewriting) considered insecure?

It breaks HTTPS
URLs are case-sensitive
It increases page load time
IDs leak through browser history, logs and Referer headers (Correct answer)

Correct answer: IDs leak through browser history, logs and Referer headers

Session IDs in URLs end up in server logs, proxy logs, bookmarks, browser history and Referer headers sent to third parties, which makes session hijacking easy.

Question 49: What does Java's try-with-resources statement guarantee?

Resources are encrypted on close
Any AutoCloseable resource declared in it is closed automatically, even if an exception occurs (Correct answer)
Exceptions are never thrown
All exceptions are automatically logged

Correct answer: Any AutoCloseable resource declared in it is closed automatically, even if an exception occurs

Introduced in Java 7, it closes declared AutoCloseable resources automatically, preventing leaks.

Question 50: Which tool or methodology is most appropriate for analyzing app security engineer secure development outcomes?

Maintaining professional boundaries while building collaborative relationships (Correct answer)
Adjusting boundaries based on individual situations without guidelines
Prioritizing relationships over professional standards
Maintaining strict formality that inhibits collaboration

Correct answer: Maintaining professional boundaries while building collaborative relationships

Maintaining professional boundaries while building collaborative relationships is the correct approach because effective app security engineer secure development in the application security engineer field requires adherence to professional standards, evidence-based practices, and systematic methodology. This approach ensures consistent, high-quality outcomes while maintaining professional accountability.

CASE .NET - Certified Application Security Engineer (.NET)

The CASE .NET certification by EC-Council validates a developer's ability to build secure .NET applications by integrating security throughout the SDLC, covering secure coding practices, threat modeling, security testing, and secure deployment.

Questions

120 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cert.eccouncil.org — Score validity, eligibility, fees · verified Oct 2026
eccouncil.org — Test delivery, exam format, passing score, time limit · verified Oct 2026