About the Exam

This exam tests application security knowledge across the software development lifecycle for Java applications. It is intended for software professionals and developers who build or secure Java software. Passing demonstrates competence in secure requirements, design, coding, testing, deployment, and maintenance for Java applications.

Exam Topics

  • Understanding Application Security, Threats, and Attacks12%
  • Security Requirements Gathering12%
  • Secure Application Design and Architecture12%
  • Secure Coding Practices for Input Validation12%
  • Secure Coding Practices for Authentication and Authorization12%
  • Secure Coding Practices for Cryptography12%
  • Secure Coding Practices for Session Management12%
  • Secure Coding Practices for Error Handling12%
  • Static and Dynamic Application Security Testing (SAST & DAST)12%
  • Secure Deployment and Maintenance10%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Last updated November 30, 2025 at 9:19 PM

Topic filter
Retired questions
Question sort

QuestionQ1

Understanding Application Security, Threats, and Attacks

Which of the following DFD components is used to represent a change in privilege levels?

Question Image

  • A 3
  • B 4
  • C 1
  • D 2
Explanation

A trust boundary denotes a transition between trust zones or privilege levels in a data-flow diagram. It is represented by a dashed boundary line, which is component 1.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Secure Deployment and Maintenance

Alice, a security engineer, was conducting security testing on the application. He discovered that users can see the website structure and file names. Under standard security practices, this can create a serious security risk because attackers may access hidden script files in the directory. Which of the following will mitigate this security risk?

  • A < int-param > < param-name>directory-listings < param-value>true < /init-param >
  • B < int param > < param-name>directory-listings < param-value>false < /init-param >
  • C < int-param > < param-name>listings < param-value>true < /init-param >
  • D < int-param > < param-name>listings < param-value>false < /init-param >
Explanation

Directory browsing should be disabled to prevent unauthenticated users from enumerating directory contents and file names. The servlet DefaultServlet uses the listings initialization parameter; a value of false prevents directory listings from being displayed.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Secure Coding Practices for Session Management

Which of the following Spring Security Framework configuration settings ensures protection against session-fixation attacks by not allowing an authenticated user to log in again?

  • A session-fixation-protection ="newSessionID"
  • B session-fixation-protection ="migrateSession"
  • C session-fixation-protection ="enabled"
  • D session-fixation-protection ="protectSession"
Explanation

migrateSession protects against session fixation by creating a new session upon authentication and copying the existing session attributes to that new session. The pre-authentication session identifier is therefore not retained as the authenticated session.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Secure Deployment and Maintenance

Which configuration setting in server.xml allows a Tomcat server administrator to impose a file-upload limit based on file size?

  • A < connector... maxFileLimit="file size" / >
  • B < connector... maxPostSize="0" / >
  • C < connector... maxFileSize="file size" / >
  • D < connector... maxPostSize="file size" / >
Explanation

The Connector attribute maxPostSize specifies the maximum POST request-body size Tomcat will process for request parameters, including applicable multipart/form-data uploads. Setting it to the desired size establishes that limit. Apache Tomcat HTTP Connector configuration

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Security Requirements Gathering

Which of the following can be derived from abuse cases to elicit security requirements for a software system?

  • A Misuse cases
  • B Data flow diagram
  • C Use cases
  • D Security use cases
Explanation

Security use cases are derived from abuse cases to describe the protective behavior and security controls required to prevent, detect, or mitigate abusive system interactions.

Community Discussion

No comments yet. Be the first to start the discussion!

That's the end of the preview

It's free

100% of the questions are free for all users.
No strings attached.

Topics covered
Understanding Application Security, Threats, and AttacksSecurity Requirements GatheringSecure Application Design and ArchitectureSecure Coding Practices for Input ValidationSecure Coding Practices for Authentication and AuthorizationSecure Coding Practices for CryptographySecure Coding Practices for Session ManagementSecure Coding Practices for Error HandlingStatic and Dynamic Application Security Testing (SAST & DAST)Secure Deployment and Maintenance
Know a question that should be here? Contribute to this exam
Back home