CASE-JAVA: EC-Council Certified Application Security Engineer (Java) 312-96
Browse certifications
Exam Resources
Official learning paths, exam details, skills measured, and community resources to supplement your study.
About the CASE Java Exam
Master secure Java development — write, review, test, and ship application code that stops the OWASP Top 10 at the source
The CASE Java (312-96) exam validates a Java developer’s ability to build security into every phase of the software development lifecycle, not bolt it on afterward. It covers application-security foundations and the OWASP Top 10 and CWE weakness classes; security requirements gathering and threat modeling (STRIDE, DREAD); secure application design on the Saltzer and Schroeder principles; and the core secure-coding practices — allowlist input validation and canonicalization, injection defense with parameterized queries (PreparedStatement) and contextual output encoding (the OWASP Java Encoder), authentication and authorization (adaptive salted password hashing with bcrypt, PBKDF2, Argon2 and scrypt, Spring Security, RBAC and ABAC, broken access control and IDOR), applied cryptography with the Java Cryptography Architecture (AES-GCM, SecureRandom, KeyStore, JSSE and TLS), session management (session fixation, Secure/HttpOnly/SameSite cookies, CSRF tokens), and secure error handling and logging. It finishes with application security testing (SAST, DAST, IAST and software composition analysis) and secure deployment and maintenance. Original practice questions. Not affiliated with, endorsed by, or sourced from EC-Council certification exams.
Who Should Take This Exam?
CASE Java is designed for Java developers, application-security engineers, secure-code reviewers, and DevSecOps engineers who build and defend Java applications. EC-Council recommends around 2 years of Java or application-development experience; hands-on time with secure coding, Spring Security, and SAST/DAST tooling helps a lot.
Typical study time: 6-10 weeks of focused study
Exam Quick Facts
| Detail | Value |
|---|---|
| Exam Code | 312-96 (CASE Java) |
| Title | Certified Application Security Engineer (Java) |
| Duration | 120 minutes |
| Questions | 50 |
| Pass Score | Cut score varies by exam form (typically 60-85%) |
| Cost | ~$450 USD (voucher; varies by region) |
| Provider | EC-Council Exam Portal (remotely proctored) |
| Validity | 3 years (EC-Council Continuing Education) |
| Question Types | Multiple choice |
Exam Domains & Weights
The CASE Java exam covers 8 study domains (drawn from EC-Council’s ten-section CASE Java outline). Focus your study time based on the weights below — higher-weighted domains have more exam questions.
| Domain | Weight | Practice Qs |
|---|---|---|
| Application Security Foundations: Threats, Attacks & Secure SDLC Requirements | 16% | 40 |
| Secure Application Design and Architecture | 12% | 30 |
| Secure Coding — Input Validation and Output Encoding | 12% | 30 |
| Secure Coding — Authentication and Authorization | 14% | 35 |
| Secure Coding — Cryptography | 10% | 25 |
| Secure Coding — Session Management and Error Handling | 16% | 40 |
| Application Security Testing — SAST and DAST | 12% | 30 |
| Secure Deployment and Maintenance | 8% | 20 |
| Total | 100% | 250 |
💡 Study tip: The five secure-coding-practice domains (input validation, authentication and authorization, cryptography, session management and error handling) are the heart of the exam. Nail the boundaries CASE loves to test: allowlist validation beats denylist; a parameterized query (PreparedStatement) — not escaping — is the SQL-injection fix; contextual output encoding stops XSS; store passwords with an adaptive salted hash (bcrypt/PBKDF2/Argon2), never MD5 or SHA-1; use AES-GCM (never ECB) and SecureRandom (never java.util.Random); and remember hashing and Base64 encoding are not encryption.
Practice Exam — 250 Questions
Prepare for CASE Java with our 250-question practice exam covering all 8 study domains. Every question is an original real-world secure-coding scenario with a named Java developer or application-security engineer, detailed explanations, and per-option rationale mapped to the OWASP Top 10, CWE, and the Java security stack.
What you get:
- ✅ Exam simulation mode with timer
- ✅ Spaced repetition for weak areas
- ✅ Detailed explanations for every question
- ✅ Progress tracking across domains
- ✅ 20 free questions — no account needed
EC-Council Certification Path
EC-Council’s application-security track centers on CASE (Certified Application Security Engineer), offered for both Java and .NET. It complements the offensive and defensive tracks — CEH for ethical hacking, CND for network defense, and CCSE for cloud security. There is no strict hierarchy; CASE is the secure-development specialization.
Related EC-Council Certifications
If you’re studying for CASE Java, you might also be interested in these EC-Council certifications:
- CEH v13: EC-Council Certified Ethical Hacker (312-50) — the offensive side: find the flaws CASE teaches you to prevent — 200 practice questions
- CCSE: EC-Council Certified Cloud Security Engineer — cloud application and platform security — 250 practice questions
- CND v3: EC-Council Certified Network Defender — defensive security fundamentals — 200 practice questions
- CTIA: EC-Council Certified Threat Intelligence Analyst — threat intelligence for AppSec context — 250 practice questions
Study Tips
- Live in the secure-coding domains — input validation, authn/authz, cryptography, and session/error handling are the bulk of the exam
- Use our practice exam — try the 20 free questions first to gauge your readiness
- Review explanations — don’t just check if you got it right; read why each answer is the secure choice
- Memorize the secure-vs-insecure pairs — parameterized query vs escaping, allowlist vs denylist, AES-GCM vs ECB, adaptive hash vs MD5, output encoding vs input validation
- Simulate exam conditions — use the timed exam mode to practice under pressure