- CASE Java (312-96) is 50 questions, 2 hours, with a 70% passing score.
- The remote-proctored voucher costs $450 and stays valid for 1 year.
- Eligibility runs through official training, ECSP status, 2 years of experience, or an accepted equivalent - plus a $100 application fee when required.
- Content spans 10 modules, from security requirements through SAST/DAST and secure deployment.
What CASE Certification Actually Covers
The Certified Application Security Engineer credential, issued by EC-Council, validates that a developer or security professional can build, test, and ship software with security baked into every phase of the lifecycle - not bolted on afterward. This site focuses specifically on CASE Java (exam 312-96), which is distinct from the separate CASE .NET exam (312-95). If you write Java code and want a credential that speaks directly to that stack, 312-96 is the one you need to prepare for.
Unlike generic security-awareness certificates, CASE is built around the actual secure software development life cycle (SSDLC): requirements gathering, architecture and design, secure coding across multiple risk categories, testing, and deployment/maintenance. That structure is what makes CASE relevant to hiring managers who need engineers that can do the work, not just recite theory. For a full breakdown of what "CASE" means as an acronym and as a discipline, see What Is CASE? and CASE Meaning.
Exam Format, Fees, and Registration
The CASE Java exam is delivered through the EC-Council Exam Portal, and remote proctoring is available so you don't need to travel to a physical test center. Here's what the mechanics look like in practice:
- Question count: 50 multiple-choice questions
- Time limit: 2 hours
- Passing score: 70%
- Voucher cost: $450 for the remote-proctored version, valid for 1 year from purchase
- Delivery: EC-Council Exam Portal via Remote Proctoring Services
Because the voucher expires after a year, it's worth buying it only once you have a realistic exam date in mind rather than purchasing far in advance "just to lock in the price." For a granular breakdown of every fee that can apply - training, eligibility application, voucher, and retake costs - read CASE Certification Cost 2026: Complete Pricing Breakdown. And if you want the exact numeric bar you're aiming for on exam day, CASE Passing Score 2026: Exactly What You Need to Pass walks through what 70% means in terms of correct answers out of 50 questions.
Key Takeaway
With only 50 questions in 2 hours, you have roughly 2.4 minutes per question - pacing matters as much as knowledge. Practicing under timed conditions on our CASE practice test platform is the best way to build that rhythm before exam day.
Eligibility Routes You Can Actually Use
You can't just register and sit the exam cold. EC-Council requires you to qualify through one of several paths:
- Official CASE training completed through an accredited provider
- Active ECSP (EC-Council Certified Secure Programmer) status
- At least 2 years of documented information-security or software-design experience
- An accepted equivalent certification, reviewed on a case-by-case basis
If you're not coming in through official training, expect a $100 nonrefundable eligibility application fee where required, on top of the exam voucher itself. This is a step candidates frequently overlook when budgeting, and it's covered in more depth in CASE Requirements 2026: Eligibility, Prerequisites & How to Qualify. If you're weighing whether to go through formal instruction or self-study your way to eligibility, CASE Training lays out what official courses typically include.
The 10 CASE Domains Explained
CASE Java content is organized into 10 modules that trace the SSDLC from concept to production. Understanding what each domain actually tests - not just its title - is the difference between passing comfortably and guessing on half the exam.
Domain 1: Understanding Application Security, Threats, and Attacks
Foundational threat modeling and attack classification - the vocabulary the rest of the exam assumes you already know.
- Common vulnerability classes and how attackers exploit them
- Threat modeling terminology used throughout later domains
Domain 2: Security Requirements Gathering
How security requirements get elicited and documented before a single line of code is written.
- Translating business risk into testable security requirements
- Stakeholder roles in requirements sign-off
Domain 3: Secure Application Design and Architecture
Design-time decisions - trust boundaries, layered defenses, and architectural patterns that prevent whole classes of bugs.
- Secure design principles like least privilege and defense in depth
- Architectural review checkpoints
Domain 4: Secure Coding Practices for Input Validation
Java-specific handling of untrusted input - a heavily tested area given how many vulnerabilities trace back to poor validation.
- Whitelisting vs. blacklisting validation strategies
- Injection prevention in Java-based data layers
Domain 5: Secure Coding Practices for Authentication and Authorization
Correct implementation of identity verification and access control logic.
- Common authentication bypass patterns and their fixes
- Role-based vs. attribute-based authorization models
Domain 6: Secure Coding Practices for Cryptography
Applied cryptography as used in Java applications, not academic crypto theory.
- Key management and storage pitfalls
- Choosing appropriate algorithms and avoiding deprecated ones
Domain 7: Secure Coding Practices for Session Management
How sessions are created, maintained, and invalidated securely.
- Session fixation and hijacking countermeasures
- Token lifecycle management
Domain 8: Secure Coding Practices for Error Handling
Preventing information leakage through error messages and logs.
- Safe exception handling patterns in Java
- Logging practices that avoid exposing sensitive data
Domain 9: Static and Dynamic Application Security Testing (SAST & DAST)
Tooling and methodology for finding vulnerabilities before and after deployment.
- When to apply SAST vs. DAST in the pipeline
- Interpreting scan results and prioritizing fixes
Domain 10: Secure Deployment and Maintenance
Closing the loop - hardening environments and maintaining security posture post-release.
- Secure configuration management
- Patch management and ongoing monitoring
Each of these domains carries different weight and difficulty on exam day, and some - particularly the secure coding practice domains 4 through 8 - tend to dominate the question pool. For a domain-by-domain study strategy with more detail than fits here, see CASE Exam Domains 2026: Complete Guide to All 10 Content Areas. If you're trying to gauge overall difficulty before committing to a study timeline, How Hard Is the CASE Exam? Complete Difficulty Guide 2026 and CASE Pass Rate 2026: What the Data Shows are both worth reading early in your planning.
Who Hires CASE-Certified Engineers
CASE is positioned for professionals who sit at the intersection of development and security: application security engineers, secure code reviewers, DevSecOps practitioners, and senior Java developers who own security requirements for their team. Organizations that build customer-facing web applications, financial platforms, or regulated software tend to value this credential because it demonstrates hands-on familiarity with the SSDLC rather than just checklist-level awareness.
If you're deciding whether this certification fits your career trajectory, CASE Jobs outlines the roles that typically list CASE as a preferred or required qualification, and CASE Salary Guide 2026: Complete Earnings Analysis discusses compensation considerations for these roles. For a broader cost-versus-benefit view before you commit the $450 voucher fee and study time, Is the CASE Certification Worth It? Complete ROI Analysis 2026 is a useful companion read.
| Attribute | CASE Java (312-96) |
|---|---|
| Delivery | EC-Council Exam Portal, Remote Proctoring Services |
| Questions | 50 multiple-choice |
| Time Limit | 2 hours |
| Passing Score | 70% |
| Voucher Cost | $450 (valid 1 year) |
| Eligibility Fee | $100 nonrefundable, where required |
| Renewal | 120 ECE credits every 3 years |
Mapping a Study Schedule to the Domains
Rather than a generic weekly template, the most effective approach is to sequence your review around how the 10 domains build on each other. Early domains establish vocabulary and architecture thinking; middle domains are where most exam questions live; the final domains close the loop on testing and deployment.
Foundations and Design
- Work through Domain 1 (threats and attacks) and Domain 2 (security requirements gathering) together, since requirements language depends on threat vocabulary
- Move into Domain 3 (secure design and architecture) once terminology feels solid
Secure Coding Core
- Spend the most time here: Domains 4-8 cover input validation, authentication/authorization, cryptography, session management, and error handling
- Practice recognizing insecure Java code patterns, since the exam presents scenario-based questions rather than pure definitions
Testing and Deployment
- Cover Domain 9 (SAST/DAST) and Domain 10 (secure deployment and maintenance)
- Review how findings from testing tools map back to the coding domains you already studied
Full-Length Review
- Run timed practice sessions on our CASE practice test platform to simulate the 2-hour, 50-question format
- Revisit weak domains identified during practice runs rather than restarting from Domain 1
This sequencing matters because the secure coding domains (4-8) are cumulative - weak input validation understanding will make authentication and session management questions harder to reason through. For a more detailed week-by-week breakdown with specific resource recommendations, see CASE Study Guide 2026: How to Pass on Your First Attempt. A one-page reference for last-minute review is available at CASE Cheat Sheet 2026: One-Page Review of Must-Know Facts.
Maintaining the Credential After You Pass
Passing the exam isn't the end of the obligation. CASE follows EC-Council's standard 3-year renewal cycle, and maintaining active status requires accumulating 120 ECE (EC-Council Continuing Education) credits during that period. These credits typically come from activities like attending security conferences, completing additional training, publishing research, or participating in approved professional development. Planning for this early - rather than scrambling in year three - keeps the certification active without last-minute stress.
If you're still deciding whether CASE is the right acronym for your goals versus adjacent terms you may have seen, the explainer articles on What Does CASE Stand For?, What Is A CASE?, What Does CASE Mean?, and What Is CASE Certification? clarify terminology before you commit to the eligibility and exam process described above. A general overview also lives at CASE Certification.
FAQ
This site is built around CASE Java (exam 312-96). CASE .NET (312-95) is a separate exam with its own code base and is not the focus here.
The exam has 50 multiple-choice questions with a 2-hour time limit, and you need a 70% score to pass.
The remote-proctored voucher costs $450 and is valid for 1 year from the date of purchase, so time your purchase close to your planned exam date.
No single path is mandatory. You can qualify through official CASE training, active ECSP status, at least 2 years of information-security or software-design experience, or an accepted equivalent certification. A $100 nonrefundable eligibility application fee applies where required.
CASE follows EC-Council's 3-year renewal cycle, which requires earning 120 ECE credits through qualifying continuing education activities during that period.