- Exam Snapshot: The Numbers You Must Memorize
- Registration and Fee Mechanics
- The 10 CASE Domains at a Glance
- Eligibility Routes Explained
- Question Format and Exam-Day Logistics
- High-Yield Topics Inside Each Domain Group
- Week-by-Week Domain Scheduling
- Renewal: 3 Years, 120 ECE Credits
- Who Hires CASE-Certified Engineers
- Frequently Asked Questions
- CASE Java (312-96) has 50 questions, a 2-hour limit, and a 70% passing score.
- The remote-proctored voucher costs $450 and stays valid for 1 year from purchase.
- Eligibility runs through official training, active ECSP status, 2+ years of experience, or an equivalent cert.
- A $100 nonrefundable eligibility application fee applies when you qualify without official training.
Exam Snapshot: The Numbers You Must Memorize
Before you touch a single practice question, lock in the raw mechanics of the exam. This page focuses on CASE Java (312-96), not the separate CASE .NET track (312-95). The two exams share a philosophy - secure software development lifecycle mastery - but they are administered as distinct EC-Council credentials with distinct question banks. If you've been mixing up study materials between the two, that's often the first correction candidates need to make.
| Attribute | Detail |
|---|---|
| Exam Code | 312-96 (CASE Java) |
| Delivery | EC-Council Exam Portal, Remote Proctoring Services |
| Questions | 50 multiple-choice |
| Time Limit | 2 hours |
| Passing Score | 70% |
| Voucher Cost | $450 (remote-proctored, valid 1 year) |
| Renewal Cycle | 3 years, 120 ECE credits |
Keep this table bookmarked. For a deeper breakdown of every line item, including how the $450 voucher compares to bundled training packages, see the CASE Certification Cost 2026: Complete Pricing Breakdown. If you want a narrative walkthrough of what "hard" actually means on this exam - timing pressure, question density, domain weight - read How Hard Is the CASE Exam? Complete Difficulty Guide 2026.
Registration and Fee Mechanics
CASE registration isn't a simple "pay and schedule" flow like many vendor exams. There are two distinct cost layers candidates frequently confuse:
- Eligibility application fee: $100, nonrefundable, required when you're applying for exam eligibility without going through official EC-Council training.
- Exam voucher: $450 for the remote-proctored version, valid for 1 year from the date of purchase.
Because the voucher has a hard 1-year expiration, buying it before you're ready to schedule is a common mistake. Pair your purchase with a realistic study window - most candidates map this against the domain list before committing funds. For a full explanation of exam scheduling windows and blackout considerations, check CASE Exam Dates 2026: Testing Windows, Deadlines & Scheduling.
Key Takeaway
Don't purchase the $450 voucher until you've confirmed eligibility and blocked out a realistic 1-year study-and-schedule window - the voucher does not extend or refund.
The 10 CASE Domains at a Glance
CASE Java content maps to the secure software development lifecycle across 10 modules. Memorizing these by name - and understanding which lifecycle phase each one represents - is non-negotiable for exam-day pattern recognition.
Domain 1: Understanding Application Security, Threats, and Attacks
Foundational threat modeling concepts, common attack classes, and why security must be baked in rather than bolted on.
- OWASP-style attack categories
- Threat actor motivations and attack surfaces
Domain 2: Security Requirements Gathering
Translating business and compliance needs into concrete, testable security requirements early in the SDLC.
- Abuse-case and misuse-case elicitation
- Requirement traceability
Domain 3: Secure Application Design and Architecture
Design-level controls, secure design patterns, and architectural risk analysis before code is written.
- Defense-in-depth layering
- Trust boundary identification
Domain 4: Secure Coding Practices for Input Validation
Preventing injection-class vulnerabilities through canonicalization, allow-listing, and boundary checks.
- SQL/command/LDAP injection prevention
- Encoding and escaping strategy
Domain 5: Secure Coding Practices for Authentication and Authorization
Identity verification and access control implementation flaws that repeatedly appear in real-world breaches.
- Session-independent auth controls
- Role- and attribute-based access control
Domain 6: Secure Coding Practices for Cryptography
Correct use of cryptographic primitives and the common misuse patterns that undermine them.
- Key management lifecycle
- Algorithm selection pitfalls
Domain 7: Secure Coding Practices for Session Management
Token generation, session fixation, and secure session termination in Java web contexts.
- Session ID entropy requirements
- Timeout and invalidation logic
Domain 8: Secure Coding Practices for Error Handling
Preventing information leakage through stack traces, logs, and exception messages.
- Fail-secure exception design
- Logging without exposing sensitive data
Domain 9: Static and Dynamic Application Security Testing (SAST & DAST)
Tool-driven verification of secure coding outcomes across the pipeline.
- SAST vs. DAST tradeoffs
- Integrating scans into CI/CD
Domain 10: Secure Deployment and Maintenance
Hardening environments at release and sustaining security posture through patching and monitoring.
- Secure configuration baselines
- Patch management cadence
For a domain-by-domain study plan with time allocation guidance, the CASE Exam Domains 2026: Complete Guide to All 10 Content Areas goes deeper than this summary allows. And if you want a structured, multi-week preparation roadmap rather than a one-page reference, pair this cheat sheet with the CASE Study Guide 2026: How to Pass on Your First Attempt.
Eligibility Routes Explained
Not everyone reaches the exam the same way. EC-Council offers four eligibility paths for CASE:
- Official CASE training: Completing an accredited training course satisfies eligibility automatically - no separate application fee.
- Active ECSP status: Holders of the ECSP (EC-Council Certified Secure Programmer) credential qualify directly.
- Experience-based: At least 2 years of information-security or software-design experience, verified through the eligibility application.
- Accepted equivalent certification: Certain recognized certifications satisfy the prerequisite without additional coursework.
If you're applying through the experience or equivalent-certification route, expect the $100 nonrefundable eligibility application fee. This is separate from - and paid before - the $450 exam voucher. A full walk-through of documentation requirements and approval timing lives in CASE Requirements 2026: Eligibility, Prerequisites & How to Qualify.
Question Format and Exam-Day Logistics
All 50 questions are multiple-choice, delivered through the EC-Council Exam Portal via Remote Proctoring Services. There's no lab-based practical component on this version of the exam - the assessment is knowledge- and scenario-based, meaning questions often present a short code snippet, architecture description, or vulnerability scenario and ask you to identify the correct secure-coding fix or design decision.
Expect a mix of:
- Direct definitional questions (e.g., identifying a secure coding principle or attack type)
- Scenario questions describing a flawed implementation and asking for the best remediation
- Comparison questions distinguishing between similar concepts (SAST vs. DAST, authentication vs. authorization flaws, session fixation vs. hijacking)
Because the passing threshold is fixed at 70%, there's no domain-by-domain minimum - a strong domain can offset a weaker one. Still, uneven scores across the 10 modules increase risk on exam day. The CASE Passing Score 2026: Exactly What You Need to Pass article breaks down exactly how that 70% threshold is calculated and what margin of error to plan for.
High-Yield Topics Inside Each Domain Group
Rather than treating all 10 domains as equally dense, group them by lifecycle phase and prioritize accordingly:
Early Lifecycle (Domains 1-3)
Focus on threat modeling vocabulary, requirement-to-control traceability, and secure design patterns. These domains test conceptual understanding more than code-level detail, so definitions and "why" questions dominate.
Coding Practice Cluster (Domains 4-8)
This is the largest concentration of exam content by module count. Input validation, authentication/authorization, cryptography, session management, and error handling each carry distinct vulnerability classes and Java-specific mitigation patterns. Expect the exam to test recognition of insecure code patterns as much as memorized definitions.
Verification and Operations (Domains 9-10)
SAST/DAST distinctions and secure deployment practices close out the lifecycle. Candidates often underweight these two domains during study, then find them heavily represented on exam day.
Key Takeaway
Domains 4 through 8 (the secure coding practice cluster) deserve the largest share of your study hours - they cover five distinct vulnerability categories in Java-specific contexts.
Week-by-Week Domain Scheduling
If you're building a study calendar around the $450 voucher's 1-year validity, here's a compressed structure tying each week to specific domains rather than generic study advice:
Domains 1-2: Threats and Requirements
- Build a vocabulary sheet of attack classes and threat modeling terms
- Practice mapping business requirements to security requirements
Domain 3: Design and Architecture
- Study trust boundaries and secure design pattern examples
- Review architectural risk analysis case studies
Domains 4-6: Input Validation, Auth, Cryptography
- Work through Java code snippets illustrating injection flaws
- Compare authentication vs. authorization failure modes
- Review symmetric vs. asymmetric key management scenarios
Domains 7-8: Session Management and Error Handling
- Study session token entropy and invalidation logic
- Practice identifying information leakage in error messages
Domains 9-10: SAST/DAST and Deployment
- Contrast static vs. dynamic testing tool outputs
- Review secure configuration and patch management checklists
This schedule assumes prior software development familiarity. If you need a more granular breakdown of resource allocation and mock-exam timing, revisit the CASE Study Guide 2026: How to Pass on Your First Attempt, and run timed practice sessions on our CASE practice test platform to simulate the 2-hour, 50-question format before exam day.
Renewal: 3 Years, 120 ECE Credits
CASE Java certification isn't permanent. EC-Council requires renewal every 3 years through its standard ECE (EC-Council Continuing Education) program, and you'll need to accumulate 120 ECE credits within that window. Credits typically come from activities like attending conferences, publishing security research, completing additional training, or participating in approved professional development. Track your credits from the day you certify rather than scrambling in year two - it's far easier to spread 120 credits across three years than to compress them at the end.
Who Hires CASE-Certified Engineers
CASE is positioned squarely at the intersection of development and security - a niche that's grown as organizations shift left on application security. Typical hiring contexts include:
- Secure software development teams embedding security engineers directly into Java development squads
- Application security (AppSec) teams responsible for SAST/DAST tooling and remediation guidance
- DevSecOps roles integrating security gates into CI/CD pipelines
- Consulting and audit firms performing secure code review engagements
For a realistic look at how this certification affects hiring conversations and compensation expectations, see CASE Salary Guide 2026: Complete Earnings Analysis and the broader Is the CASE Certification Worth It? Complete ROI Analysis 2026 analysis. If you're exploring the job market itself rather than just the certification's value, CASE Jobs covers common role titles and postings that reference this credential.
Curious how CASE compares against candidates who skip formal training entirely, or what the overall pass landscape looks like? CASE Pass Rate 2026: What the Data Shows puts the exam's difficulty into broader context, and pairing that with timed drills on our practice exam engine is one of the more efficient ways to close knowledge gaps before spending the $450 voucher.
Frequently Asked Questions
This page covers CASE Java (312-96). CASE .NET (312-95) is a separate EC-Council exam with its own question bank, though both share the same secure SDLC philosophy.
The exam has 50 multiple-choice questions with a 2-hour time limit, delivered through the EC-Council Exam Portal via Remote Proctoring Services.
You need 70% to pass. There's no separate minimum per domain, so strong performance in one domain can offset a weaker one elsewhere.
The remote-proctored voucher costs $450 and is valid for 1 year from purchase. A separate $100 nonrefundable eligibility application fee applies if you qualify without official training.
No. You can also qualify through active ECSP status, at least 2 years of information-security or software-design experience, or an accepted equivalent certification, subject to the eligibility application process.