- Overview: How EC-Council Structures the CASE Java Exam
- Domain 1: Understanding Application Security, Threats, and Attacks
- Domain 2: Security Requirements Gathering
- Domain 3: Secure Application Design and Architecture
- Domain 4: Secure Coding Practices for Input Validation
- Domain 5: Secure Coding Practices for Authentication and Authorization
- Domain 6: Secure Coding Practices for Cryptography
- Domain 7: Secure Coding Practices for Session Management
- Domain 8: Secure Coding Practices for Error Handling
- Domain 9: Static and Dynamic Application Security Testing
- Domain 10: Secure Deployment and Maintenance
- Mapping the Domains to a Study Schedule
- Who Actually Uses These Domains on the Job
- Frequently Asked Questions
- CASE Java (312-96) covers 10 domains across the full secure SDLC, from requirements to maintenance.
- The exam has 50 multiple-choice questions, a 2-hour limit, and a 70% passing score.
- Four domains focus specifically on secure coding: input validation, auth, cryptography, session management, and error handling.
- Domain 9 (SAST/DAST) tests tool-based testing concepts, not just manual code review.
Overview: How EC-Council Structures the CASE Java Exam
The Certified Application Security Engineer (CASE) Java credential, exam code 312-96, is EC-Council's answer to a persistent gap in software teams: developers who can write functional code but haven't been trained to think like attackers. Unlike broad security certifications that skim across networking, governance, and incident response, CASE stays laser-focused on one thing - building and shipping secure applications across the entire software development life cycle.
That focus shows up in the exam blueprint. CASE Java is organized into 10 content domains that trace the natural order of a secure SDLC: understanding threats first, gathering security requirements second, designing defensively third, then moving through the actual secure coding practices developers apply daily, before finishing with testing, deployment, and maintenance. If you're still deciding whether this credential fits your career path, our overview of what CASE certification actually is is a good place to start before diving into domain-level detail.
The exam itself is delivered through the EC-Council Exam Portal via Remote Proctoring Services, consists of 50 multiple-choice questions, and gives candidates a 2-hour window to finish. You need a 70% score to pass. Every one of the 10 domains below can appear on any given exam form, so skipping one because it "feels less important" is a common way candidates lose points they didn't need to lose.
Domain 1: Understanding Application Security, Threats, and Attacks
What This Domain Covers
This is the foundational domain - it establishes the vocabulary and mental model for everything that follows. Candidates need to recognize common attack categories, understand the OWASP Top 10 conceptually, and know how vulnerabilities map to real-world exploitation techniques.
- Classifying threats by attack surface (client-side, server-side, network, third-party components)
- Distinguishing between application-layer attacks and infrastructure-layer attacks
- Recognizing how a single unpatched vulnerability can cascade into a full breach
Questions in this domain tend to be scenario-based rather than pure definitions. Expect a short description of an application behavior and a question asking which attack category it represents. This is also where candidates first encounter EC-Council's terminology conventions, which stay consistent across the rest of the exam.
Domain 2: Security Requirements Gathering
What This Domain Covers
Before a single line of code is written, secure applications start with requirements that explicitly account for abuse cases, not just use cases. This domain tests whether you understand how to translate business and compliance needs into concrete, testable security requirements.
- Differentiating functional requirements from non-functional security requirements
- Building misuse and abuse case scenarios alongside standard use cases
- Aligning requirements with regulatory and compliance drivers
Candidates sometimes underestimate this domain because it feels "less technical" compared to coding-heavy sections. That's a mistake - questions here often test your ability to spot a requirements document that's missing a critical security control, which is a practical skill EC-Council expects working engineers to have.
Domain 3: Secure Application Design and Architecture
What This Domain Covers
This domain bridges requirements and implementation. You're expected to know secure design principles and how architectural decisions either reduce or amplify risk before code even exists.
- Applying principles like least privilege, defense in depth, and fail-secure defaults
- Evaluating layered architecture patterns for security trade-offs
- Threat modeling techniques used during the design phase
Expect questions that present two architectural approaches and ask which better satisfies a stated security requirement. This domain rewards conceptual understanding over memorization, and it sets up the reasoning you'll apply in every secure coding domain that follows.
Key Takeaway
Domains 1 through 3 are conceptual and design-oriented - master them first, since every secure coding domain afterward assumes you already understand threat modeling and design principles.
Domain 4: Secure Coding Practices for Input Validation
What This Domain Covers
Input validation is where most real-world Java vulnerabilities originate, so this domain carries significant practical weight. Expect coverage of injection flaws, unsafe deserialization, and validation strategy.
- Whitelisting versus blacklisting validation approaches
- Preventing SQL injection, command injection, and XSS through proper input handling
- Server-side validation requirements even when client-side checks exist
Questions may show a Java code snippet with a validation flaw and ask you to identify the vulnerability or the correct remediation. If code-reading questions concern you, the CASE Study Guide walks through how to approach these snippet-based items methodically.
Domain 5: Secure Coding Practices for Authentication and Authorization
What This Domain Covers
This domain separates two frequently confused concepts - proving identity versus granting access - and tests secure implementation patterns for both.
- Secure password storage, credential handling, and multi-factor authentication concepts
- Role-based and attribute-based access control models
- Common authorization flaws like broken access control and privilege escalation
Expect at least a few questions distinguishing authentication failures from authorization failures - a distinction that's easy to blur under time pressure but that EC-Council tests deliberately.
Domain 6: Secure Coding Practices for Cryptography
What This Domain Covers
This is typically the domain candidates find most technically dense. You need working knowledge of cryptographic concepts as they apply to application code, not deep mathematical theory.
- Symmetric versus asymmetric encryption use cases in application design
- Secure key management and storage practices
- Common cryptographic mistakes: weak algorithms, hardcoded keys, improper randomness
If cryptography is a weak spot for you, treat it as its own study block rather than folding it into a general "secure coding" review session - it deserves dedicated time given its density.
Domain 7: Secure Coding Practices for Session Management
What This Domain Covers
Sessions are the connective tissue of most web applications, and this domain tests how well you understand securing that layer end to end.
- Secure session token generation, storage, and expiration
- Preventing session fixation and session hijacking
- Proper use of secure cookie attributes
This domain pairs closely with Domain 5 conceptually - a weak session management implementation can undo an otherwise strong authentication system, and the exam sometimes tests that connection directly.
Domain 8: Secure Coding Practices for Error Handling
What This Domain Covers
Error handling is often overlooked by developers but heavily tested here, because poor error handling frequently leaks information attackers can use.
- Avoiding verbose error messages that expose stack traces or system details
- Centralized exception handling patterns in Java applications
- Logging practices that support security monitoring without exposing sensitive data
This domain is shorter in scope than Domains 4-6 but still shows up reliably on the exam - don't skip it just because it seems minor.
Domain 9: Static and Dynamic Application Security Testing (SAST & DAST)
What This Domain Covers
This domain shifts from writing secure code to verifying it. Candidates need to understand both testing methodologies conceptually and know when each is appropriate.
- How static analysis inspects source code without execution, and its limitations
- How dynamic analysis tests a running application, and what it catches that SAST misses
- Combining SAST and DAST results into a coherent remediation workflow
Expect comparison-style questions asking which testing approach would catch a specific vulnerability type. Understanding the complementary strengths of each method is more important than memorizing specific tool names.
| Aspect | SAST | DAST |
|---|---|---|
| When Applied | Source code, pre-runtime | Running application, runtime |
| Visibility | Full code access | Black-box, external perspective |
| Best For | Coding flaws, insecure patterns | Runtime behavior, config issues |
Domain 10: Secure Deployment and Maintenance
What This Domain Covers
Security doesn't end at deployment. This final domain tests ongoing operational responsibilities that keep an application secure after release.
- Secure configuration management and hardened deployment environments
- Patch management and vulnerability disclosure handling
- Monitoring, incident response readiness, and secure decommissioning
This domain often gets shortchanged in study plans because candidates run out of time after focusing heavily on the coding domains. Reserve dedicated review time for it - it's a full domain on the blueprint, not an afterthought.
Mapping the Domains to a Study Schedule
Rather than studying domains in random order, sequence your prep to match the SDLC flow the exam follows. A study block built around the 10 domains might look like this:
Foundations
- Domain 1: threats and attack classification
- Domain 2: security requirements gathering
Design
- Domain 3: secure architecture and threat modeling
- Begin Domain 4: input validation basics
Core Secure Coding
- Domain 5: authentication and authorization
- Domain 6: cryptography
Coding Wrap-Up and Testing
- Domain 7: session management
- Domain 8: error handling
- Domain 9: SAST/DAST concepts
Deployment and Review
- Domain 10: secure deployment and maintenance
- Full-length practice runs on the practice test platform
This sequencing mirrors how a real application moves from concept to production, which reinforces retention better than jumping between unrelated topics. For a deeper breakdown of pacing and technique, the CASE Study Guide covers how to allocate review time once you've completed a first pass through all 10 domains.
Who Actually Uses These Domains on the Job
The 10 domains aren't academic - they map directly to responsibilities held by application security engineers, secure code reviewers, DevSecOps engineers, and senior Java developers tasked with security ownership on their teams. Organizations that build or maintain custom Java applications, especially in regulated industries, look for candidates who can demonstrate this exact breadth: from writing secure requirements to reviewing SAST/DAST output to hardening a production deployment.
If you're evaluating whether this maps to real hiring demand, it's worth checking our notes on CASE-related job roles and reading through the broader ROI analysis for CASE certification before committing study time. Candidates coming from a pure development background sometimes wonder how this credential differs from general security certifications - our CASE Certification overview and What Is CASE? explainer both cover that distinction in plain terms.
Registration and Eligibility Notes Tied to the Domains
Because CASE tests applied secure-coding knowledge rather than theory alone, EC-Council gates access through eligibility requirements: completing official CASE training, holding active ECSP status, having at least 2 years of information-security or software-design experience, or holding an accepted equivalent certification. Where the training route isn't used, a $100 nonrefundable eligibility application fee applies. Once approved, the remote-proctored voucher costs $450 and is valid for 1 year, giving you a full year to schedule your session through the EC-Council Exam Portal.
Full details on qualifying, including what counts as acceptable experience documentation, are covered in our CASE Requirements guide. For a line-item look at every fee involved, see the CASE Certification Cost breakdown.
Key Takeaway
You need a 70% score across all 10 domains combined - there's no minimum score required per individual domain, so a strong showing in coding domains can offset a weaker one elsewhere.
Frequently Asked Questions
EC-Council does not publish a per-domain weighting breakdown for the 50-question exam, so the safest approach is to prepare all 10 domains thoroughly rather than assuming any single domain is safe to skip.
Domain 6 (Cryptography) tends to be the most technically dense for candidates without a strong crypto background, while Domain 9 (SAST/DAST) can be challenging for those who haven't used security testing tools professionally. For a broader look at difficulty factors, see How Hard Is the CASE Exam?
The domain focuses on testing methodology and concepts - how static and dynamic analysis differ and what each catches - rather than requiring memorization of specific vendor tools.
The 70% threshold applies to your overall score across all 50 questions combined, not to each domain individually. Details on exactly how this is calculated are in our CASE Passing Score guide.
Since the exam is delivered via Remote Proctoring Services through the EC-Council Exam Portal, scheduling is flexible within your voucher's 1-year validity. Our CASE Exam Dates guide covers how to plan scheduling around your study timeline.