- CASE Java (312-96) requires a 70% passing score out of 50 multiple-choice questions.
- You have a strict 2-hour limit, roughly 2.4 minutes per question on average.
- The remote-proctored voucher costs $450 and is valid for one year from purchase.
- Eligibility requires official training, active ECSP status, 2+ years of experience, or an accepted equivalent, plus a $100 fee where applicable.
The Exact Passing Score
If you're searching for a single number, here it is: CASE Java (exam 312-96) requires a 70% passing score. Out of 50 multiple-choice questions, that works out to 35 correct answers. There is no published curve, no adaptive scoring, and no partial credit for multi-part reasoning - you either select the correct option or you don't. This is one of the more straightforward scoring models in the EC-Council catalog, but "straightforward" doesn't mean "easy." The 70% threshold is calculated across the entire exam, not per domain, which changes how you should think about weak spots.
This article focuses specifically on CASE Java, which is the credential this site is built around. If you're comparing routes, note that EC-Council also offers a separate CASE .NET exam (312-95) with its own question bank - the guidance here applies to the Java track only.
Exam Format and How Scoring Works
Understanding the passing score requires understanding the exam's mechanics, because the format directly shapes your test-day strategy.
- Question count: 50 multiple-choice questions
- Time limit: 2 hours (120 minutes)
- Passing score: 70% (35 of 50 correct)
- Delivery: EC-Council Exam Portal, available via Remote Proctoring Services
- Voucher cost: $450 for the remote-proctored version, valid for 1 year
That 2-hour window gives you a little under two and a half minutes per question, but not every question demands that long. Many CASE questions test whether you can identify a secure coding flaw in a short code snippet or match a vulnerability class to the correct mitigation - these can be answered quickly once you know the pattern. Others, particularly around cryptographic implementation choices or session management edge cases, require you to read carefully before committing. Budgeting your two hours unevenly, rather than pacing every question identically, is a smarter approach than a flat per-question timer.
Key Takeaway
Don't split 120 minutes evenly across 50 questions. Move fast through recall-based items so you bank time for the scenario-based questions on authentication, cryptography, and session handling.
Because the exam is delivered remotely, you'll also want logistics sorted well before test day - stable internet, a clean workspace, and ID ready for the proctor. For a full breakdown of scheduling windows and deadlines, see the CASE Exam Dates 2026 guide.
Domain Breakdown and Weighting
CASE Java's 50 questions are drawn from 10 domains covering the full secure software development life cycle. EC-Council doesn't publish an exact per-domain question count for public consumption, but the domain list itself tells you where the exam's attention is concentrated - from planning and architecture all the way through testing and deployment.
Domain 1: Understanding Application Security, Threats, and Attacks
Foundational coverage of the threat landscape and why security must be built into the SDLC rather than bolted on afterward.
- Common attack categories and their root causes
Domain 2: Security Requirements Gathering
How security requirements get elicited, documented, and validated alongside functional requirements.
- Abuse cases and misuse case modeling
Domain 3: Secure Application Design and Architecture
Design-phase decisions that prevent entire vulnerability classes before a single line of code is written.
- Threat modeling and secure design patterns
Domains 4-8: Secure Coding Practices
The largest cluster of the exam, spanning input validation, authentication and authorization, cryptography, session management, and error handling.
- Java-specific implementation flaws and their fixes
Domain 9: Static and Dynamic Application Security Testing (SAST & DAST)
Tooling and methodology for finding vulnerabilities before and after deployment.
- Differences between white-box and black-box testing approaches
Domain 10: Secure Deployment and Maintenance
Closing the loop - hardening environments, patch management, and secure configuration after release.
- Secure deployment checklists and ongoing maintenance practices
Notice that five of the ten domains (4 through 8) all fall under "secure coding practices." That single umbrella covers input validation, authentication/authorization, cryptography, session management, and error handling - meaning coding-level knowledge likely represents the single largest share of your 50 questions. For a deeper walkthrough of each domain with study priorities, read the CASE Exam Domains 2026 complete guide.
Where Candidates Actually Lose Points
Since the passing score is calculated across the whole exam rather than domain-by-domain, a candidate who is strong in five domains and weak in the other five can still fail even with an overall study effort that "feels" thorough. The domains most likely to cause trouble are the ones with dense, easily-confused technical details:
- Cryptography (Domain 6): Candidates often blur the lines between encryption, hashing, and encoding, or misapply symmetric versus asymmetric use cases.
- Authentication and Authorization (Domain 5): Session tokens, multi-factor flows, and access control models get mixed up under time pressure.
- Session Management (Domain 7): Overlaps conceptually with authentication, which makes it easy to answer questions from the wrong mental model.
- SAST & DAST (Domain 9): Requires knowing not just what each testing type does, but when in the SDLC each is appropriate.
If you want a candid assessment of how these overlapping domains affect overall difficulty, the How Hard Is the CASE Exam? Complete Difficulty Guide 2026 breaks this down further. And if you're curious how other candidates have historically performed, CASE Pass Rate 2026: What the Data Shows puts the passing score in context.
Registration, Fees, and Eligibility
Hitting 70% starts before you ever open the exam portal - it starts with confirming you're eligible and budgeting correctly. EC-Council requires candidates to qualify through one of several routes:
- Completing official CASE training
- Holding active ECSP status
- Having at least 2 years of information-security or software-design experience
- Holding an accepted equivalent certification
Candidates who don't come through official training typically pay a $100 nonrefundable eligibility application fee before they can purchase an exam voucher. The remote-proctored CASE Java voucher itself is $450 and remains valid for 1 year from the date of purchase, so there's no need to rush a testing date the moment you buy it - but you also don't want it to expire unused. For the full eligibility decision tree, see CASE Requirements 2026: Eligibility, Prerequisites & How to Qualify, and for a complete cost breakdown including training options, see CASE Certification Cost 2026: Complete Pricing Breakdown.
| Item | Detail |
|---|---|
| Passing score | 70% (35 of 50 questions) |
| Question format | 50 multiple-choice questions |
| Time limit | 2 hours |
| Voucher cost | $450 (remote proctored, valid 1 year) |
| Eligibility fee | $100 nonrefundable, where applicable |
| Renewal cycle | 3 years, 120 ECE credits |
A Domain-Focused Prep Schedule
Generic study techniques like spaced repetition or timed review sessions only help if they're pointed at the right material. Given that the secure coding cluster (Domains 4-8) makes up half the domain list, your schedule should weight time accordingly rather than spending equal days on every topic.
Foundations and Design
- Domain 1: threat and attack categories
- Domain 2: security requirements gathering
- Domain 3: secure design and architecture, including threat modeling
Input, Auth, and Crypto
- Domain 4: input validation flaws and fixes
- Domain 5: authentication and authorization patterns
- Domain 6: cryptography fundamentals and common misuse
Session, Errors, and Testing
- Domain 7: session management
- Domain 8: secure error handling
- Domain 9: SAST versus DAST use cases
Deployment and Full Review
- Domain 10: secure deployment and maintenance
- Timed practice runs under the 2-hour limit
- Targeted review of your weakest domain cluster
For a more detailed walkthrough of how to sequence these weeks with practice materials, the CASE Study Guide 2026: How to Pass on Your First Attempt goes deeper into resource selection. It's also worth running full-length timed simulations on our practice test platform so the 70% threshold stops being abstract and starts reflecting your actual, current readiness.
Key Takeaway
Spend roughly half your prep time on Domains 4-8 combined, since they collectively represent the largest and most detail-heavy portion of the exam content.
After You Pass: Renewal and Career Use
Clearing 70% is the finish line for the exam itself, but the credential doesn't stay active forever without upkeep. CASE follows EC-Council's standard 3-year renewal cycle, requiring 120 ECE credits to maintain certification status. Planning for renewal early - through conference attendance, training, or other approved activities - keeps you from scrambling near the deadline.
On the career side, CASE is typically pursued by developers, application security engineers, and QA professionals who need to demonstrate secure-coding competency to employers. If you're weighing whether the investment pays off, Is the CASE Certification Worth It? Complete ROI Analysis 2026 and CASE Salary Guide 2026: Complete Earnings Analysis cover the broader context, while CASE Jobs outlines the kinds of roles that value this credential. For a fast-reference version of everything covered here, bookmark the CASE Cheat Sheet 2026: One-Page Review of Must-Know Facts, and once you're ready to test your knowledge against realistic questions, head back to the main practice test platform.
Frequently Asked Questions
You need 70%, which means answering at least 35 of the 50 multiple-choice questions correctly within the 2-hour time limit.
The 70% threshold is calculated across the full 50-question exam as a whole, not per individual domain, so strength in some domains can offset weaker areas as long as your total stays at or above 35 correct.
The remote-proctored voucher is $450 and is valid for 1 year. Candidates who aren't coming through official training may also owe a $100 nonrefundable eligibility application fee.
No. Eligibility can also be met through active ECSP status, at least 2 years of relevant information-security or software-design experience, or an accepted equivalent certification, in addition to official CASE training.
No, CASE follows EC-Council's 3-year renewal cycle, and maintaining active status requires earning 120 ECE credits within that period.