- Eligibility Routes to CASE
- The 2-Year Experience Prerequisite
- The $100 Eligibility Application Fee
- Exam Mechanics You Must Qualify Against
- Mapping Requirements to the 10 Domains
- Step-by-Step: Registering for CASE Java
- Who Actually Qualifies (and Who Hires CASE Holders)
- Maintaining Eligibility After Certification
- Frequently Asked Questions
- Four eligibility routes exist: official training, active ECSP status, 2 years of security/dev experience, or an accepted equivalent cert.
- Self-study candidates without training must pay a nonrefundable $100 eligibility application fee.
- The CASE Java remote-proctored voucher costs $450 and stays valid for 1 year from purchase.
- You need 70% on 50 multiple-choice questions within a 2-hour window to pass.
Eligibility Routes to CASE
Before you can sit for the CASE Java exam (312-96), EC-Council requires you to demonstrate that you're qualified to take it. Unlike open-enrollment exams, CASE gates access through one of four accepted eligibility routes. Understanding which route applies to you determines whether you pay for official training, submit an experience application, or move straight to voucher purchase.
- Official CASE training: Completing an EC-Council-authorized CASE course automatically satisfies eligibility - no separate application needed.
- Active ECSP status: If you already hold the EC-Council Certified Secure Programmer (ECSP) credential in good standing, you're pre-qualified.
- Professional experience: At least 2 years of verifiable information-security or software-design experience.
- Accepted equivalent certification: Holding certain recognized security or development certifications can substitute for formal training.
If you're still deciding whether the credential fits your career path, the overview at What Is CASE Certification? and the broader breakdown in CASE Certification are good starting points before you commit to an eligibility route.
The 2-Year Experience Prerequisite
For candidates without official training or ECSP status, the experience route is the most common path - and the one most likely to trip people up. EC-Council wants to see documented, verifiable experience in information security or software design, not just tangential IT work. That means roles involving secure coding, application architecture, vulnerability assessment, code review, or security testing all count toward the 2-year threshold.
If your background is heavier on general development than security specifically, it still often qualifies, since CASE explicitly targets developers who write secure code rather than pure security analysts. The exam's own domain structure - covering everything from Secure Coding Practices for Input Validation to Static and Dynamic Application Security Testing (SAST & DAST) - reflects that dual developer/security orientation.
Domain 1: Understanding Application Security, Threats, and Attacks
This foundational domain tests whether your experience actually maps to real application security concepts, not just general programming.
- Common attack vectors against web and enterprise applications
- The relationship between vulnerabilities, threats, and exploits in the SDLC context
The $100 Eligibility Application Fee
If you're relying on the experience or equivalent-certification route rather than official training, expect to pay a $100 nonrefundable eligibility application fee. This fee is separate from the exam voucher and covers EC-Council's review of your submitted experience documentation or credential proof.
A few practical points worth planning around:
- The fee is nonrefundable regardless of whether your application is approved or denied.
- Candidates who complete official CASE training typically skip this fee entirely, since training satisfies eligibility directly.
- Processing takes time, so submit your eligibility application well before you intend to schedule the exam.
For a full accounting of every dollar involved - training, eligibility fee, voucher, and potential retakes - see CASE Certification Cost 2026: Complete Pricing Breakdown.
Key Takeaway
Budget the $100 eligibility fee and the $450 exam voucher as two separate line items - they are billed independently and neither substitutes for the other.
Exam Mechanics You Must Qualify Against
Once eligibility is confirmed, the actual exam requirement is straightforward on paper but demanding in practice: 50 multiple-choice questions in 2 hours, with a 70% passing score required. That's roughly 35 correct answers out of 50, and roughly 2.4 minutes per question on average - though question difficulty is not evenly distributed across the 10 domains.
| Requirement | Detail |
|---|---|
| Question format | 50 multiple-choice questions |
| Time limit | 2 hours |
| Passing score | 70% |
| Delivery method | EC-Council Exam Portal, Remote Proctoring Services |
| Voucher cost | $450 (CASE Java, remote-proctored) |
| Voucher validity | 1 year from purchase |
The exact score threshold, and why it's calibrated the way it is, is covered in more depth in CASE Passing Score 2026: Exactly What You Need to Pass. If you're trying to gauge overall difficulty before committing time and money, How Hard Is the CASE Exam? Complete Difficulty Guide 2026 and CASE Pass Rate 2026: What the Data Shows put the requirements in context.
Mapping Requirements to the 10 Domains
Meeting the eligibility bar is only half the equation - the real qualifying work is mastering the content across all 10 domains EC-Council tests. These domains trace the secure software development life cycle end to end, and none of them can be safely skipped since the exam draws from the full set.
Domain 2: Security Requirements Gathering
Candidates must know how to translate business and compliance needs into concrete, testable security requirements before a single line of code is written.
- Threat modeling inputs that shape requirements
- Distinguishing functional vs. non-functional security requirements
Domain 3: Secure Application Design and Architecture
This domain tests architectural decision-making - where trust boundaries go, how components are segmented, and how design choices prevent entire classes of vulnerabilities.
- Secure design patterns and principles like least privilege
- Layered architecture and defense-in-depth reasoning
Domains 4-8: Secure Coding Practices
The largest cluster of domains covers hands-on secure coding: input validation, authentication and authorization, cryptography, session management, and error handling. Expect scenario-based questions asking you to identify flawed code patterns or select the correct remediation.
- Input sanitization and validation techniques against injection attacks
- Secure session token handling and proper error/exception handling that avoids information leakage
Domain 9: Static and Dynamic Application Security Testing (SAST & DAST)
You'll need working familiarity with how static and dynamic testing tools operate, what each catches, and where each falls short.
- Differences between SAST (code-level) and DAST (runtime) testing
- Interpreting scan results and prioritizing remediation
Domain 10: Secure Deployment and Maintenance
The final domain covers what happens after release - secure configuration, patch management, and ongoing monitoring.
- Secure deployment checklists and hardening practices
- Maintenance-phase vulnerability management
For a domain-by-domain breakdown with weighting considerations and study priorities, read CASE Exam Domains 2026: Complete Guide to All 10 Content Areas. Pairing that with a structured plan from CASE Study Guide 2026: How to Pass on Your First Attempt gives you a complete qualification roadmap, not just an eligibility checklist.
Confirm Eligibility, Start Foundation Domains
- Submit eligibility application or confirm training/ECSP status
- Study Domains 1-3: threats, requirements, architecture
Secure Coding Core
- Work through Domains 4-8 with real code examples
- Practice spotting vulnerable code snippets under time pressure
Testing and Deployment
- Cover Domains 9-10: SAST/DAST tooling and secure deployment
- Purchase the $450 voucher once you feel domain-ready
Full Review and Scheduling
- Take full-length practice tests against the 2-hour, 50-question format
- Schedule your remote-proctored session
Step-by-Step: Registering for CASE Java
Once you've satisfied one of the four eligibility routes, registration follows a predictable sequence:
- Confirm your eligibility route. Training completion, active ECSP, verified 2-year experience, or accepted equivalent certification.
- Submit the eligibility application if required. Pay the $100 nonrefundable fee for experience- or equivalent-cert-based applications.
- Purchase your exam voucher. The CASE Java remote-proctored voucher is $450 and valid for 1 year.
- Schedule your remote-proctored session. Coordinate timing through the EC-Council Exam Portal.
- Sit the exam. 50 multiple-choice questions, 2-hour limit, 70% passing score.
If timing flexibility matters to your schedule, review CASE Exam Dates 2026: Testing Windows, Deadlines & Scheduling before locking in your voucher, since the 1-year validity window starts counting down immediately upon purchase.
Who Actually Qualifies (and Who Hires CASE Holders)
In practice, three groups tend to clear the eligibility bar most easily: application developers moving into security-focused roles, security analysts who write or review code regularly, and QA/testing professionals transitioning into application security testing. Organizations hiring for secure development and AppSec testing roles frequently list CASE as a preferred or accepted credential, particularly where SAST/DAST tooling and secure SDLC practices are part of daily work.
If you're weighing whether qualifying for and earning CASE actually pays off in your job search, CASE Jobs and CASE Salary Guide 2026: Complete Earnings Analysis cover the employer and compensation side, while Is the CASE Certification Worth It? Complete ROI Analysis 2026 weighs the eligibility investment against career return.
Maintaining Eligibility After Certification
Qualifying for CASE isn't a one-time event. Like other EC-Council credentials, CASE follows a 3-year renewal cycle requiring 120 ECE (Continuing Education) credits to remain active. This means passing the exam is the start of an ongoing eligibility relationship with EC-Council, not a permanent, static achievement.
- Track ECE-eligible activities (training, conferences, writing, teaching) throughout each 3-year cycle rather than scrambling near the deadline.
- Renewal keeps your credential - and any employer-facing eligibility claims - current and verifiable.
For quick reference during both initial prep and renewal planning, bookmark CASE Cheat Sheet 2026: One-Page Review of Must-Know Facts. And if you're still clarifying terminology before diving into requirements, foundational pieces like What Is CASE?, CASE Meaning, What Does CASE Stand For?, What Is A CASE?, and What Does CASE Mean? fill in the basics.
Once you've mapped your eligibility route and are ready to test your domain knowledge against exam-style questions, practicing on our CASE practice test platform is the most direct way to confirm you're actually ready - not just eligible on paper. Working through timed question sets on the main practice site before your remote-proctored session helps close the gap between meeting the prerequisites and actually passing within the 2-hour window.
Frequently Asked Questions
EC-Council accepts information-security or software-design experience, so general development work - particularly involving secure coding, code review, or architecture - typically counts toward the 2-year requirement.
No. The nonrefundable $100 fee applies to candidates using the experience or accepted-equivalent-certification routes. Completing official CASE training generally satisfies eligibility without this fee.
The CASE Java remote-proctored voucher, priced at $450, is valid for 1 year from the date of purchase, so schedule your exam within that window.
Yes. Holding active ECSP (EC-Council Certified Secure Programmer) status is one of the four accepted eligibility routes and bypasses the experience application and its fee.
CASE follows EC-Council's standard 3-year renewal cycle requiring 120 ECE credits. Failing to accumulate them within the cycle puts your certification's active status at risk, so plan continuing education activities throughout the cycle rather than at the end.