- A CASE is a Certified Application Security Engineer, an EC-Council credential focused on the secure SDLC.
- CASE Java (312-96) has 50 questions, a 2-hour limit, and a 70% passing score.
- The remote-proctored CASE Java voucher currently costs $450 and is valid for one year.
- Eligibility runs through official training, ECSP status, 2+ years of experience, or an accepted equivalent, with a $100 fee where applicable.
What Is A CASE, Exactly?
A CASE is a Certified Application Security Engineer - a professional who holds EC-Council's credential validating hands-on ability to design, build, test, and maintain software using secure coding practices. It's not a generic "security awareness" badge. It's a role-based certification built around the actual phases developers and security engineers move through when shipping an application: gathering security requirements, architecting defenses, writing input-validation and authentication logic correctly, testing for vulnerabilities, and hardening deployment.
If you've landed here after reading about CASE Certification in general terms, or after searching What Is CASE?, CASE Meaning, or What Does CASE Stand For?, this article answers the more specific question: what does it mean to be a CASE, and what does earning that title actually require? For a companion piece on the term itself, see What Does CASE Mean? and What Is CASE Certification?.
CASE Java vs. CASE .NET
EC-Council actually issues two separate CASE exams: CASE Java (312-96) and CASE .NET (312-95). They share the same conceptual framework - secure requirements, architecture, coding, testing, deployment - but the coding-practice questions and code samples are language-specific. This site, CASE Exam Prep, focuses exclusively on CASE Java (312-96), so every domain breakdown, question-format note, and registration detail below refers to the Java track unless stated otherwise.
If you're unsure which track fits your career path, consider which language your current or target employer actually uses in production. Candidates coming from Spring, Java EE, or Android backgrounds should stick with CASE Java; those working primarily in C# or the Microsoft stack should look at the .NET track instead.
The 10 Domains a CASE Credential Actually Tests
Unlike broader security certifications that survey many unrelated topics, CASE Java is built around a linear development narrative. The 10 domains map to phases of the secure SDLC, and questions are written to test whether you can apply the concept to Java code, not just recite a definition.
Domain 1: Understanding Application Security, Threats, and Attacks
Establishes the baseline: common vulnerability classes, attacker motivations, and how insecure design decisions turn into exploitable flaws.
- Recognize threat categories tied to specific coding mistakes
Domain 2: Security Requirements Gathering
Covers how security requirements get elicited and documented before a line of code is written, including abuse cases and misuse-case modeling.
- Translate business requirements into testable security requirements
Domain 3: Secure Application Design and Architecture
Focuses on architectural controls - trust boundaries, layered defenses, secure design patterns - that reduce the attack surface before implementation begins.
- Apply threat modeling output to architectural decisions
Domain 4: Secure Coding Practices for Input Validation
Tests whether you know how to prevent injection-class vulnerabilities through proper validation, sanitization, and encoding in Java code.
- Identify unsafe input-handling patterns in sample code
Domain 5: Secure Coding Practices for Authentication and Authorization
Covers correct implementation of identity verification and access control, including common flaws that let attackers bypass either.
- Distinguish authentication failures from authorization failures
Domain 6: Secure Coding Practices for Cryptography
Tests knowledge of proper key management, algorithm selection, and common cryptographic misuse in Java applications.
- Spot weak or deprecated cryptographic implementations
Domain 7: Secure Coding Practices for Session Management
Covers secure session handling: token generation, expiration, and protection against session fixation or hijacking.
- Evaluate session lifecycle controls in code samples
Domain 8: Secure Coding Practices for Error Handling
Focuses on preventing information leakage through verbose errors and stack traces, plus fail-secure design principles.
- Recognize error-handling patterns that expose internals
Domain 9: Static and Dynamic Application Security Testing (SAST & DAST)
Tests understanding of both testing methodologies - analyzing code without execution versus testing a running application - and when each is appropriate.
- Compare SAST and DAST tooling outputs and use cases
Domain 10: Secure Deployment and Maintenance
Covers hardening configurations, patch management, and ongoing monitoring once an application reaches production.
- Apply secure configuration baselines to deployment pipelines
For a deeper walkthrough of weighting, question style, and study priorities per domain, read the full CASE Exam Domains 2026: Complete Guide to All 10 Content Areas.
Exam Format and Registration Mechanics
Knowing the domains matters, but so does knowing the mechanics of actually sitting for the exam. CASE Java is delivered through the EC-Council Exam Portal, and candidates can take it via Remote Proctoring Services rather than traveling to a physical test center.
| Detail | Specification |
|---|---|
| Exam code | 312-96 (CASE Java) |
| Delivery | EC-Council Exam Portal, Remote Proctoring Services |
| Number of questions | 50, multiple choice |
| Time limit | 2 hours |
| Passing score | 70% |
| Remote-proctored voucher cost | $450 |
| Voucher validity | 1 year |
Every question is multiple choice, but many are scenario-based - a short code snippet or a described development situation followed by a question about what's wrong or what should be done next. That format rewards candidates who can read Java code critically, not just memorize vocabulary lists. If you want a granular breakdown of what a 70% cutoff means in terms of questions you can miss, see CASE Passing Score 2026: Exactly What You Need to Pass. For the full cost picture including training and eligibility fees, check CASE Certification Cost 2026: Complete Pricing Breakdown.
Who Can Sit for the Exam
EC-Council gates access to the CASE exam more tightly than many vendor-neutral certifications. There are four accepted routes:
- Official CASE training: Completing an EC-Council-authorized CASE course satisfies eligibility directly.
- Active ECSP status: Holders of the EC-Council Certified Secure Programmer credential are already deemed eligible.
- Experience-based eligibility: At least 2 years of information-security or software-design experience, submitted through an eligibility application.
- Accepted equivalent certification: Certain other credentials may be recognized as meeting the bar.
Where an eligibility application is required (i.e., you're not coming through official training), a $100 nonrefundable eligibility application fee applies. Plan for this as a separate line item from the $450 exam voucher. A complete breakdown of each pathway, including documentation tips, is available in CASE Requirements 2026: Eligibility, Prerequisites & How to Qualify. If you're weighing whether formal instruction is worth the investment on top of the exam fee, see CASE Training.
Key Takeaway
Don't assume you can register on exam day alone - budget time for the eligibility application (and its $100 fee, if applicable) before you commit to a testing date.
Who Hires People With A CASE
Because the credential is built around the secure SDLC rather than network defense or governance, the roles that value it skew toward hands-on development and application security work: secure software developers, application security engineers, DevSecOps practitioners, code reviewers, and QA/test engineers who specialize in security testing. Organizations that build custom software in-house - especially those handling regulated data - tend to look for this specific combination of coding fluency and security judgment, rather than a purely defensive-security background.
If you're mapping the credential to career outcomes, CASE Jobs covers the job titles and responsibilities typically associated with the certification, while CASE Salary Guide 2026: Complete Earnings Analysis and Is the CASE Certification Worth It? Complete ROI Analysis 2026 walk through how the credential tends to factor into hiring conversations and compensation discussions.
Mapping Study Time to the Domains
Because CASE Java's 10 domains follow the actual order of the SDLC, it makes sense to study them roughly in sequence rather than jumping around. A candidate with a Java background but limited formal security training typically needs more time on the domains dealing with cryptography and session management than on input validation, which most developers have already encountered in some form.
Foundations
- Work through Domain 1 (threats and attacks) and Domain 2 (security requirements)
- Build a glossary of vulnerability classes referenced later in coding domains
Design and Input Handling
- Study Domain 3 (architecture) and Domain 4 (input validation)
- Practice reading Java code samples for injection-style flaws
Identity and Cryptography
- Cover Domain 5 (authentication/authorization) and Domain 6 (cryptography) - often the densest material
- Drill common misconfiguration patterns in each area
Sessions, Errors, and Testing
- Work through Domain 7 (session management) and Domain 8 (error handling)
- Study Domain 9 (SAST/DAST) and compare tool categories directly
Deployment and Review
- Finish Domain 10 (secure deployment and maintenance)
- Run full-length practice questions under the real 2-hour, 50-question limit
For a more detailed week-by-week plan with resource recommendations, see the CASE Study Guide 2026: How to Pass on Your First Attempt. If you want a single reference sheet to review in the final days before your exam, bookmark the CASE Cheat Sheet 2026: One-Page Review of Must-Know Facts. And if you're still gauging how much effort this actually takes relative to other credentials, How Hard Is the CASE Exam? Complete Difficulty Guide 2026 and CASE Pass Rate 2026: What the Data Shows are worth reading before you lock in a study timeline.
Keeping the Credential Active
Passing the exam isn't the end of the story. Like other EC-Council credentials, CASE follows the standard 3-year renewal cycle, requiring 120 ECE (Continuing Education) credits to keep the certification active. Credits typically come from activities like attending relevant training, contributing to the security community, or completing approved continuing-education content. Treat this as part of the total cost of holding the credential, not an afterthought - it's a recurring commitment on top of the initial $450 exam fee and any training expenses.
You can practice full-length simulations and review domain-specific question sets anytime at CASE Exam Prep's practice test platform, whether you're preparing for your first attempt or refreshing knowledge ahead of renewal-related coursework.
Frequently Asked Questions
No. ECSP (EC-Council Certified Secure Programmer) is a related, generally more introductory credential, and active ECSP status is actually one of the accepted eligibility routes into the CASE exam.
No. The exam tests secure coding principles applied to Java generally across the 10 domains, rather than certifying expertise in a single framework or library.
With 70% required out of 50 questions, you need 35 correct answers, leaving room for up to 15 misses.
Yes. CASE Java is available through Remote Proctoring Services via the EC-Council Exam Portal, so on-site testing isn't required.
The $100 eligibility application fee is nonrefundable, which is why it's worth reviewing the accepted pathways - training, ECSP status, experience, or equivalent certification - carefully before applying.