- CASE Java (312-96) is a 50-question, 2-hour exam requiring a 70% score to pass.
- The remote-proctored voucher costs $450 and stays valid for 1 year from purchase.
- Eligibility comes from official training, active ECSP status, 2 years of security/dev experience, or an equivalent cert.
- The exam maps directly to 10 modules covering the full secure SDLC, not just coding syntax.
What CASE Certification Actually Is
Certified Application Security Engineer (CASE) is an EC-Council credential built for developers, architects, and security engineers who need to prove they can write and review code that resists real-world attacks - not just describe security concepts in the abstract. Instead of testing general application security theory, CASE ties every exam objective to the secure software development life cycle: requirements gathering, threat modeling, secure architecture, defensive coding, testing, deployment, and ongoing maintenance.
This site focuses specifically on CASE Java (exam 312-96), EC-Council's version aimed at candidates who build and secure Java-based applications. There's a separate CASE .NET exam (312-95) with its own code base and syntax focus, but the underlying philosophy and domain structure are nearly identical between the two tracks. If you're comparing the broader question of what the credential represents before diving into exam mechanics, our companion pieces on What Is CASE?, CASE Meaning, and What Does CASE Stand For? cover the terminology and history in more depth.
CASE Java vs. CASE .NET
EC-Council offers two parallel CASE exams so candidates can certify against the stack they actually use on the job:
| Attribute | CASE Java | CASE .NET |
|---|---|---|
| Exam code | 312-96 | 312-95 |
| Language focus | Java / JVM ecosystem | C# / .NET ecosystem |
| Domain structure | 10 modules, SDLC-based | 10 modules, SDLC-based |
| Delivery | EC-Council Exam Portal, remote proctored | EC-Council Exam Portal, remote proctored |
Because the domain framework is shared, most of what you learn while studying CASE Java transfers conceptually to the .NET version - the difference shows up in code snippets, framework-specific vulnerabilities, and language idioms rather than in the security principles being tested. If your work runs on Java, Spring, or JVM-based microservices, the Java track is the correct choice, and it's the one this site's practice questions target.
Exam Format, Fees, and Registration
The CASE Java exam is delivered exclusively through EC-Council's Exam Portal, and it's available via Remote Proctoring Services - meaning you can test from a home or office setup rather than traveling to a physical test center. Here's what candidates should budget for and expect:
- Question count: 50 multiple-choice questions
- Time limit: 2 hours
- Passing score: 70%
- Voucher cost: $450 for the remote-proctored exam
- Voucher validity: 1 year from date of purchase
The question style leans scenario-based rather than pure recall - you'll often see a short code snippet, a described architecture, or a described vulnerability, and you'll need to identify the correct secure-coding fix or the right SDLC phase where a control belongs. This format rewards candidates who've actually reviewed code, not just memorized OWASP terminology. For a full pricing breakdown including the training path and any bundled costs, see CASE Certification Cost 2026: Complete Pricing Breakdown, and for the exact scoring mechanics behind that 70% threshold, check CASE Passing Score 2026: Exactly What You Need to Pass.
Key Takeaway
Book your remote-proctored session with enough buffer before your voucher's 1-year expiration - testing centers and remote slots can fill up during peak scheduling windows, so check CASE Exam Dates 2026: Testing Windows, Deadlines & Scheduling before you commit to a date.
Who Can Sit for the Exam
Unlike open-enrollment certifications, CASE has a gate you need to clear before you can register for the exam itself. EC-Council recognizes four eligibility routes:
- Official CASE training - completing an authorized training course satisfies eligibility automatically.
- Active ECSP status - holders of EC-Council's Certified Secure Programmer credential can bypass the separate application process.
- Relevant experience - at least 2 years of information-security or software-design experience, verified through the standard application.
- Equivalent certification - an accepted comparable credential in lieu of formal training or direct experience.
If you're applying via the experience or equivalent-certification route rather than through training, expect a $100 nonrefundable eligibility application fee. This is separate from the $450 exam voucher, so factor both into your total budget. The full breakdown of documentation, timelines, and what counts as "accepted equivalent" experience is covered in CASE Requirements 2026: Eligibility, Prerequisites & How to Qualify.
The 10 CASE Domains
CASE's exam blueprint is organized around the secure SDLC, moving in roughly the same order a real application would move through development. Understanding this sequence helps explain why certain topics show up together on the exam.
Domain 1: Understanding Application Security, Threats, and Attacks
Foundational domain covering the modern threat landscape, common attack classes, and why traditional network security controls don't protect application logic.
- Know OWASP Top 10-style vulnerability categories and how they manifest in code
Domain 2: Security Requirements Gathering
Focuses on capturing security requirements alongside functional requirements, including abuse cases and misuse cases during planning.
- Distinguish functional requirements from non-functional security requirements
Domain 3: Secure Application Design and Architecture
Covers threat modeling methodologies, secure design patterns, and architectural decisions that reduce attack surface before a single line of code is written.
- Be comfortable with STRIDE-style threat modeling walkthroughs
Domain 4: Secure Coding Practices for Input Validation
Tests knowledge of injection flaws, canonicalization issues, and validation strategies at trust boundaries.
- Know allow-list vs. deny-list validation and where each belongs
Domain 5: Secure Coding Practices for Authentication and Authorization
Covers identity verification, session-to-privilege mapping, and common access-control failures like broken object-level authorization.
- Understand multi-factor authentication implementation pitfalls in Java frameworks
Domain 6: Secure Coding Practices for Cryptography
Focuses on correct use of encryption, hashing, and key management - and the mistakes that make cryptography ineffective even when it's "technically" implemented.
- Know why custom crypto implementations are a red flag
Domain 7: Secure Coding Practices for Session Management
Covers session token generation, session fixation, timeout handling, and secure cookie attributes.
- Be able to identify insecure session handling in a code snippet
Domain 8: Secure Coding Practices for Error Handling
Tests understanding of how verbose error messages and unhandled exceptions leak information useful to attackers.
- Know the difference between logging for diagnostics and logging that exposes secrets
Domain 9: Static and Dynamic Application Security Testing (SAST & DAST)
Covers tooling categories, when to apply each testing type, and how to interpret findings within a development pipeline.
- Understand the tradeoffs between SAST's code-level visibility and DAST's runtime perspective
Domain 10: Secure Deployment and Maintenance
Closes the loop with secure configuration, patch management, and monitoring practices after an application goes live.
- Know why hardening doesn't stop at deployment - it's an ongoing process
For a deeper breakdown of each domain's weighting and study priority, read CASE Exam Domains 2026: Complete Guide to All 10 Content Areas. And if you want an honest read on how these domains combine to make the exam feel harder or easier than other EC-Council credentials, How Hard Is the CASE Exam? Complete Difficulty Guide 2026 walks through that comparison directly.
Who Hires CASE-Certified Professionals
CASE sits at an unusual intersection: it's a developer credential with a security lens, which makes it relevant to roles that don't fit neatly into either "pure developer" or "pure security" job postings. Employers commonly look for CASE when hiring for:
- Secure software engineer / application security engineer roles embedded within product teams
- Security code reviewer positions responsible for manual and tool-assisted code audits
- DevSecOps engineer roles that need to integrate SAST/DAST tooling into CI/CD pipelines
- Application security analyst positions within larger security operations teams
- Software architect roles where secure-by-design decisions matter at the system level
Because the certification's domains mirror the SDLC so closely, it tends to resonate with hiring managers at organizations that have adopted - or are trying to adopt - a shift-left security model, where vulnerabilities get caught during design and coding rather than after release. For a closer look at job titles, industries, and demand signals, see CASE Jobs, and for compensation context tied to this skill set, CASE Salary Guide 2026: Complete Earnings Analysis is worth reviewing before you invest in the exam.
How to Prepare Without Wasting Time
Generic study advice - flashcards, timed drills, spaced repetition - applies to any certification exam. What matters more for CASE is sequencing your review around the SDLC structure, since later domains (testing, deployment) build conceptually on earlier ones (requirements, design). A simple way to allocate a four-week runway:
Foundations and Design
- Cover Domains 1-3: threats/attacks, requirements gathering, and secure architecture
- Build a mental model of the full secure SDLC before touching code-level detail
Core Secure Coding
- Work through Domains 4-6: input validation, authentication/authorization, cryptography
- Review Java-specific code snippets for each vulnerability class
Session, Errors, and Testing
- Cover Domains 7-9: session management, error handling, SAST/DAST
- Practice reading tool output and mapping findings to root causes
Deployment and Full Review
- Finish Domain 10 and run full-length timed practice sets
- Revisit weak domains identified from missed practice questions
Whatever pace you choose, a structured guide helps more than improvised review - CASE Study Guide 2026: How to Pass on Your First Attempt lays out a complete plan, and CASE Cheat Sheet 2026: One-Page Review of Must-Know Facts is useful for a final pass the night before your exam. Running scenario-style questions on our practice test platform before exam day is one of the most direct ways to get comfortable with CASE's code-snippet question format, since reading about a vulnerability and spotting it under time pressure are different skills entirely.
Maintaining the Credential
Passing the exam isn't the end of the commitment. CASE follows EC-Council's standard 3-year renewal cycle, and maintaining active status requires earning 120 ECE (EC-Council Continuing Education) credits within that period. Credits typically come from activities like attending relevant training, contributing to the security community, or engaging in approved professional development - the specifics are managed through EC-Council's ECE program rather than a repeat exam.
Because the credential requires ongoing upkeep, it's worth treating CASE as a long-term professional commitment rather than a one-time exam to check off. Planning your renewal activities early - rather than scrambling near the 3-year mark - keeps the credential active without disrupting your work schedule.
Frequently Asked Questions
CASE is the umbrella credential name, but candidates choose between two exam versions: CASE Java (312-96) and CASE .NET (312-95). This site focuses on CASE Java, though both share the same 10-domain framework.
The remote-proctored exam voucher is $450, valid for 1 year. If you're applying for eligibility through the experience or equivalent-certification route rather than official training, add a $100 nonrefundable application fee.
Not necessarily. You can qualify through official CASE training, active ECSP status, at least 2 years of information-security or software-design experience, or an accepted equivalent certification - training is the most direct path if you don't already meet the experience threshold.
The 50-question, 2-hour format leans toward applied scenarios: interpreting code snippets, identifying vulnerable patterns, and choosing the correct secure-coding fix, rather than pure definition recall.
It follows EC-Council's 3-year renewal cycle. To keep it active, you need to accumulate 120 ECE credits within that window rather than retake the exam from scratch.