312-96 Dumps with Practice Exam Questions Answers

 To ensure that Tomcat can be shut down only by the user who owns the Tomcat process, the server.xml file should be configured to disable the shutdown port. This is done by setting the port attribute of the  element to -1. The shutdown attribute should be set to a value (like “SHUTDOWN”) that would be known to the server administrator. This configuration prevents remote or unauthorized shutdowns of the Tomcat server via the shutdown port.

References: The information is consistent with best practices for securing Tomcat servers as per the guidelines found in various resources, including Stack Overflow discussions and Tenable® security configurations123. For official EC-Council Application Security Engineer (CASE) JAVA documentation and learning resources, please refer to the EC-Council’s official materials and courses45.

The image depicts URLs with modified query parameters, which is indicative of a Parameter Tampering Attack. In this type of attack, an attacker manipulates the parameters exchanged between the client and the server to alter application data, such as user credentials and permissions. This can lead to unauthorized access or other malicious activities.

In the image:

• The first URL has a parameter ‘debit’ changed from one value to another.
• The second URL also shows a change in the ‘debit’ parameter.
• The third and fourth URLs depict changes in ‘status’ parameter values.

These modifications can lead to unauthorized actions being performed on behalf of an authenticated user without their consent.

References:For precise references, please refer directly to EC-Council Application Security Engineer (CASE) JAVA related courses and study guides, as my capabilities do not include real-time access to external databases or the internet for document retrieval. However, the information provided is based on my training data up to my last update in September 2021.

The code snippet provided in the image is a Java program where a SQL query is being constructed by concatenating user inputs directly into the query string. This practice is highly insecure as it opens up the application to SQL Injection attacks. In this specific example, uname and pwd are directly appended to the SQL query string without any sanitization or parameterization, making it vulnerable.

A secure practice would be to use parameterized queries or prepared statements which ensure that user inputs are treated as data and not executable code. This prevents malicious users from injecting harmful SQL code into the application.

Here’s how the corrected code using parameterized queries should look:

Java

PreparedStatement ps = con.prepareStatement("SELECT * FROM empinfo WHERE uname=? AND pwd=?");

ps.setString(1, uname);

ps.setString(2, pwd);

ResultSet rs = ps.executeQuery();

AI-generated code. Review and use carefully. More info on FAQ.

In this corrected version, ? placeholders are used in the SQL query string for user inputs, and then those placeholders are replaced with actual user input values using setString() method calls on the PreparedStatement object. This ensures that user inputs are safely incorporated into the SQL query, preventing SQL Injection.

References:

• EC-Council Application Security Engineer (CASE) JAVA official study guides and materials emphasize on secure coding practices including avoiding non-parameterized queries to prevent security vulnerabilities like SQL Injection.
• Specific topics covering secure coding practices in Java can be found in modules focusing on data validation and sanitization.

To remove the HttpSession object and its values from the client’s system, the developer should use the invalidate() method. This method is called on the HttpSession object itself and marks the session for deletion, removing all its attributes and invalidating the session on the server side. Once a session is invalidated, any new request from the client does not associate with the old session and will typically result in a new session being created if required.

Here’s a step-by-step explanation of how the invalidate() method works:

• The developer retrieves the HttpSession object from the HttpServletRequest object using the getSession() method.
• The developer calls the invalidate() method on the retrieved HttpSession object.
• The server invalidates the session, which means it is no longer recognized and any subsequent requests will not be associated with it.
• All objects bound to the session are removed and available for garbage collection.
• The client’s next request will not have a valid session, and the server will treat it as a new session if necessary.

References:The information provided here is aligned with the EC-Council’s Certified Application Security Engineer (CASE) JAVA guidelines and best practices for secure session management. For more detailed information, please refer to the EC-Council’s CASE JAVA official study guides and training materials12.

To mitigate the security risk of users being able to view the website structure and file names, the correct action would be to disable directory listings. This is often accomplished through configuration settings in web server software, where you can specify whether to allow or deny the listing of directory contents. The option <int-param> <param-name>listings <param-value>false</int-param> effectively disables directory listings, preventing users and potential attackers from viewing the website's file and directory structure, thus enhancing security. Ensuring that directory listings are disabled is a common security practice to avoid revealing sensitive information about the web application's structure.References:

• Web Server Security Best Practices documentation
• OWASP (Open Web Application Security Project) guidelines on securing web server configurations