Skip to content
CertGPS

Certified Application Security Engineer - Java

Tests secure Java development across the whole lifecycle, from abuse cases and threat modeling to Spring Security, error handling and Tomcat hardening

IntermediateEC-Council

The exam

Exam cost
$450
Study time
3-5 months
Passing score
70%
Valid for
3 years

Before you book

  • Required: official CASE training, or two years of information security or software experience
  • Self-study route: $100 non-refundable eligibility application
  • Recommended: at least two years of Java development experience

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

  1. Certified Ethical Hacker

    Intermediate

    Comes before. EC-Council's attack-side exam; useful context for CASE but not required for it

  2. Certified Application Security Engineer - Java

    You are here

  3. Certified Secure Software Lifecycle Professional

    Advanced

    Next step. Covers the same secure lifecycle across eight domains, without Java code, after four years

Study guide

Last updated

CASE Java Study Guide: EC-Council's Secure Java Exam, Weights, and Plan

Certified Application Security Engineer (CASE) Java is EC-Council's exam for developers who build web applications in Java and want to show they can secure them at every stage, from requirements to deployment. It is still on sale in 2026, with a $450 voucher for a 50-question, two-hour exam. The outline is the thing to read first. It names Struts, Enterprise JavaBeans (EJB) and Tomcat alongside Spring, so you'll be tested on older Java stacks as well as the one you probably use at work.

Who CASE Java is for, and who should skip it

EC-Council aims the training at Java developers with at least two years of experience and at people moving into application security engineer, analyst or tester roles. It fits a backend developer who has become the team's go-to person for security reviews, or a Java shop that already buys EC-Council training and wants a credential to show for it. EC-Council also offers a separate CASE .NET exam for developers on the .NET framework; the two are independent, and you can sit either or both.

If your work is about the software development lifecycle as a whole rather than Java code, CSSLP from ISC2 covers eight domains of secure software practice and asks for four years of experience. If you want to prove you can find and exploit flaws in source code yourself, OSWE is a 48-hour proctored exam in which you review code, exploit live targets and write a report. For defending web applications without a language focus, look at GWEB.

The exam at a glance

CASE Java
FormatMultiple choice
Questions50
Time2 hours
Passing score70%
Voucher price$450 (remote-proctored voucher in EC-Council's store)
EligibilityOfficial CASE training (the $100 application fee applies unless the training includes it); or two years in information security or software plus a $100 non-refundable application; or EC-Council Certified Secure Programmer (ECSP) membership; or an equivalent certification plus the $100 application
Validity3 years; 120 continuing education credits and an $80 annual fee

What the ten domains cover

EC-Council's CASE Java blueprint, still labeled Version 1, gives these weights:

  • Understanding Application Security, Threats, and Attacks: 18%
  • Security Requirements Gathering: 8%
  • Secure Application Design and Architecture: 12%
  • Secure Coding Practices for Input Validation: 8%
  • Secure Coding Practices for Authentication and Authorization: 4%
  • Secure Coding Practices for Cryptography: 6%
  • Secure Coding Practices for Session Management: 10%
  • Secure Coding Practices for Error Handling: 16%
  • Static and Dynamic Application Security Testing (SAST and DAST): 8%
  • Secure Deployment and Maintenance: 10%

Two things stand out. First, more than a third of the exam (domains 1 to 3, 38%) is about concepts, process and design rather than code: Microsoft's Security Development Lifecycle, abuse cases, the SQUARE and OCTAVE models, and STRIDE and DREAD threat modeling. If you skip those chapters because you already code securely, you'll give away marks there.

Second, the coding weights are uneven. Error handling and logging carry 16%, covering Spring MVC error handling, exception handling in Struts 2 and logging with Log4j, while authentication and authorization carry 4% despite listing the Java Authentication and Authorization Service (JAAS), EJB authorization, Java EE security and Spring Security. With 50 questions, 4% is about two items. Deployment asks about hardening at the host, network, Tomcat and Oracle database levels, so expect configuration questions as well as code.

How to prepare

Start with the blueprint PDF and turn every bullet into a question you can answer in a sentence. It's five pages, and it's the best guide to how EC-Council phrases its objectives.

Official training is the expected route. EC-Council lists it as 24 hours, or three full days, and attendees receive the courseware, an exam voucher and access to EC-Council's iLabs. The courseware alone sells for $330 in the EC-Council store if you're eligible through experience and want the official text.

For hands-on practice, run OWASP WebGoat, a deliberately insecure Java application, and after exploiting each flaw, fix it in the code. Then work through the same weaknesses in a small Spring Boot application of your own:

  • Validate input with Bean Validation and compare that with what the blueprint says about Struts validators.
  • Configure session fixation protection, timeout and cookie flags in Spring Security.
  • Throw exceptions on purpose and check what reaches the browser and what reaches the log, including whether user input can forge log lines.
  • Use the Java Cryptography Architecture to encrypt, sign and hash correctly, and read the OWASP Cheat Sheet Series pages on each.

For reading beyond the courseware, Iron-Clad Java: Building Secure Web Applications by Jim Manico and August Detlefsen (Oracle Press, 2014) covers authentication, session management, access control, injection and error handling in Java terms. It is older than current Spring releases, so treat it as a guide to principles rather than APIs.

A reasonable split for a working Java developer is about a third of your time on the process and design domains, a third on secure coding labs, and the rest on error handling and deployment, which together carry 26%.

Renewal and what to do next

CASE sits under EC-Council's continuing education scheme. You need 120 credits in each three-year cycle and an $80 annual fee, with credits reported by February 1 of the following year. If you fail, you can retake straight away the first time, then wait 14 days before each later attempt, with no more than five attempts in 12 months.

Next steps:

  • CSSLP once you have four years of experience, for the lifecycle and management view of the same subject.
  • OSWE if you'd rather exploit code than describe how to protect it.
  • CEH only if your employer wants an EC-Council attack credential; it isn't a prerequisite for CASE.

Our view

CASE Java's strength is that it is about Java specifically. It asks about Spring Security, JAAS and Log4j in one sitting, which a language-neutral exam won't. Its weaknesses are an outline that still names Struts and EJB, and a format of 50 multiple-choice questions that can't show whether you write secure code. At $450, or $550 with the self-study application fee, it's worth taking if your employer pays for EC-Council training or a client asks for it. If you're paying yourself, we'd spend the money on CSSLP for recognition or OSWE for proof of skill.

Sources