EC-Council · CASE-.NET
Certified Application Security Engineer .NET (CASE-.NET) Practice Tests
Validates the ability to build secure .NET applications throughout the software development lifecycle, covering secure requirements gathering, input validation, authentication and authorization, cryptographic practices, error handling, session management, and security testing.
Exam Details
Practice Questions
625
≈ 5 practice exams
Duration
120 minutes
Passing Score
70%
Difficulty
AssociateLast Updated
Sep 2026
Certified Application Security Engineer .NET (CASE .NET) Practice Exam
EC-Council structures the CASE .NET exam (code 312-95) around 10 course modules but does not publish per-module weights, so treat all 10 as fair game: application security threats and attacks, security requirements gathering, secure application design and architecture, then five secure-coding modules (input validation, authentication and authorization, cryptography, session management, error handling), followed by static and dynamic application security testing (SAST and DAST) and secure deployment and maintenance. The five secure-coding modules are where .NET-specific detail concentrates, things like ASP.NET validation controls, System.Security.Cryptography usage, and session token handling, and this 625-question bank is built to give each of the 10 modules real depth rather than skimming the coding chapters.
Test day is short and dense: 50 multiple-choice questions in 120 minutes, delivered through the EC-Council Exam Portal with remote proctoring by EC-Council's RPS team. The published passing score is 70%, which works out to 35 correct out of 50. EC-Council does not disclose any scored versus unscored split for this exam, so assume every question counts. With less than 2.5 minutes per question and scenario stems that quote actual .NET code, unprepared candidates tend to lose time parsing C# snippets rather than recalling concepts.
Eligibility is formal, not just recommended: you must either complete official EC-Council CASE training (ATC, iWeek, or iLearn), be an ECSP .NET or Java member in good standing, have a minimum of 2 years of working experience in the InfoSec or software domain, or hold an equivalent certification such as GSSP .NET or Java. The experience and equivalent-cert routes require a non-refundable USD 100 eligibility application fee, and the exam voucher itself is USD 450 through the EC-Council store. The certification is valid for 3 years and renews under the ECE program (120 credits per 3-year cycle plus the USD 80 annual membership fee). Start with the 30 free questions, then work through the full 625-question bank until your accuracy holds steady across all 10 modules.
Exam Overview
The Certified Application Security Engineer .NET (CASE .NET) is an application security certification offered by EC-Council that validates a software developer's ability to integrate security practices throughout every phase of the .NET software development lifecycle (SDLC). Developed in partnership with global application and software development experts, it tests critical security knowledge and skills spanning pre-deployment through post-deployment phases, with a focus on .NET-specific secure coding techniques including input validation, authentication and authorization mechanisms, cryptographic implementation, session management, and error handling.
The certification covers the full spectrum of SDLC security activities: from gathering secure requirements and designing secure architectures, to writing defensively coded .NET applications and performing security testing using both static (SAST) and dynamic (DAST) analysis methods. It addresses real-world threats and attack vectors targeting .NET web applications and teaches developers to build security in from the ground up rather than bolt it on after deployment. The exam is identified by exam code 312-95 and is recognized globally as a benchmark for application security competency in the Microsoft .NET ecosystem.
Who Should Take This Exam
CASE .NET is designed primarily for .NET developers with a minimum of two years of professional development or information security experience who want to formalize their application security expertise. It is equally relevant for application security engineers, security analysts, and security testers who work with .NET-based systems and need to demonstrate proficiency in secure SDLC practices.
The certification is also well-suited for software architects, DevSecOps practitioners, and anyone involved in designing, building, testing, managing, or protecting .NET applications — including web applications, mobile applications, and IoT solutions built on the .NET framework. Professionals transitioning from pure development roles into application security roles will find this certification particularly valuable for validating their security-oriented coding skills.
Prerequisites
There are no strict formal educational prerequisites, but EC-Council requires candidates to meet at least one of the following eligibility criteria before sitting for the exam: complete official EC-Council CASE training through an accredited training partner (ATC, iWeek, or iClass), be an active EC-Council Secure Programmer (ECSP) .NET or Java member in good standing, possess a minimum of two years of working experience in the information security or software development domain, or hold an equivalent industry certification such as GIAC GSSP-.NET or GSSP-Java. Candidates applying via the experience or equivalent-certification pathway must submit a USD $100 non-refundable application fee.
In terms of recommended knowledge, candidates should have hands-on familiarity with the .NET framework and C# or VB.NET development, a working understanding of web application architectures, and foundational knowledge of common vulnerability categories such as those defined by OWASP. Familiarity with basic cryptographic concepts, HTTP/HTTPS protocols, and software testing methodologies will also ease preparation for the exam domains.
Exam Format
The CASE .NET exam (312-95) consists of 50 multiple-choice questions and must be completed within 120 minutes. The passing score is 70%, meaning candidates must answer at least 35 questions correctly. The exam is delivered through the EC-Council exam portal and can be taken at authorized Prometric testing centers or, in eligible cases, via online proctored delivery.
All 50 questions are scored; no unscored or survey items have been publicly disclosed. The multiple-choice format tests both conceptual understanding and practical application of secure coding principles across the ten defined exam domains. Candidates who do not pass may retake the exam, subject to EC-Council's standard retake policies.
Skills Measured
- 1.Domain 1: Understanding Application Security, Threats, and Attacks — Covers the foundational concepts of application security, common attack surfaces, and the threat landscape targeting .NET applications, including OWASP Top 10 and .NET-specific vulnerabilities.
- 2.Domain 2: Security Requirements Gathering — Addresses how to identify and document security requirements during the planning phase of the SDLC, including abuse case modeling and threat modeling techniques.
- 3.Domain 3: Secure Application Design and Architecture — Focuses on security design principles such as least privilege, defense in depth, separation of duties, and secure architecture patterns applicable to .NET systems.
- 4.Domain 4: Secure Coding Practices for Input Validation — Covers techniques for validating, sanitizing, and encoding user-supplied data in .NET to prevent injection attacks, XSS, and related vulnerabilities.
- 5.Domain 5: Secure Coding Practices for Authentication and Authorization — Examines implementation of robust authentication mechanisms (including multi-factor authentication) and role-based/claims-based authorization in .NET applications.
- 6.Domain 6: Secure Coding Practices for Cryptography — Covers proper use of cryptographic APIs in the .NET framework, including symmetric/asymmetric encryption, hashing, digital signatures, and common cryptographic pitfalls to avoid.
- 7.Domain 7: Secure Coding Practices for Session Management — Addresses secure session token generation, storage, transmission, and invalidation in .NET web applications to prevent session hijacking and fixation attacks.
- 8.Domain 8: Secure Coding Practices for Error Handling — Focuses on implementing secure exception handling and logging in .NET, preventing information leakage through error messages while ensuring adequate audit trails.
- 9.Domain 9: Static and Dynamic Application Security Testing (SAST & DAST) — Covers security testing methodologies applied during and after development, including code review techniques, automated static analysis tools, and dynamic testing approaches for .NET applications.
- 10.Domain 10: Secure Deployment and Maintenance — Addresses security considerations for deploying .NET applications to production environments, patch management, security configuration hardening, and ongoing maintenance security practices.
Study Tips
- Download and study the official CASE .NET Exam Blueprint v1 from cert.eccouncil.org, as it defines the exact knowledge areas and provides the authoritative outline for all 10 exam domains.
- Use EC-Council's official iClass self-paced or instructor-led training course, which aligns directly with the exam objectives and includes the official courseware textbook covering all 10 domains in depth.
- Focus heavily on Domains 4 through 8 (input validation, authentication, cryptography, session management, and error handling), as these secure coding practice domains represent the core practical skills the exam emphasizes.
- Practice with hands-on .NET coding exercises for each domain — particularly implementing ASP.NET Core authentication middleware, the .NET cryptography namespace (System.Security.Cryptography), and ASP.NET data validation attributes — since the exam tests applied knowledge, not just theory.
- Review the OWASP .NET Security Cheat Sheet and the OWASP Top 10 as supplementary references, since many exam scenarios are grounded in real-world attack patterns that OWASP documents extensively.
- Allocate approximately two months of structured study time, spending at least two hours per day, and use a topic checklist based on the Blueprint to ensure full coverage before scheduling the exam.
- Take practice exams from reputable sources to familiarize yourself with the multiple-choice question style and identify knowledge gaps; focus follow-up study on domains where practice scores are weakest.
Career Benefits
Earning the CASE .NET certification positions professionals for roles such as Application Security Engineer, Secure Software Developer, Security Analyst, DevSecOps Engineer, and Application Security Tester — all of which are in strong demand as organizations increasingly require security expertise embedded within development teams rather than solely in separate security departments. The credential is recognized globally and is valued by employers across financial services, healthcare, government, and technology sectors where .NET remains a dominant development platform.
The CASE .NET complements other EC-Council certifications such as the CEH and CPENT by providing a developer-focused security credential, and it stacks well with Microsoft-specific certifications for professionals building careers in the Microsoft ecosystem. Certified professionals typically see enhanced earning potential relative to non-certified peers, and the credential supports long-term career growth by demonstrating a structured, SDLC-wide approach to application security that aligns with frameworks such as OWASP SAMM and NIST SSDF.
Sample Questions
5 sample questions with answers and explanations. The full bank has 625 questions, enough for 5 full-length practice exams.
Preview — answers shown1. An application architect must choose between SAST and DAST for integration into a CI/CD pipeline with the following constraints: must scan code before deployment, identify coding errors in proprietary business logic, require no running application instance, and complete within 5-minute build windows. Which testing approach meets all requirements and what is its primary limitation? (Select one!)
ADAST - scans running applications but requires a deployed test environment
BSAST - analyzes source code without execution but produces higher false positive rates
CPenetration testing - provides comprehensive security validation but requires security experts
DDAST - black-box testing that identifies runtime vulnerabilities
Explanation
SAST (Static Application Security Testing) meets all specified requirements: it analyzes source code during build time without requiring a running application, can identify coding errors in proprietary logic by examining the actual code, and can complete within CI/CD build windows. The primary limitation of SAST is higher false positive rates compared to DAST because static analysis may flag potential vulnerabilities that are not exploitable in actual runtime contexts. DAST requires a running deployed application, violating the requirement. Penetration testing is manual, time-intensive, and cannot complete in 5-minute windows. While DAST identifies runtime vulnerabilities, it fails the fundamental requirement of not needing a running application instance for testing.
2. A development team implements input validation for a file upload feature that allows users to download files from a specific directory. Which code correctly prevents path traversal attacks? (Select one!)
Astring filePath = Path.Combine(baseDirectory, fileName.Replace("..", ""));
Bif (fileName.Contains("..")) return BadRequest(); string filePath = Path.Combine(baseDirectory, fileName);
Cstring fullPath = Path.GetFullPath(Path.Combine(baseDirectory, fileName)); if (!fullPath.StartsWith(baseDirectory)) return BadRequest();
Dstring safePath = baseDirectory + Path.DirectorySeparatorChar + fileName.Replace("/", "").Replace("\\", "");
Explanation
Path traversal prevention requires canonicalizing the full path using Path.GetFullPath and then verifying it starts with the allowed base directory. This approach handles all path traversal techniques including encoded characters, Unicode variations, and OS-specific path separators. Simply replacing dot-dot sequences fails because attackers can use URL encoding, double encoding, or Unicode characters. String replacement of slashes misses canonicalization and can be bypassed. Checking for dot-dot strings before combining paths fails because Path.Combine can still resolve relative paths and the check misses encoded variations. Only full canonicalization followed by prefix verification provides complete protection.
3. An application security assessment evaluates a .NET Windows service that stores encryption keys for data-at-rest protection. The service must ensure that keys are accessible only to the service account and protected from other processes on the same machine. Which approach provides the strongest key protection? (Select one!)
AStore keys in the Windows Certificate Store with private key marked as non-exportable and require the service account to have read permissions
BStore keys encrypted with DPAPI using DataProtectionScope.CurrentUser to restrict decryption to the service account user context
CGenerate keys using Aes.Create() and store them in a file with NTFS permissions restricted to the service account
DStore keys encrypted with DPAPI using DataProtectionScope.LocalMachine so any process can decrypt them after system restart
Explanation
Windows Certificate Store with non-exportable private keys provides the strongest protection by leveraging hardware security modules or TPM when available, preventing key extraction even by administrators. Marking keys non-exportable ensures they cannot be copied from the system. DPAPI with CurrentUser scope protects keys but stores them in the user profile which can be accessed by administrators or through user profile backup mechanisms. DPAPI with LocalMachine scope allows any process running on the machine to decrypt the keys, providing no isolation between processes. Storing keys in files even with NTFS permissions exposes them to file system backup processes, volume shadow copies, and administrator access. Certificate Store provides defense-in-depth with hardware backing, non-exportability, and fine-grained ACLs on private key material.
4. An organization implements distributed caching using Redis for session state in an ASP.NET Core application. The security team identifies that Redis connections use unencrypted TCP. What security risks does this introduce and what is the appropriate mitigation? (Select one!)
ARedis performance degradation; implement connection pooling
BSession hijacking through network sniffing; enable SSL/TLS for Redis connections
CNo security risk as session data is already encrypted by ASP.NET Core Data Protection
DData corruption during transmission; enable Redis persistence mode
Explanation
Unencrypted Redis connections transmit session data in plaintext over the network, allowing attackers with network access to intercept session identifiers and session contents through network sniffing, enabling session hijacking. The appropriate mitigation is enabling SSL/TLS for Redis connections using the ssl=true configuration parameter. While ASP.NET Core Data Protection can encrypt specific values, it does not automatically encrypt all session data, and session cookies themselves would still be visible. Connection pooling addresses performance and resource management, not security. Redis persistence mode controls data durability to disk and does not address network transmission security. Encrypted Redis connections prevent session interception and meet compliance requirements for data protection in transit.
5. An enterprise application implements policy-based authorization using IAuthorizationHandler. The security review identifies this handler implementation: protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MinimumAgeRequirement requirement) { var dob = context.User.FindFirst(ClaimTypes.DateOfBirth)?.Value; if (dob == null) { context.Fail(); return Task.CompletedTask; } var age = CalculateAge(DateTime.Parse(dob)); if (age >= requirement.MinimumAge) context.Succeed(requirement); return Task.CompletedTask; } What is the security vulnerability in this implementation? (Select one!)
ACalling context.Fail() prevents other handlers from succeeding, breaking the authorization handler chain and causing authorization failures
BThe handler does not implement IAuthorizationRequirement interface required for policy registration
CMissing null check on context.User.Identity before accessing claims allows null reference exceptions
DUsing DateTime.Parse without validation allows attackers to cause denial of service through format exception crashes
Explanation
Authorization handlers should never call context.Fail() unless implementing an explicit deny requirement. The ASP.NET Core authorization framework allows multiple handlers to evaluate requirements, and calling Fail() prevents other handlers from succeeding even if they would otherwise authorize the request. The correct pattern returns Task.CompletedTask without calling Fail() when requirements are not met, allowing the framework to make the final authorization decision based on whether any handler called Succeed(). DateTime.Parse can throw exceptions but this is a robustness issue rather than a security vulnerability. IAuthorizationRequirement is implemented by the requirement class, not the handler. The User.Identity property is guaranteed to exist in AuthorizationHandlerContext, though it may be unauthenticated. The authorization failure caused by incorrect use of context.Fail() is the primary security concern.
Frequently Asked Questions
How many questions are on the CASE .NET (312-95) exam?
50 multiple-choice questions in 120 minutes, delivered through the EC-Council Exam Portal with remote proctoring by EC-Council's RPS team.
What is the passing score for the CASE .NET exam?
EC-Council publishes a 70% passing score for CASE .NET, which means 35 correct answers out of 50. Unlike some EC-Council exams (such as CEH) that use variable per-form cut scores, the CASE .NET page states a flat 70%.
How much does the CASE .NET certification cost?
The exam voucher is USD 450 through the official EC-Council store, and candidates qualifying via the experience or equivalent-certification route also pay a non-refundable USD 100 eligibility application fee. Official training packages price separately and typically include the exam.
What are the eligibility requirements for CASE .NET?
One of four routes: official EC-Council CASE training (ATC, iWeek, or iLearn), active ECSP .NET or Java membership in good standing, a minimum of 2 years of working experience in the InfoSec or software domain, or an equivalent certification such as GSSP .NET or Java. The last two routes require the USD 100 application fee.
What domains does the CASE .NET exam cover?
Ten modules: application security threats and attacks, security requirements gathering, secure design and architecture, secure coding for input validation, authentication and authorization, cryptography, session management, error handling, SAST and DAST testing, and secure deployment and maintenance. EC-Council does not publish per-module weights.
What question format does the CASE .NET exam use?
All 50 questions are multiple choice. Many stems are scenario-based and reference .NET-specific code and APIs, so expect to read C# and ASP.NET snippets under time pressure rather than answer pure definition questions.
How long is the CASE .NET certification valid and how do I renew it?
It is valid for 3 years. CASE falls under EC-Council's ECE scheme, so renewal requires 120 ECE credits per 3-year cycle plus the USD 80 annual EC-Council membership fee.
More EC-Council Practice Exams
Certified DevSecOps Engineer (ECDE)
ECDE · 609 questions
Digital Forensics Essentials (DFE)
DFE · 626 questions
EC-Council Certified Disaster Recovery Professional (EDRP)
EDRP · 623 questions
EC-Council Certified Incident Handler (ECIH)
ECIH · 590 questions
EC-Council Certified Encryption Specialist (ECES)
ECES · 627 questions
Ethical Hacking Essentials (EHE)
EHE · 627 questions
$17.99
One-time access to this exam
625 questions (5 practice exams' worth)
Unlimited timed exam simulations
Yours forever — no subscription
Detailed explanations
Free preview stays available