thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

EC-Council · Cybersecurity · Professional

EC-Council Certified Application Security Engineer (CASE) exam guide

Exam 312-96 (Java); 312-95 (.NET)

Certified Application Security Engineer (CASE) validates secure software development skills across the SDLC: requirements, secure coding for input validation, authentication, cryptography and session management, testing with SAST and DAST, and secure deployment. It comes in Java and .NET tracks.

QuestionsSee official page
Time limitSee official page
Passing scoreSee official page
Exam feeSee official page
Valid for3 years
DeliveryEC-Council Exam Portal (remote proctored) or ECC test centers

Format: Multiple choice. Fee note: Sold with training; check EC-Council for pricing.

Who it's for

Developers, application security engineers and testers who build or review Java or .NET applications.

What the exam covers

Secure requirements and design—
Input validation and defensive coding—
Authentication and authorization—
Cryptography—
Session management—
Error handling and logging—
SAST and DAST—
Secure deployment and maintenance—

A dash means the vendor does not publish a weight for that domain.

Eligibility & prerequisites

Required: Check EC-Council eligibility; candidates without official training typically need relevant application security or development experience.

Recommended: Two or more years of Java or .NET development.

Keeping it active

Valid three years under EC-Council's ECE policy: earn 120 ECE credits in the cycle and pay the $80 annual continuing education fee.

Skills & careers

Skills it validates

  • Threat modelling applications
  • Secure input validation and output encoding
  • Implementing authentication and session management securely
  • Correct use of cryptographic APIs
  • Running SAST and DAST tools
  • Secure configuration and deployment

Job roles

Application Security EngineerSecure Software DeveloperDevSecOps EngineerSoftware EngineerSecurity Code Reviewer

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Secure SDLC, requirements and threat modelling.
  2. Week 2: Input validation, authentication, authorization and session management in your track's language.
  3. Week 3: Cryptography, error handling and logging.
  4. Week 4: SAST/DAST tooling and secure deployment; practice questions and book.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Pick the track (Java or .NET) you code in; questions use language-specific APIs.
  • Know OWASP Top 10 mappings for each module.
  • Expect code-reading questions; practise spotting insecure snippets.
  • Learn the difference between SAST, DAST and IAST outputs.

Key terms for this exam

All 28 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

What are the CASE exam codes?

312-96 for Java and 312-95 for .NET.

Is CASE worth it?

It is a developer-focused credential; CSSLP is more recognised for AppSec leadership roles.

CASE vs CSSLP?

CASE is hands-on coding; CSSLP covers secure SDLC management and requires four years of experience.

Does CASE expire?

Yes, three years under EC-Council's ECE program.

Should I choose Java or .NET?

Choose the language you use at work.

Official page: www.eccouncil.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.