Why Study with PlanetCert?
The Latest Questions
Practice questions and exam topics aligned with the current exam objectives.
Detailed Explanations
Go beyond the answer. Master the material with comprehensive learning and professional explanations for every concept.
AI-Powered Insights
Personalized preparation guidance that adapts to your performance and identifies weak spots automatically.
Exam Information
Official specifications published by EC-Council
Exam Format
120 min
50
70%
Specialist
Registration
$300 USD
EC-Council Exam Portal or online proctoring
Validity
3 years
Earn EC-Council Continuing Education (ECE) credits; Retake the exam; Adhere to EC-Council Continuing Education Requirements
312-95 Exam Topics and Domains
312-95 is organized into 10 weighted domains. Expect to work with Microsoft Threat Modeling Tool, Acunetix, Application Insights, ASP.NET Core, and more.
1
Understanding Application Security, Threats, and Attacks
8%
Application Security Fundamentals
Need and Benefits of Application SecurityCommon Application-Level AttacksCauses of Application-Level Vulnerabilities
- Understand the need and benefits of application security
- Demonstrate the understanding of common application-level attacks
- Explain the causes of application-level vulnerabilities
Comprehensive Application Security and SDLC Integration
Components of Comprehensive Application SecurityIntegrating Security in SDLCMicrosoft Security Development Lifecycle (SDL)Software Security Reference Standards, Models, and Frameworks
- Explain various components of comprehensive application security
- Explain the need and advantages of integrating security in Software Development Life Cycle (SDLC)
- Differentiate functional vs security activities in SDLC
- Explain Microsoft Security Development Lifecycle (SDL)
- Demonstrate the understanding of various software security reference standards, models, and frameworks
2
Security Requirements Gathering
8%
Security Requirements Engineering
Importance of Gathering Security RequirementsSecurity Requirement Engineering (SRE) and Its Phases
- Understand the importance of gathering security requirements
- Explain Security Requirement Engineering (SRE) and its phases
Security Use Cases and Modeling
Abuse Cases and Abuse Case ModelingSecurity Use Cases and Security Use Case ModelingAbuser and Security Stories
- Demonstrate the understanding of Abuse Cases and Abuse Case Modeling
- Demonstrate the understanding of Security Use Cases and Security Use Case Modeling
- Demonstrate the understanding of Abuser and Security Stories
Security Requirements Models
SQUARE ModelOCTAVE Model
- Explain Security Quality Requirements Engineering (SQUARE) Model
- Explain Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Model
3
Secure Application Design and Architecture
10%
Secure Design Principles
Importance of Secure Application DesignSecure Design Principles in Practice
- Understand the importance of secure application design
- Explain various secure design principles
Threat Modeling
Threat Modeling Concepts and ProcessSTRIDE and DREAD ModelsSecure Application Architecture Design
- Demonstrate the understanding of threat modeling
- Explain threat modeling process
- Explain STRIDE and DREAD Model
- Demonstrate the understanding of Secure Application Architecture Design
4
Secure Coding Practices for Input Validation
18%
Input Validation Fundamentals
Importance of Robust Input ValidationSecure Input Validation in Web Forms, ASP.NET Core, and MVC
- Understand the importance of robust input validation
- Demonstrate the understanding of secure input validation techniques in Web Forms, ASP.NET Core, and MVC
Defensive Coding Against Injection Attacks
Defensive Coding Against SQL InjectionDefensive Coding Against XSS AttacksDefensive Coding Against Parameter TamperingDefensive Coding Against Directory TraversalDefensive Coding Against Open Redirect Vulnerabilities
- Demonstrate the understanding of defensive coding techniques against SQL Injection attacks
- Demonstrate the understanding of defensive coding techniques against XSS attacks
- Demonstrate the understanding of defensive coding techniques against Parameter Tampering attacks
- Demonstrate the understanding of defensive coding techniques against Directory Traversal attacks
- Demonstrate the understanding of defensive coding techniques against Open Redirect vulnerabilities
5
Secure Coding Practices for Authentication and Authorization
16%
Authentication and Authorization Fundamentals
Authentication and Authorization IssuesAuthentication and Authorization in Web FormsAuthentication and Authorization in ASP.NET CoreAuthentication and Authorization in MVC
- Understand authentication and authorization issues
- Explain authentication and authorization in Web Forms
- Explain authentication and authorization in ASP.NET Core
- Explain authentication and authorization in MVC
Authentication and Authorization Techniques
Authentication and Authorization Techniques in Web FormsAuthentication and Authorization Techniques in ASP.NET CoreAuthentication and Authorization Techniques in MVC
- Demonstrate the understanding of authentication and authorization techniques in Web Forms
- Demonstrate the understanding of authentication and authorization techniques in ASP.NET Core
- Demonstrate the understanding of authentication and authorization techniques in MVC
6
Secure Coding Practices for Cryptography
12%
Cryptography in .NET
Cryptography in .NET FundamentalsSymmetric EncryptionDefensive Coding with Symmetric Encryption
- Understand cryptography in .NET
- Explain symmetric encryption
- Demonstrate the understanding of defensive coding practices using symmetric encryption
Asymmetric Encryption, Hashing, and Digital Signatures
Asymmetric EncryptionDefensive Coding with Asymmetric EncryptionHashingDigital SignaturesDigital CertificatesASP.NET Core Secure Cryptography Practices
- Explain asymmetric encryption
- Demonstrate the understanding of defensive coding practices using asymmetric encryption
- Explain Hashing
- Explain Digital Signatures
- Explain Digital Certificates
- Demonstrate the understanding of ASP.NET Core-specific secure cryptography practices
7
Secure Coding Practices for Session Management
4%
Session Management Concepts and Techniques
Session Management ConceptsSession Management Techniques
- Understand session management concepts
- Explain various session management techniques
Defensive Coding for Session Security
Preventing Session HijackingPreventing Session Replay and FixationPreventing XSS, CSRF, and Client-Side Script Attacks on SessionsPreventing ViewState AttacksASP.NET Core Session Management
- Demonstrate the understanding of defensive coding practices against session hijacking attacks
- Demonstrate the understanding of defensive coding practices against session replay and session fixation attacks
- Demonstrate the understanding of techniques to prevent sessions from cross-site scripting, client-side scripts, and CSRF attacks
- Demonstrate the understanding of techniques to prevent session attacks on ViewState
- Demonstrate the understanding of ASP.NET Core specific secure session management techniques
8
Secure Coding Practices for Error Handling
10%
Error and Exception Handling Concepts
Error and Exception Handling FundamentalsNeed for Secure Exception Handling
- Understand error and exception handling concepts
- Explain the need of secure exception handling
Defensive Coding for Error Handling
Preventing Information DisclosurePreventing Improper Error HandlingSecure Error Handling in ASP.NET CoreSecure Auditing and Logging Best Practices
- Demonstrate the understanding of defensive coding practices against information disclosure
- Demonstrate the understanding of defensive coding practices against improper error handling
- Demonstrate the understanding of secure error handling practices in ASP.NET Core
- Explain secure auditing and logging best practices
9
Static and Dynamic Application Security Testing (SAST & DAST)
6%
Static Application Security Testing (SAST)
SAST ConceptsManual Secure Code Review
- Explain Static Application Security Testing (SAST) concepts
- Demonstrate the understanding of manual secure code review techniques for common vulnerabilities
Dynamic Application Security Testing (DAST)
DAST ConceptsAutomated Vulnerability Scanning ToolsProxy-Based Security Testing Tools
- Explain Dynamic Application Security Testing
- Demonstrate the knowledge of automated application vulnerability scanning tools to perform DAST
- Demonstrate the knowledge of proxy-based security testing tools to perform DAST
10
Secure Deployment and Maintenance
8%
Secure Deployment Practices
Importance of Secure DeploymentSecurity at Host LevelSecurity at Network LevelSecurity at Application LevelSecurity at IIS LevelSecurity at .NET LevelSecurity at SQL Server Level
- Understand the importance of secure deployment
- Explain security practices at host level
- Explain security practices at network level
- Explain security practices at application level
- Explain security practices at IIS level
- Explain security practices at .NET level
- Explain security practices at SQL Server level
Security Maintenance and Monitoring
Security Maintenance and Monitoring Activities
Demonstrate the knowledge of security maintenance and monitoring activities
How do I earn this certification?
Passing 312-95 earns the Certified Application Security Engineer (CASE) .NET certification. It sits in the Application Security track.
Current Level Exams
Next Level Options
- 312-50 - Certified Ethical Hacker (CEH)
- 412-79 - Certified Security Analyst (ECSA)
- 312-97 - EC-Council Certified DevSecOps Engineer (ECDE)
Alternative Paths
- 312-96 - CASE JavaJava counterpart of CASE .NET for cross-platform application security expertise
- 312-50 - CEH Broader offensive security skills that complement application security knowledge
- GIAC GSSP-.NET Alternative .NET secure coding certification from SANS/GIAC recognized in the industry
- CSSLP Vendor-neutral secure software development lifecycle certification covering similar domains
Practice with Precision
The PlanetCert Simulator mirrors the real exam environment with authentic questions and timed pressure.
How to study for this exam?
The most effective way to prepare for 312-95 is by using the PlanetCert Simulator to practice questions and review detailed explanations.
What's changed on this exam?
Current Status
ACTIVE
Updates
- ASP.NET Core 9.0 Core authentication middleware, Data Protection API, and security header patterns continue to evolve. Exam may be updated to reflect newer ASP.NET Core patterns. • Release date: 2024-11-12
- Entity Framework Core 9.0 ORM-based SQL Injection prevention remains a core exam topic in Domain 4. • Release date: 2024-11-12
- OWASP ZAP 2.15+ Primary open-source DAST tool referenced in Domain 9. • Release date: 2024-01-01
Who should take this exam?
This exam is typically taken by .NET Developers with a minimum of 2 years of experience and Application Security Engineers.
- Attend official EC-Council CASE training through an accredited EC-Council Partner (ATC/iWeek/iLearn)
- Be an ECSP (.NET/Java) member in good standing
- Minimum 2 years working experience in InfoSec or Software domain
- Hold industry equivalent certifications such as GSSP .NET/Java