Secure Exception/Error Handling CASEJAVA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A Java method acquires a database connection and then performs a series of operations. If an exception occurs, the method catches it, logs it, and returns a default value. The connection is not closed. What is the most significant security issue?

   • AThe method should not catch the exception at all.
   • BThe exception is logged, which may reveal sensitive data.
   • CResource leak can lead to connection exhaustion and denial of service.
   • DThe default value may be incorrect and cause data corruption.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Java Spring Boot application has multiple controllers, each with its own @ExceptionHandler methods that return different error JSON structures. The security team wants a consistent error format and centralized logging for all unhandled exceptions. Which approach is the most maintainable and secure?

   • ACreate a base controller class that all controllers extend, with a protected method for error responses.
   • BUse a @ControllerAdvice class with a global @ExceptionHandler that logs the exception and returns a standardized error response.
   • CLet the default Spring Boot error response handle all exceptions.
   • DKeep the per-controller handlers but ensure each one logs the exception and returns the same JSON structure.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A Java application's exception handling is being reviewed. The code has multiple catch blocks that each log the exception and then continue execution. The security team is concerned about information disclosure. What is the most important principle to apply?

   • ARethrow every exception to the caller.
   • BLog every exception at the highest severity level.
   • CEnsure exception messages and stack traces are not exposed to end users.
   • DUse multiple catch blocks to handle each exception type separately.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A Java application's login module catches authentication failures and logs the exception. The current log entry includes the user's password in plain text because the exception message contains the password. What is the best practice for logging this security event?

   • ALog the full exception message to aid in debugging authentication issues.
   • BLog the exception with a sanitized message that excludes the password, and log the username and timestamp.
   • CDo not log authentication failures to avoid storing sensitive data.
   • DLog the password but encrypt the log file at rest.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key consideration when logging exception details in a Java application?

   • ALog only the exception message, not the stack trace.
   • BLog exceptions in a format that is easy for end users to read.
   • CEnsure logs do not contain sensitive data such as passwords or credit card numbers.
   • DAvoid logging exceptions to reduce disk usage.
   Reveal Solution Discussion Select an answer first