Secure Exception/Error Handling CASEJAVA Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A Java method opens a file, reads data, and then closes the file in a finally block. If an exception occurs during reading, the finally block closes the file, but the exception is not logged or rethrown. What is the primary security concern with this approach?

   • AThe method should use a try-with-resources statement to automatically close the file.
   • BThe exception is silently swallowed, hiding potential security-relevant failures.
   • CThe file should be opened in a different mode to prevent security issues.
   • DThe file may not be closed properly if the finally block itself throws an exception.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A Java application's logging framework is configured to log at DEBUG level in production. The logs contain full stack traces, including SQL queries with parameter values. The security team wants to reduce the risk of sensitive data exposure while maintaining the ability to troubleshoot issues. What is the best approach?

   • AUse a separate log file for DEBUG logs that is only accessible to developers.
   • BKeep DEBUG level but encrypt the log files.
   • CLog only the exception class name and message, not the stack trace.
   • DChange the log level to WARN and sanitize SQL queries to remove parameter values.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A Java application has a centralized exception handler that logs every exception with a stack trace. The application experiences a high volume of exceptions from a brute-force attack on the login form, causing the log to fill up rapidly and potentially impacting disk space. What is the best approach to handle this while maintaining security?

   • ACatch the exception in the login controller and swallow it to avoid logging.
   • BDisable logging for login-related exceptions to prevent log flooding.
   • CImplement rate limiting or throttling on the login endpoint and log only the first few failures per source IP.
   • DIncrease the log file size and rotation settings to accommodate the volume.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In a Spring MVC application, which annotation is commonly used to create a centralized exception handler?

   • A@RequestMapping
   • B@RestController
   • C@ControllerAdvice
   • D@ExceptionHandler
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following is a best practice for logging security events in a Java application?

   • ALog security events only when a user requests it.
   • BLog security events with detailed information and protect the log files from unauthorized access.
   • CLog security events in plain text files with no access controls.
   • DLog security events only in memory to avoid disk usage.
   Reveal Solution Discussion Select an answer first