Secure Exception/Error Handling CASEJAVA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard · select all that apply

   A Java application's centralized exception handler logs exceptions to a file. The security team is concerned about log tampering and unauthorized access. Which of the following measures are appropriate to protect the logs? (Select all that apply.)

   • AUse a logging library that supports cryptographic signing of log entries.
   • BEncrypt the log file with a key stored in the application's source code.
   • CSend logs to a centralized, append-only log server with access controls.
   • DStore logs on a separate partition with restricted file permissions.
   • EImplement log rotation and retention policies to prevent disk exhaustion.
   Check answers Discussion Select an answer first
2. 12application · medium

   A developer writes a method that opens a database connection, runs a query, and then closes the connection in a finally block. If the query throws an exception, the finally block closes the connection, but the exception is caught and logged. However, the method returns null to the caller, which then tries to use the null result and throws a NullPointerException. What is the primary flaw in this exception handling?

   • AThe method swallows the original exception by returning null, causing the caller to fail with a less informative error.
   • BThe caller should catch NullPointerException and handle it gracefully.
   • CThe finally block should not close the connection if an exception occurred.
   • DThe method should rethrow the exception as a runtime exception to avoid returning null.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a Java web application, which of the following is the most secure way to handle an exception that occurs during user authentication?

   • ALog the full exception details and show a generic error message to the user.
   • BSwallow the exception and continue as if authentication succeeded.
   • CReturn the exception message to the user for transparency.
   • DSend the stack trace to the user's email for support.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A Java application's exception handler catches all exceptions and logs them. However, the application is running in a clustered environment, and the logs are written to a local file on each node. The security team wants to correlate exceptions across nodes for incident response. What is the most effective approach?

   • AInclude a unique request correlation ID in the exception log entries and aggregate logs from all nodes into a central log management system.
   • BSend all exceptions to a single designated node that writes the logs.
   • CWrite logs to a shared network file system that all nodes can access.
   • DLog exceptions to a database table that is shared across all nodes.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A Java web application is being hardened. The current error page shows the exception class name and method names. The requirement is to provide a user-friendly message while retaining detailed diagnostics for support staff. Which implementation best meets this requirement?

   • ASend the full stack trace to the user only if the user is an administrator.
   • BDisplay the exception class name and a generic message on the error page.
   • CRedirect the user to the application's home page without any error message.
   • DUse a custom error page that displays a generic message and logs the full exception server-side.
   Reveal Solution Discussion Select an answer first