Secure Exception/Error Handling CASEJAVA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When an exception occurs in a Java web application, what should the user see?

   • AThe exception class name and method names.
   • BThe full stack trace to help them understand the error.
   • CA generic error message like 'Something went wrong. Please try again later.'
   • DThe SQL query that caused the error.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A Java application logs exceptions using a logging library that writes to a file with permissions 644 (world-readable). The log file contains user IDs and exception messages that may include sensitive data. Which action is most important to secure the logs?

   • ALog only the exception class name and not the message to reduce sensitive data.
   • BUse a logging library that writes to the system console instead of a file.
   • CEncrypt the log file contents using a symmetric key stored in the application code.
   • DChange the log file permissions to 600 or 640 so only the application and authorized admins can read it.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A Java method reads a file, processes it, and then deletes the file in a finally block. If an exception occurs during processing, the finally block deletes the file, but the exception is not logged. The developer wants to ensure the file is always deleted and the exception is logged. Which pattern is correct?

   • ACatch the exception, log it, and rethrow it after the finally block deletes the file.
   • BDelete the file in the catch block and then rethrow the exception.
   • CLog the exception in the finally block and then delete the file.
   • DSwallow the exception after deleting the file to avoid disrupting the caller.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A Java application's exception handling code includes the following line: logger.error("Error processing request", e); where e is an exception that contains the user's session ID in its message. What is the best practice?

   • ALog only the exception class name, not the message.
   • BSanitize the exception message before logging to remove the session ID.
   • CLog the exception as is, because session IDs are not sensitive.
   • DEncrypt the log file to protect the session ID.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A Java method acquires a database connection and a file lock. If an exception occurs while processing, the method must release both resources. The developer writes a finally block that releases the file lock, but the database connection is not closed if the file lock release throws an exception. What is the most robust way to ensure both resources are released?

   • AClose the file lock in the catch block and the database connection in the finally block.
   • BUse try-with-resources for both the database connection and the file lock, ensuring each is closed automatically.
   • CClose the database connection in the catch block and the file lock in the finally block.
   • DUse a nested try-finally block: first try-finally for the connection, then try-finally for the file lock.
   Reveal Solution Discussion Select an answer first