Secure Exception/Error Handling CASEJAVA Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A Java web application's error page currently displays the raw exception message, which sometimes includes file paths and SQL fragments. The security team requires that users see only a generic message, but developers need full details for debugging. Which implementation satisfies both requirements?

   • ALog the full exception with stack trace to a secure server log and show a generic 'An error occurred' message to the user.
   • BShow the exception message to the user only if the request comes from an internal IP address.
   • CDisplay the exception class name and message but not the stack trace.
   • DCreate a custom error page that includes a 'Details' button that reveals the stack trace after a password prompt.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A Java application's logging configuration writes logs to a shared directory that is also used by other applications. The security team is concerned that logs may be tampered with or accessed by other applications. What is the best way to protect the logs?

   • AWrite logs to a database instead of a file.
   • BConfigure the logging framework to write to a dedicated directory with restricted permissions and enable log rotation.
   • CUse a logging framework that writes to the system event log.
   • DEncrypt the log files with a key stored in the application's configuration file.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard · select all that apply

   A Java application's exception handler logs the exception message and stack trace. The application processes credit card payments, and the exception messages sometimes include the full credit card number. The security team requires that credit card data never appear in logs. Which of the following actions are appropriate? (Select all that apply.)

   • ADisable logging for the payment module entirely.
   • BUse a logging library that automatically redacts fields annotated with @Sensitive.
   • CEncrypt the log file so that credit card numbers are not readable.
   • DImplement a logging filter that masks credit card numbers using a regex pattern before writing to the log.
   • EModify the exception classes to avoid including credit card numbers in messages.
   Check answers Discussion Select an answer first
5. 24application · medium

   A Java application's exception handler logs the full stack trace to a file in the application's web root. The log file is accessible via a predictable URL (e.g., /logs/app.log) and contains SQL queries with parameter values, internal IP addresses, and session IDs. Which combination of actions should be taken to secure the logging?

   • AMove the log file outside the web root, restrict file permissions, and redact sensitive data such as session IDs and SQL parameters from log entries.
   • BLog only the exception class name and message, omitting stack traces entirely.
   • CChange the log file extension to .txt so it is not executed by the server.
   • DKeep the log file in the web root but add a servlet filter to require authentication before accessing it.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A Java application uses a third-party library that throws exceptions with sensitive internal details. The application's exception handler logs the exception and returns a generic error to the user. However, the log file is stored in a location that is accessible to all application users via a shared file system. What is the best way to mitigate this risk?

   • ASanitize the exception message before logging and move the log file to a restricted directory.
   • BDisable logging for that third-party library.
   • CCatch the exception and rethrow a new exception with a generic message.
   • DUse a different third-party library that does not expose sensitive details.
   Reveal Solution Discussion Select an answer first