Secure Exception/Error Handling CASEJAVA Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the primary benefit of implementing a centralized exception handling mechanism in a Java application?

   • AIt ensures consistent error responses and prevents unhandled exceptions from exposing details.
   • BIt allows exceptions to be ignored safely.
   • CIt automatically fixes the underlying cause of exceptions.
   • DIt eliminates the need for try-catch blocks in the code.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A Java application processes payment transactions. The development team wants to log all exceptions for debugging, but the security team is concerned about PCI DSS compliance and information disclosure. The application runs in a shared hosting environment where log files are accessible to other tenants. What is the best approach?

   • ALog all exceptions to the system's standard output, which is not accessible to other tenants.
   • BEncrypt all log entries and store the encryption key in the application code.
   • CLog exceptions to a dedicated log file with restricted permissions and sanitize any sensitive data such as card numbers.
   • DDo not log any exceptions to avoid storing sensitive data.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A developer is writing a method that parses user input. If the input is invalid, the method throws a custom InvalidInputException with a message that includes the user's input. The exception is caught by a global handler that returns the message to the user. What is the primary security concern?

   • AThe custom exception is not a standard Java exception, which may cause compatibility issues.
   • BThe exception message may contain user input that could be used for stored or reflected XSS if not properly encoded in the response.
   • CThe global handler logs the exception, which may create a denial-of-service by filling the log with user input.
   • DThe exception is thrown for invalid input, which is a normal flow and should not be an exception.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A Java application uses a third-party library that throws checked exceptions. The team has a policy that all exceptions must be logged and the user must receive a generic error. However, the library also throws an Error (not Exception) in rare cases. The current code only catches Exception, so Errors propagate to the container and produce a default error page. What is the most secure and maintainable way to handle this?

   • ACatch Throwable in the centralized handler, log it, and return a generic error response.
   • BLet Errors propagate because they indicate serious JVM issues that should not be handled by the application.
   • CCatch Exception and also add a separate catch block for Error that logs and rethrows it.
   • DWrap the library call in a try-catch that catches Throwable and then throws a new RuntimeException with the original cause.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A Java application's exception handler logs the exception message and stack trace to a log file. The log file is shipped to a centralized SIEM for analysis. The security team requires that no sensitive data (e.g., passwords, credit card numbers) be logged, but developers need enough context to debug. Which approach best balances these requirements?

   • ADisable logging for exceptions that may contain sensitive data, such as those from authentication or payment modules.
   • BImplement a logging filter that redacts known sensitive patterns (e.g., password fields, credit card numbers) before writing to the log.
   • CLog only the exception class name and a correlation ID, and store full details in a separate secure database.
   • DEncrypt the log file before shipping to the SIEM so that sensitive data is protected.
   Reveal Solution Discussion Select an answer first