Secure Exception/Error Handling CASEJAVA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A Java application has a centralized exception handler that logs exceptions and returns a generic error. However, the handler itself can throw an exception if the logging framework fails (e.g., disk full). What is the best way to handle this situation?

   • ALet the exception propagate to the container's default error page.
   • BIgnore the logging failure and continue with the generic error response.
   • CWrap the logging call in a try-catch that falls back to a secondary logging mechanism or fails silently.
   • DRethrow the exception after logging to ensure the error is not swallowed.
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A Java application has a centralized exception handler that returns a generic error response. However, some exceptions are thrown in background threads (e.g., scheduled tasks) and are not caught by the handler, causing the thread to terminate silently. The operations team wants to be alerted to these failures. What is the best approach?

   • AWrap the code in each background thread with a try-catch that logs the exception.
   • BSet a default uncaught exception handler for all threads that logs the exception and sends an alert.
   • CUse a thread pool that catches exceptions and stores them for later retrieval.
   • DIgnore background thread exceptions because they do not affect the user-facing application.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A Java application uses a custom exception class that includes a field for the user's password when a login fails. The exception is logged and also returned to the client in an error response. Which of the following is the most critical security issue?

   • AThe exception contains sensitive data (the password) that is both logged and returned to the client.
   • BThe exception is logged, which is unnecessary for login failures.
   • CThe exception is a custom class rather than a standard Java exception.
   • DThe exception is returned to the client, which is a user-friendly error handling practice.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   In a try-catch-finally block, what is the purpose of the finally block?

   • ATo handle exceptions that are not caught by the catch block.
   • BTo log the exception details.
   • CTo return a default value when an exception occurs.
   • DTo ensure cleanup code runs regardless of whether an exception occurs.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A Java web application is being developed for a financial institution. The application must provide user-friendly error messages but also comply with audit requirements that mandate detailed logging of all exceptions. The application runs in a clustered environment with multiple nodes. What is the best approach?

   • ASend all exception details to the user's browser for transparency and log only a reference ID.
   • BLog exceptions locally on each node and rely on the operating system to protect the logs.
   • CDisable logging in production to reduce the risk of data exposure.
   • DUse a centralized logging service that aggregates logs from all nodes, with restricted access and sanitization of sensitive data.
   Reveal Solution Discussion Select an answer first