Secure Exception/Error Handling CASEJAVA Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A Java web service returns error responses that include the exception class name, method name, and line number from the stack trace. The security team is concerned about information disclosure. What is the best way to reduce the risk while still allowing developers to debug?

   • AReturn the stack trace only to clients that present a valid API key.
   • BRemove the line number from the stack trace but keep the exception class name in the response.
   • CLog the full stack trace server-side and return a generic error message to the client.
   • DObfuscate the exception class names before returning them.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A Java web application has multiple servlets, each with its own try-catch blocks that render different error pages. Some error pages expose internal class names and file paths. The team wants a consistent, secure error-handling approach. Which solution is most effective?

   • ADisable error pages so the container's default error page is shown.
   • BImplement a centralized exception handler that logs details and forwards to a generic error page.
   • CAdd more detailed error pages to each servlet to cover all possible exceptions.
   • DWrap every method in a try-catch that logs and rethrows the exception.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A Java web application has a global exception handler that returns a generic error page. However, the application also has a REST API that returns JSON error responses. The security team wants to ensure that neither the web pages nor the API responses leak internal details. What is the best approach?

   • ALog the exception and return a generic message that is the same for all clients, but include the exception class name in a custom header.
   • BReturn the same generic HTML error page for both web and API requests.
   • CImplement two separate exception handlers: one for web requests that returns an HTML error page, and one for API requests that returns a JSON error object, both logging details server-side.
   • DReturn the same JSON error object for both web and API requests.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   Where should detailed exception information be stored in a Java web application?

   • AIn the user's browser console.
   • BIn the URL as a query parameter.
   • CIn a cookie on the user's machine.
   • DIn server-side logs.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which of the following should be avoided in exception messages that are shown to end users?

   • AThe exception class name and stack trace.
   • BA generic description like 'An error occurred.'
   • CA message like 'Invalid input format.'
   • DA reference to a support ticket number.
   Reveal Solution Discussion Select an answer first