Secure Exception/Error Handling CASEJAVA Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Why is secure exception handling critical in a Java web application?

   • AIt ensures exceptions are always logged for debugging.
   • BIt prevents sensitive information disclosure and helps maintain application integrity.
   • CIt guarantees the application never crashes.
   • DIt prevents all security vulnerabilities from being exploited.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which of the following is a common pitfall in exception handling that can lead to information disclosure?

   • AUsing a global exception handler.
   • BDisplaying the exception message directly to the user.
   • CCatching exceptions and rethrowing them as custom exceptions.
   • DLogging exceptions with a generic message.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the danger of 'swallowing' an exception in a Java method?

   • AIt automatically retries the operation.
   • BIt converts checked exceptions to runtime exceptions.
   • CIt makes the code run faster.
   • DIt can hide critical failures and leave the application in an inconsistent state.
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A Java web application has a global exception handler that returns a generic error page. However, the application also uses a REST API that returns JSON error responses. The security team wants to ensure that the REST API does not leak internal details while still providing useful error codes to clients. What is the best approach?

   • ACreate a separate exception handler for REST endpoints that returns a generic JSON error with a status code, and log the full details server-side.
   • BUse the same global exception handler for both web and REST endpoints.
   • CLog the exception and return an empty response with a 500 status code.
   • DReturn the exception message in the JSON response for easier debugging.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A Java application has a centralized exception handler that logs all exceptions and returns a generic error response. However, the security team finds that some exceptions are not being logged because they occur in background threads. What is the best solution?

   • AImplement a custom uncaught exception handler for threads that logs the exception and optionally notifies an administrator.
   • BUse a thread pool that automatically logs exceptions.
   • CIgnore background thread exceptions because they do not affect the user response.
   • DWrap all background thread code in try-catch blocks that call the centralized handler.
   Reveal Solution Discussion Select an answer first