Defensive Coding Against Information Disclosure CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A team uses Serilog in an ASP.NET Core application. They need to log exceptions for debugging but must ensure that passwords and credit card numbers never appear in log files. Which configuration should they use?

   • AEncrypt the entire log file at rest so that even if sensitive data is logged, it is not readable by unauthorized parties.
   • BUse a custom enricher that applies redaction to sensitive properties before the event is written to the sink.
   • CLog only the exception message and stack trace, and avoid logging any method parameters or context data.
   • DEnable Serilog's built-in filtering to exclude all properties named Password, CardNumber, and Token from log events.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary purpose of centralized error logging?

   • ATo display error details to users in a user-friendly format
   • BTo store detailed error information securely for debugging while keeping it out of user responses
   • CTo automatically fix errors without developer intervention
   • DTo increase the performance of the application by reducing error handling overhead
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A development team is using Serilog in an ASP.NET Core application. They want to ensure that no sensitive data, such as passwords or credit card numbers, is written to logs. Which Serilog feature should they use?

   • AUse the Serilog `Destructure` option to limit the depth of logged objects.
   • BSet the minimum log level to Fatal so that only fatal errors are logged, reducing the chance of sensitive data.
   • CUse a custom enricher that applies a redaction policy to all log events before they are written.
   • DDisable logging in production to avoid any risk of sensitive data exposure.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An attacker triggers an unhandled exception and sees a detailed error page with file paths and SQL query fragments. What is the primary security impact?

   • AUnauthorized access to the database because the SQL query is shown
   • BInformation disclosure that aids in further attacks
   • CDenial of service due to the error page consuming resources
   • DLoss of data integrity because the error page modifies data
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A .NET Framework web application has a global exception handler in Global.asax. Currently, the Application_Error method writes the exception details to the response. You need to change it so that users see a generic message but developers can still get details. What should you do?

   • AIn Application_Error, throw a new custom exception with a user-friendly message.
   • BIn Application_Error, log the exception, clear the error, and redirect to a generic error page.
   • CIn Application_Error, set the response status code to 500 and write the exception message to the response.
   • DIn Application_Error, use Server.Transfer to a page that displays the stack trace only for authenticated administrators.
   Reveal Solution Discussion Select an answer first