Defensive Coding Against Information Disclosure CASENET Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A .NET application's login page displays 'Invalid username or password' for both unknown users and wrong passwords. A penetration test report recommends changing this to 'User not found' for unknown users. What is the security impact of this change?

   • AIt would help prevent brute-force attacks by making it clear when a username is invalid.
   • BIt would allow attackers to enumerate valid usernames, increasing the risk of targeted attacks.
   • CIt would improve usability without any security downside.
   • DIt would have no effect because attackers can always tell the difference through timing.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A developer uses Serilog to log authentication events. The logs currently include the full JWT token, which is a security risk. The team wants to keep the token's expiration time and issuer for debugging but mask the token itself. What is the best way to achieve this?

   • AUse a Serilog destructuring policy that replaces the token property with a masked value like '***'.
   • BLog only the token's expiration time and issuer, and omit the token entirely.
   • CHash the token with a salt and log the hash along with the expiration time.
   • DLog the token as a base64-encoded string so that it is not directly readable.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard · select all that apply

   A team uses Serilog in a .NET application. They need to ensure that no sensitive data is written to logs, but they also need to log enough information to debug issues. Which of the following practices should they implement? (Select all that apply.)

   • AConfigure the logging level to Information in production to reduce the volume of logs.
   • BUse a custom enricher that redacts properties matching a sensitive-data pattern.
   • CStore logs in a location accessible only to the development team for easier debugging.
   • DUse a destructuring policy that replaces sensitive property values with a placeholder.
   • ELog all method parameters as structured data so that no information is lost.
   Check answers Discussion Select an answer first
5. 9foundation · easy

   What is the primary goal of designing user-facing error messages in a secure application?

   • ATo display the full stack trace so that developers can debug the issue in production
   • BTo log the error details in the user's browser console for debugging
   • CTo provide the user with detailed technical information to help them fix the issue themselves
   • DTo inform the user that an error occurred without revealing internal system details
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of log redaction?

   • ATo compress log files to save storage space
   • BTo encrypt log files so that only authorized users can read them
   • CTo remove or mask sensitive data from log entries before they are stored
   • DTo delete log files after a certain period of time
   Reveal Solution Discussion Select an answer first