Defensive Coding Against Information Disclosure CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A user reports that when they enter an invalid product ID, the application displays an error page that includes the full stack trace and the physical path to the source file. What is the primary security risk?

   • AThe error page might allow the user to modify the product ID to access other users' data.
   • BThe error page might be slow to load, causing a denial-of-service condition.
   • CAn attacker could use the stack trace to identify the framework version and potentially exploit known vulnerabilities.
   • DThe error page could expose the user's session token in the URL.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company runs multiple .NET web services and wants to centralize error logs to a SIEM for analysis. The logs must include correlation IDs so that a single user request can be traced across services. Which approach should be used?

   • AUse Windows Event Log on each server and forward events to the SIEM without any correlation ID.
   • BUse a distributed tracing library that propagates a correlation ID and sends structured logs to a central log aggregator.
   • CWrite logs to a shared network file share that all services can access.
   • DHave each service log to its own database table and manually correlate by timestamp.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In ASP.NET Core, what is the role of a global exception handler middleware?

   • ATo log all successful requests for auditing
   • BTo catch unhandled exceptions and provide a generic response to the client
   • CTo automatically retry failed requests
   • DTo redirect users to a custom error page only in development mode
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which alert condition is most likely to indicate a potential SQL injection attack?

   • AA decrease in the number of 404 errors
   • BA single user logging in successfully
   • CAn increase in page load times
   • DA high number of database exceptions with SQL syntax errors
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A .NET application logs exception details to a central log aggregator. The logs include the raw HTTP request body, which may contain passwords. The team wants to keep the request body for debugging but mask the password field. Which approach is most maintainable?

   • AHash the entire request body before logging so that no sensitive data is visible.
   • BModify each controller action to remove the password from the request body before logging.
   • CUse a logging middleware that parses the request body, redacts known sensitive fields, and logs the sanitized body.
   • DLog the request body only when the request fails, and hope that passwords are not present in those cases.
   Reveal Solution Discussion Select an answer first