Defensive Coding Against Information Disclosure CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company's compliance team requires that application logs be protected from unauthorized access and that any security-related events be reviewed promptly. The logs are currently stored on the same web server as the application. Which action best meets the requirement?

   • AEnable IIS logging to a shared network folder that all developers can access for easier debugging.
   • BMove logs to a separate, restricted-access log management server and configure alerts for suspicious error patterns.
   • CCompress and archive logs daily to reduce storage usage and keep them on the web server.
   • DSet NTFS permissions on the log folder so that only the application pool identity can read the files.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   Your .NET application has been logging errors to a central log management system. The security team wants to be notified when there is a sudden spike in 500 errors, which could indicate an attack. What should you configure?

   • ACreate a dashboard that shows the number of 500 errors, and instruct the security team to check it daily.
   • BSet up an alert rule in the log management system that triggers when the count of 500 errors exceeds a threshold within a time window.
   • CAdd a custom exception handler that sends an email to the security team for every 500 error.
   • DIncrease the log level to Fatal so that only severe errors are logged, reducing noise.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which user-facing error message is designed to avoid revealing internal details?

   • AThe database connection string is invalid. Contact the administrator.
   • BNullReferenceException at C:\App\Controllers\LoginController.cs line 42.
   • CYour password is incorrect because the hash algorithm failed.
   • DAn error occurred while processing your request. Please try again later.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which technique should be used to prevent logging of sensitive data such as passwords and tokens?

   • ALog the full request data to ensure all details are captured for debugging
   • BUse a logging filter to exclude sensitive fields from log entries
   • CStore sensitive data in a separate log file that is more secure
   • DEncrypt the log file so that sensitive data is protected at rest
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Why is it important to avoid catching a general Exception and then rethrowing it without any additional handling?

   • AIt is a performance issue because rethrowing exceptions is slow.
   • BIt causes the application to crash immediately.
   • CIt prevents the application from logging the exception.
   • DIt may expose the stack trace to the user if the exception is not handled further up the call stack.
   Reveal Solution Discussion Select an answer first