Defensive Coding Against Information Disclosure CASENET Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a direct information disclosure risk caused by improper error handling?

   • ADisplaying the full stack trace to the end user
   • BReturning a generic error message to the user
   • CCatching exceptions and logging only the exception type
   • DLogging the exception details to a secure log file
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   Your organization's security policy requires that application logs be stored for at least one year and that only the security team can access them. The logs contain error details that might include sensitive information. Which storage solution best meets these requirements?

   • AStore logs in the application's database with a foreign key to the user table for easy correlation.
   • BWrite logs to a file on the web server and set the file permissions to allow only the application pool identity.
   • CEmail the logs to the security team daily and delete them from the server.
   • DStore logs in a dedicated log management service with role-based access control and a retention policy of one year.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A .NET web application returns detailed exception messages to users, including stack traces and SQL query fragments. The security team has mandated that users must only see a generic message, while developers need full details for debugging. What should you implement?

   • AWrap each method in a try-catch block that returns the exception message directly to the user.
   • BDisable custom errors in web.config so that ASP.NET displays the detailed error page only to local users.
   • CUse a custom exception class that serializes the stack trace into the response for authenticated users only.
   • DConfigure a global exception handler that logs the full exception details and returns a generic error page to the user.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which practice best supports centralized error logging while protecting sensitive information?

   • AWriting error details to a text file in the application's root directory
   • BSending error details in an email to the system administrator
   • CLogging detailed exception information to a central log server that is only accessible to authorized personnel
   • DDisplaying the full exception details in the user's browser for transparency
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   During a code review, you notice that a logging statement in a .NET application writes the entire exception object, which includes the password reset token in the message. What is the most effective way to prevent this sensitive data from being logged?

   • AUse a custom exception class that overrides ToString() to remove sensitive properties.
   • BSet the log level to Error so that only errors are logged, and the token will not appear.
   • CEncrypt the log file after it is written so that the token is not readable.
   • DModify the logging statement to exclude the exception message and log only the exception type and stack trace.
   Reveal Solution Discussion Select an answer first