A developer is writing a method that parses user-supplied JSON. If parsing fails, the method should not reveal the internal exception details to the caller. Which implementation is most appropriate?

Catch JsonException and rethrow it after adding the user input to the exception data.

Catch Exception, return null, and do not log anything.

Catch JsonException, log the full exception, and throw a custom InvalidInputException with a generic message.

Let the JsonException propagate to the caller so that they can handle it appropriately.

A .NET application logs user input during form submissions for debugging. The logs contain email addresses and phone numbers, which are considered personal data. The compliance team requires that this data be masked in logs. Which approach should you take?

Store logs in a database with column-level encryption for the sensitive fields.

Stop logging user input entirely to avoid any personal data in logs.

Use a logging enrichment pipeline that applies a regex-based redaction to mask email addresses and phone numbers before the log is written.

Hash the entire log entry so that the personal data is not readable.

A security team wants to detect a potential brute-force attack on a login endpoint. The application logs failed login attempts with the username and IP address. The team wants to set up an alert that minimizes false positives while still catching the attack. Which alerting rule is most appropriate?

Alert when the same IP address has more than 10 failed logins within a 5-minute window.

Alert when a single username has more than 100 failed logins in a day.

Alert when the total number of failed logins across all IPs exceeds 100 in an hour.

Alert when any failed login occurs, because any failure could be an attack.

You are reviewing a .NET application that uses a custom exception class to wrap database errors. The custom exception's Message property includes the full SQL query. When an exception occurs, the application returns the exception's Message to the user. What is the most secure way to handle this?

Catch the exception and return a generic message, but do not log the SQL query to avoid any risk.

Use the built-in SqlException class and let ASP.NET handle the error display.

Keep the custom exception but remove the SQL query from the Message property and put it in the Data collection.

Create a user-facing exception class with a generic message and log the original exception with the SQL query separately.

EC-CouncilCertified Application Security Engineer (.NET)

Domain 7Objective 2

Defensive Coding Against Information Disclosure CASENET Practice Questions (Page 7)

Part of the Secure Coding: Error Handling and Logging domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 41 practice questions to prepare you well beyond it. (estimate)

41questions here

9free pages

10concepts

10 Concepts in This Objective

Information Disclosure Risks in Error Handling
Safe Error Message Design
Structured Exception Handling
Centralized Error Logging
Logging Sensitive Data Protection
Log Obfuscation and Redaction
Secure Log Storage and Access Control
Error Handling in .NET Applications
Logging Frameworks and Best Practices
Monitoring and Alerting for Anomalies

Questions 31–35

31application · medium
A developer is writing a method that parses user-supplied JSON. If parsing fails, the method should not reveal the internal exception details to the caller. Which implementation is most appropriate?
Select an answer first
32application · medium
A .NET application logs user input during form submissions for debugging. The logs contain email addresses and phone numbers, which are considered personal data. The compliance team requires that this data be masked in logs. Which approach should you take?
Select an answer first
33expert · hard
A security team wants to detect a potential brute-force attack on a login endpoint. The application logs failed login attempts with the username and IP address. The team wants to set up an alert that minimizes false positives while still catching the attack. Which alerting rule is most appropriate?
Select an answer first
34foundation · easy
Which .NET logging framework provides a structured logging API that allows for capturing named properties?
Select an answer first
35application · medium
You are reviewing a .NET application that uses a custom exception class to wrap database errors. The custom exception's Message property includes the full SQL query. When an exception occurs, the application returns the exception's Message to the user. What is the most secure way to handle this?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.