Secure Exception Handling CASENET Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A .NET web application processes user-uploaded files. When a file is malformed, the application throws a custom exception that includes the original file name and the user's email address. The current global error handler logs the exception message and displays it directly on the error page. After a security review, the team decides to prevent sensitive data from appearing in the browser while still capturing enough detail for support staff. What should be implemented?

   • ALog the full exception details server-side, and show a generic message on a custom error page.
   • BCatch the exception in the page-level try-catch, display the exception message, and log the stack trace.
   • CRemove the email from the exception message and continue showing the message to the user.
   • DUse Response.Redirect to an error page that includes the exception details in the query string.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a common .NET exception type that indicates an attempt to access an element outside the bounds of an array?

   • ANullReferenceException
   • BArgumentException
   • CIndexOutOfRangeException
   • DInvalidCastException
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An ASP.NET MVC application currently shows the Yellow Screen of Death with stack traces to all users. The team wants to implement custom error pages that are user-friendly and do not reveal internal details. They also want to ensure that unhandled exceptions are logged centrally. Which combination of steps should they take?

   • AUse IIS's built-in error pages and disable all custom error handling in the application.
   • BSet customErrors mode to Off so the default handler shows a generic message, and log exceptions in each controller.
   • CCreate a single error page that displays the exception message and stack trace, and log exceptions in the page's code-behind.
   • DAdd a custom error page for each HTTP status code and configure the application to use it, while logging exceptions in Application_Error.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During penetration testing, an ASP.NET application returned the following error page: 'System.Data.SqlClient.SqlException: Invalid object name 'dbo.Orders'. at MyApp.Data.OrderRepository.GetOrders() in C:\inetpub\wwwroot\MyApp\Data\OrderRepository.cs:line 42.' The team needs to fix this vulnerability while still allowing developers to see full details in the development environment. What is the best approach?

   • AEnable custom errors for remote users and disable them for localhost, then use a generic error page for remote requests.
   • BChange the exception type to a generic Exception and rethrow it to the error page.
   • CRemove the try-catch block so the default ASP.NET error handler displays a sanitized page.
   • DEncrypt the error message before displaying it to the user.
   Reveal Solution Discussion Select an answer first
6. 5expert · medium · select all that apply

   You are conducting a security review of a .NET application's exception handling. The application uses a global exception handler that logs exceptions and returns a generic error page. However, you find that some controllers have their own try-catch blocks that return exception messages to the client. Which of the following actions should you take to ensure consistent and secure exception handling? (Select all that apply.)

   • AEnsure the global exception handler logs the full exception details.
   • BChange the global exception handler to return the exception message to the client for easier debugging.
   • CRemove the controller-level try-catch blocks that return exception messages.
   • DModify the controller-level catch blocks to log the exception and rethrow it.
   Check answers Discussion Select an answer first