Secure Exception Handling CASENET Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A developer is refactoring a legacy .NET method that performs multiple operations: reading a file, parsing data, and updating a database. The current code has a single try-catch that catches Exception and returns a generic error. The team wants to improve error handling so that file-related errors are logged with the file path, database errors are logged with the SQL command, and all other errors are logged generically, without exposing any of these details to the user. What is the best structure?

   • AUse separate try-catch blocks for the file operation, the parsing operation, and the database operation, each logging specific details and throwing a custom exception with a generic message.
   • BKeep a single try-catch but inspect the exception type to determine whether to log the file path or SQL command.
   • CUse a single try-catch that logs the full exception object and returns a generic message.
   • DWrap the entire method in a try-catch that logs the method name and rethrows the original exception.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In .NET, which block is used to ensure that resources are cleaned up regardless of whether an exception is thrown?

   • Atry
   • Busing
   • Ccatch
   • Dfinally
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   You are implementing a centralized exception logging mechanism for a .NET application. The logging must capture the exception type, stack trace, and the user's ID, but must not capture the user's session token or any form data. Which approach best meets these requirements?

   • ALog the entire exception object and the current HttpContext, including all request headers and form collections.
   • BLog the exception and the raw query string, which may contain the session token if it is passed in the URL.
   • CLog only the exception type and message, and discard all other context.
   • DLog the exception type, stack trace, and a sanitized context object that includes only the user ID and a correlation ID.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   During a code review of exception handling, what should a reviewer look for?

   • ACustom exception classes that derive from Exception
   • BCatch blocks that log the full exception details to the server log
   • CFinally blocks that release resources
   • DCatch blocks that display the exception message directly to the user
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A team has implemented a centralized exception handler that logs exceptions and returns a generic JSON error response. They want to test that the handler does not leak sensitive data and that it logs all unhandled exceptions. Which testing strategy is most effective?

   • AManually trigger an exception in the browser and check the network tab for the response body.
   • BWrite integration tests that trigger various exceptions and assert that the response body contains no stack trace or exception message, and that the log contains the exception details.
   • CPerform a code review of the exception handler to ensure it uses a generic message and logs the exception.
   • DUse a unit test that calls the exception handler directly with a mock exception and checks the returned response.
   Reveal Solution Discussion Select an answer first