Secure Exception Handling CASENET Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A .NET Core API catches exceptions and logs them using a third-party logging library. The current logging call includes the exception object, the request body, and the user's claims. A security review finds that the logs contain plaintext passwords from the request body. What is the most secure way to log exceptions without losing diagnostic value?

   • AHash the request body before logging it so the original password cannot be recovered.
   • BLog the request body only when the exception is an ArgumentException.
   • CLog only the exception message and stack trace, and exclude the request body and claims from the log entry.
   • DStore the request body in a separate log file with restricted access.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is a recommended practice for logging exceptions securely?

   • ALog full exception details including stack trace to a secure server-side log
   • BLog exceptions to the client-side console for easy debugging
   • CLog exceptions in plain text files in the application's root directory
   • DLog only the exception type and message without any context
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An ASP.NET Core application is deployed behind a load balancer. When an unhandled exception occurs, the default developer exception page is shown to users, revealing stack traces. You need to ensure that production users see a friendly error page while developers can still see detailed errors when accessing the site from the development environment. What is the recommended configuration?

   • AUse app.UseExceptionHandler() with an error path, and conditionally add app.UseDeveloperExceptionPage() only when the environment is Development.
   • BUse app.UseDeveloperExceptionPage() unconditionally in the Configure method.
   • CSet the ASPNETCORE_ENVIRONMENT variable to Production on the development machine.
   • DConfigure the load balancer to strip the X-Forwarded-For header so that the app cannot detect the client IP.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A .NET web service returns exception messages directly in the HTTP response body. A penetration test revealed that the messages include SQL query fragments and internal IP addresses. The business requires that clients receive meaningful error codes (e.g., 400, 404, 500) but no internal details. What is the primary security principle that is being violated?

   • ALeast privilege – the service should only have access to the data it needs.
   • BInformation disclosure – error messages must not reveal internal system details.
   • CDefense in depth – multiple layers of security controls should be used.
   • DFail secure – the system should fail in a secure state.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A .NET application's login page throws an exception when the database is unreachable. The current error page displays the full exception details, including the database connection string. The security team wants to reduce the risk of information disclosure while still allowing the support team to diagnose the issue. What is the most appropriate action?

   • ARedirect the user to the home page without any error message.
   • BDisplay the exception details only to users with the 'Admin' role.
   • CLog the full exception details server-side and display a generic 'Service Unavailable' message to the user.
   • DRemove the connection string from the exception message and continue showing the rest of the details.
   Reveal Solution Discussion Select an answer first