Secure Exception Handling CASENET Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   An ASP.NET application uses a custom exception class that includes a property for the user's account ID. When an exception is thrown, the global handler logs the exception and displays the exception message on the error page. A penetration test reveals that the account ID appears in the error page. The team needs to fix this without losing the account ID in logs for audit purposes. What is the best solution?

   • ARemove the account ID from the custom exception and log it separately in the catch block.
   • BModify the custom exception to store the account ID in a separate property that is logged but not included in the ToString() output, and ensure the error page uses a generic message.
   • CCatch the exception in each controller and remove the account ID from the message before passing it to the error page.
   • DEncrypt the account ID before storing it in the exception property.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   An ASP.NET Core application has a custom error handling middleware that logs exceptions and returns a generic response. However, the middleware is registered after the authentication middleware. When an unhandled exception occurs during authentication, the error handling middleware does not catch it, and the default server error page is shown. You need to ensure that all unhandled exceptions, including those from authentication, are handled by the custom middleware. What should you do?

   • ARegister the error handling middleware after authentication but before the MVC middleware.
   • BUse the UseExceptionHandler extension method in the Configure method after all other middleware.
   • CMove the error handling middleware to the beginning of the pipeline, before authentication.
   • DWrap the authentication middleware in a try-catch block.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A financial application's API returns detailed error messages that include SQL query fragments and internal server paths. The security team wants to eliminate this leakage, but the support team relies on these details to troubleshoot client issues. The application is used by both internal employees and external customers. What is the best approach that balances security and support needs?

   • AReturn detailed error messages only to requests coming from internal IP addresses.
   • BLog all error details server-side and have support staff access the logs directly instead of through the API.
   • CReturn generic error messages to all clients, and provide a separate support-only endpoint that returns detailed errors when authenticated with a support role.
   • DEncrypt the error details and include them in a custom header that only support tools can decrypt.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard · select all that apply

   A team has implemented a centralized exception handler that logs exceptions and returns a generic error page. They want to verify that the handler does not leak sensitive information and that it logs all unhandled exceptions. Which testing techniques are appropriate? (Select all that apply.)

   • AUse a fuzzing tool to send malformed requests and verify that the application returns generic errors without crashing.
   • BWrite integration tests that trigger exceptions in controllers and assert that the response body does not contain stack traces or exception messages.
   • CManually trigger an exception and visually inspect the error page for any internal details.
   • DUse a unit test to verify that the logging method sanitizes sensitive data before writing to the log.
   • EPerform a code review to confirm that the exception handler is registered globally and that no other error handling paths bypass it.
   Check answers Discussion Select an answer first
6. 20application · medium

   An ASP.NET application is being updated to handle 404, 500, and 403 errors with custom pages. The team wants to ensure that the custom pages do not reveal whether a resource exists or expose internal paths. What should they do?

   • ACreate three separate custom error pages with generic messages that do not reference the requested URL or internal paths.
   • BUse the same custom error page for all errors and include the original URL in the page content.
   • CRedirect all errors to the home page without any message.
   • DDisplay the exception message on the 500 error page to help users understand the failure.
   Reveal Solution Discussion Select an answer first