Secure Exception Handling CASENET Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A developer is writing a method that parses user input into an integer. The method currently catches all exceptions with a single catch block and returns a default value. A security reviewer notes that this hides critical errors such as OutOfMemoryException. What is the recommended way to handle this in .NET?

   • ACatch Exception and check the inner exception for OutOfMemoryException before returning the default.
   • BCatch FormatException and OverflowException specifically, and let other exceptions propagate.
   • CWrap the parsing code in a try-catch that rethrows all exceptions as a custom ParsingException.
   • DUse a catch block for ArgumentNullException only, and ignore other exceptions.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A developer is writing a file download feature in ASP.NET. The code uses File.ReadAllBytes and catches Exception to display a friendly message. A security reviewer points out that catching Exception also catches UnauthorizedAccessException and OutOfMemoryException, which should not be handled the same way. What is the recommended change?

   • AWrap the file read in a try-catch that catches Exception and returns a 500 status code.
   • BUse a single catch block for IOException and return a generic error message for all other exceptions.
   • CCatch specific exceptions such as FileNotFoundException, DirectoryNotFoundException, and UnauthorizedAccessException, and let OutOfMemoryException propagate.
   • DKeep catching Exception but log the exception type and rethrow if it is OutOfMemoryException.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A .NET application logs exceptions using a third-party logging library. The security review found that exception messages sometimes contain the user's password because it is included in a custom exception's Data dictionary. You need to ensure that sensitive data is never written to the log while still capturing enough detail to diagnose issues. What is the most effective approach?

   • AEnsure that custom exceptions do not include sensitive data in their Message or Data properties, and log only the exception type, stack trace, and safe context.
   • BModify the logging library's configuration to filter out any log entry that contains the word 'password'.
   • CLog the exception only in debug builds and suppress all logging in production.
   • DEncrypt the entire log file so that even if sensitive data is logged, it is not readable.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a risk of exposing sensitive information in error messages?

   • AIt may cause the application to crash more frequently
   • BIt may slow down the application's response time
   • CIt may help an attacker identify the database type and version used by the application
   • DIt may cause the user's session to be terminated
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A .NET application has a method that performs multiple operations: it reads a file, parses its content, and writes to a database. The method currently uses a single try-catch block that catches Exception, logs it, and returns a generic error. The team wants to improve the error handling so that different failure types are handled appropriately: file access errors should be logged and retried, parsing errors should be logged and reported to the user, and database errors should be logged and an alert sent to operations. What is the best way to structure the exception handling?

   • AUse a single try-catch block and inspect the exception type with if-else statements.
   • BUse nested try-catch blocks for each operation, catching specific exception types and handling them accordingly.
   • CUse a single try-catch block that catches Exception and always sends an alert to operations.
   • DUse a single try-catch block that catches Exception and rethrows it after logging.
   Reveal Solution Discussion Select an answer first