Secure Exception Handling CASENET Practice Questions (Page 7)

Questions 31–35

1. 31application · medium

   A .NET Core application has multiple microservices, each with its own exception handling middleware. The security team wants to standardize error responses and logging across all services without duplicating code. What is the most maintainable approach?

   • ACreate a shared NuGet package that provides a custom exception handling middleware and logging configuration, and reference it in each service.
   • BConfigure each service's web.config to redirect errors to the same external error page.
   • CCopy the exception handling code from one service to all others to ensure they match.
   • DUse a separate logging service that each microservice calls directly from its catch blocks.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following should be avoided in error messages shown to end users?

   • AA generic message like 'An error occurred'
   • BA reference to a support ticket number
   • CThe exception type, such as 'SqlException'
   • DA message asking the user to try again later
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   An ASP.NET MVC application has a custom error page that displays the exception message to the user. The exception message is generated from a third-party library and may contain file paths. You need to ensure that the user never sees these paths while still logging them for support. What is the best way to achieve this?

   • ASet the customErrors mode to 'Off' so that the default error page is shown, which does not include file paths.
   • BDisplay a generic message on the error page and log the full exception details, including the message, in the global error handler.
   • CConfigure the error page to show the exception message only to users in the Administrator role.
   • DIn the error page, parse the exception message and remove any text that looks like a file path before displaying it.
   Reveal Solution Discussion Select an answer first
5. 34expert · medium

   An e-commerce application is being redesigned. The previous version displayed detailed error pages that included stack traces and SQL queries, which led to a security breach. The new design must ensure that production users see only a generic error page, but support engineers need access to detailed error information for troubleshooting. The application is hosted on Azure App Service. What is the best way to provide detailed error information to support engineers without exposing it to end users?

   • AConfigure the application to log detailed exceptions to Azure Application Insights and use a generic error page for all users.
   • BStore detailed error information in the user's session and display it on the error page.
   • CEnable the developer exception page in production and restrict access to it using IP restrictions in the web.config.
   • DCreate a custom error page that displays the exception details only when the request includes a special query string parameter.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Why is it important to test exception handling paths in an application?

   • ATo make the application run faster by catching exceptions earlier
   • BTo ensure that all exceptions are logged to the client-side console
   • CTo verify that error messages do not expose sensitive information
   • DTo ensure that exceptions are never thrown in production
   Reveal Solution Discussion Select an answer first