Secure Exception Handling CASENET Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   In .NET, which class is the base class for all exceptions?

   • ASystemException
   • BException
   • CRuntimeException
   • DApplicationException
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   In ASP.NET Core, which method is used to configure a custom error page for unhandled exceptions?

   • Aapp.UseStatusCodePages("/Error")
   • Bapp.UseCustomErrors("/Error")
   • Capp.UseErrorPage("/Error")
   • Dapp.UseExceptionHandler("/Home/Error")
   Reveal Solution Discussion Select an answer first
4. 38expert · medium

   A healthcare application stores patient records. The application has a centralized exception handler that logs exceptions to a file. A recent audit found that some exception logs contain patient names and medical record numbers because they were included in exception messages thrown by the data access layer. The compliance team requires that no protected health information (PHI) be written to logs. You need to modify the exception handling to prevent PHI leakage while still capturing enough information to debug issues. What is the most effective solution?

   • AEncrypt the log file so that PHI is not readable by unauthorized personnel.
   • BAdd a log filter that redacts any text matching a regular expression for medical record numbers.
   • CModify the data access layer to throw exceptions without including PHI, and update the centralized handler to log only exception type, stack trace, and a non-sensitive correlation ID.
   • DDisable logging for the data access layer entirely.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   What is the primary security reason for implementing secure exception handling in a .NET application?

   • ATo prevent attackers from gaining insight into the application's internal structure through error messages
   • BTo ensure that all exceptions are converted to HTTP 500 responses
   • CTo make the application run faster by catching exceptions early
   • DTo ensure that exceptions are logged with full detail for debugging
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   You are reviewing a C# method that parses user-supplied JSON input. The current code catches all exceptions with a single catch block and logs the exception. You need to differentiate between a malformed JSON payload (which should return a 400 Bad Request) and a database connection failure (which should return a 503 Service Unavailable). What is the most appropriate exception handling approach?

   • ACatch the generic Exception, inspect the message string, and decide the HTTP status code based on keywords.
   • BUse multiple catch blocks: catch JsonException for parsing errors and catch SqlException for database errors, with a generic catch for unexpected exceptions.
   • CUse a single catch block that always returns a 500 Internal Server Error for any exception.
   • DCatch only Exception and rethrow it after logging, letting the global handler decide the status code.
   Reveal Solution Discussion Select an answer first