What is the purpose of the catch block in a try-catch-finally structure?

To prevent any exception from being thrown in the application

To define the scope of variables used in the try block

To execute code that must run regardless of exceptions

To handle exceptions that occur in the try block

A team is designing a centralized logging solution for a .NET application that handles credit card payments. The logging must capture enough detail to troubleshoot payment failures, but it must not store full credit card numbers or CVV codes. The team is considering logging the exception object, the request body, and the response body. What is the most secure approach?

Log the exception details and a sanitized version of the request body that masks credit card fields, and exclude the response body.

Log the full request and response bodies to a separate encrypted log file.

Log the request body but truncate it to the first 100 characters.

Log only the exception message and stack trace, and do not log any request or response data.

When logging exceptions, which of the following should be excluded from the log entries?

The user's password if it appears in the exception data

What is the purpose of a custom error page in a web application?

To redirect users to the home page automatically

To prevent any exceptions from occurring in the application

To display the full exception details to the user for transparency

To provide a user-friendly, generic message while logging detailed errors server-side

Why is it dangerous to display a stack trace to an end user?

It can reveal the internal file paths and class names used in the application

It can allow the user to modify the application's source code

It can slow down the server because stack traces are large

It can cause the browser to crash

EC-CouncilCertified Application Security Engineer (.NET)

Domain 7Objective 1

Secure Exception Handling CASENET Practice Questions (Page 9)

Part of the Secure Coding: Error Handling and Logging domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 2–3 from this objective — we provide 45 practice questions to prepare you well beyond it. (estimate)

45questions here

9free pages

8concepts

Questions 41–45

41foundation · easy
What is the purpose of the catch block in a try-catch-finally structure?
Select an answer first
42expert · hard
A team is designing a centralized logging solution for a .NET application that handles credit card payments. The logging must capture enough detail to troubleshoot payment failures, but it must not store full credit card numbers or CVV codes. The team is considering logging the exception object, the request body, and the response body. What is the most secure approach?
Select an answer first
43foundation · easy
When logging exceptions, which of the following should be excluded from the log entries?
Select an answer first
44foundation · easy
What is the purpose of a custom error page in a web application?
Select an answer first
45foundation · easy
Why is it dangerous to display a stack trace to an end user?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CASENET

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CASENET” is a trademark of its owner, used for identification only.