Secure Error Handling & Logging Flashcards

In the OWASP Top 10 (2021), which category covers missing audit logs and lack of alerting on attacks?

Answer: A09: Security Logging and Monitoring Failures

A09:2021 covers insufficient logging, monitoring, and alerting that let breaches go undetected.

An attacker submits a username containing CR/LF characters so that a fake 'login succeeded' line appears in the log. What is the best mitigation?

Answer: Encode or strip CR/LF and other control characters before writing user input to logs

Neutralizing line-break and control characters prevents log forging (CWE-117).

What is the most secure way to handle uncaught exceptions in a Java EE web application?

Answer: Configure a global in web.xml that shows a generic message while details are logged server-side

A global error page hides internal details from users while the full error is logged securely.

An exception is thrown during an authorization check. Following the fail-secure principle, what should happen?

Answer: Deny access and log the failure

Fail-secure (fail-closed) means denying access by default when a security control errors out.

Which of the following SHOULD be recorded in a security log?

Answer: A failed login attempt with timestamp, username, and source IP

Security events should be logged with context, but never secrets like passwords, tokens, or full card numbers.

Which practice best protects the integrity of application logs against tampering by an attacker who compromises the web server?

Answer: Forwarding logs in real time to a centralized, access-restricted log server or SIEM

Shipping logs off-host to a protected central store means a compromised server cannot easily alter them.

Why should all servers in an application environment synchronize clocks using NTP?

Answer: So log events across systems can be accurately correlated during incident investigation

Consistent timestamps are essential to reconstruct the sequence of events across multiple systems.