CASE Secure Error Handling & Logging

Question 1

What should a production application show users when an unhandled exception occurs?

Accepted Answer

A generic error message, with details logged on the server only

Answer

Detailed errors leak information an attacker can use, such as stack traces, queries and versions. Users should get a generic message, while the details go to secure server-side logs.

Question 2

What does the 'fail securely' (fail closed) principle mean?

Accepted Answer

When an error occurs, the system defaults to denying access

Answer

Failing securely means that if an exception happens, for example during an authorization check, the system ends up in a secure state and denies access rather than allowing it.

Question 3

Which of these should NEVER be written to application logs?

Accepted Answer

Plaintext passwords and full session tokens

Answer

Logs are often widely accessible and kept for a long time. Passwords, session tokens, card numbers and similar secrets must never be logged, or should be masked.

Question 4

An attacker submits input containing CR/LF characters so that fake entries appear in the log file. What is this attack called?

Accepted Answer

Log injection (log forging)

Answer

Log injection uses newline characters to forge log entries, which can mislead investigators. The defense is to sanitize or encode user data before it is logged.

Question 5

Which coding practice weakens security in exception handling?

Accepted Answer

Using empty catch blocks that swallow exceptions

Answer

Empty catch blocks hide failures, can leave the application in an inconsistent or insecure state, and remove evidence of attacks.

(CASE) Certified Application Security Engineer Practice Test

(CASE) Certified Application Security Engineer Practice Test

CASE Secure Error Handling & Logging