Secure Error Handling & Logging Flashcards

In ASP.NET web.config, which customErrors mode displays detailed error information, including stack traces, to remote users?

Answer: Off

mode="Off" shows detailed ASP.NET errors to all users, including remote ones, leaking internal information.

Which login failure message best prevents username enumeration?

Answer: "Invalid username or password."

A generic message does not reveal whether the username or the password was wrong.

What is the primary security risk of an empty catch block?

Answer: Errors are silently ignored, so the application may continue in an unsafe or inconsistent state

Swallowing exceptions hides failures and can let security-relevant errors go unhandled and undetected.

Why should database connections and file handles be released in a finally block (or equivalent)?

Answer: To ensure resources are freed even when an exception occurs, preventing resource exhaustion

finally executes regardless of exceptions, so resources are always released and DoS via leaks is prevented.

The Log4Shell vulnerability (CVE-2021-44228) allowed remote code execution through which mechanism?

Answer: JNDI lookups processed in logged strings in Log4j 2

Log4j 2 evaluated ${jndi:...} lookups in logged data, letting attackers load remote malicious classes.

Why should DEBUG-level logging normally be disabled in production?

Answer: It may record sensitive data and internal details and can degrade performance

Verbose debug output often captures request bodies, secrets, and internals that should not persist in production logs.

An application shows users a message like "An error occurred. Reference ID: 8F3A2C". What is the main purpose of the reference ID?

Answer: To let support staff correlate the user's report with the detailed server-side log entry without exposing details

A correlation ID links the generic user message to full internal logs while revealing nothing sensitive.