Secure Error Handling & Logging Flashcards

In Java, which exception is unchecked (does not need to be declared or caught)?

Answer: NullPointerException

NullPointerException extends RuntimeException, making it unchecked.

In a classic ASP.NET application, which event in Global.asax can be used for centralized handling of unhandled exceptions?

Answer: Application_Error

Application_Error fires for unhandled exceptions, allowing central logging and a safe redirect.

Which set of fields forms a minimal useful security audit record?

Answer: User identity, timestamp, event type, resource affected, and outcome

Audit records should answer who, what, when, where, and whether it succeeded.

Which technique helps provide tamper-evidence for audit logs to support non-repudiation?

Answer: Cryptographic hash chaining or digital signing of log entries

Hash chains or signatures make any modification or deletion of entries detectable.

In Spring MVC, which approach provides centralized exception handling across all controllers?

Answer: A class annotated with @ControllerAdvice containing @ExceptionHandler methods

@ControllerAdvice applies @ExceptionHandler methods globally for consistent, safe error responses.

What does Java's try-with-resources statement guarantee?

Answer: Any AutoCloseable resource declared in it is closed automatically, even if an exception occurs

Introduced in Java 7, it closes declared AutoCloseable resources automatically, preventing leaks.

Why do detailed database error messages returned to the browser increase SQL injection risk?

Answer: They enable error-based SQL injection by revealing query structure and data

Verbose DB errors let attackers infer schema and extract data through error output.