CASE Secure Error Handling & Logging 2

Question 1

In the OWASP Top 10 (2021), which category covers missing audit logs and lack of alerting on attacks?

Accepted Answer

A09: Security Logging and Monitoring Failures

Answer

A09:2021 covers insufficient logging, monitoring, and alerting that let breaches go undetected.

Question 2

An attacker submits a username containing CR/LF characters so that a fake 'login succeeded' line appears in the log. What is the best mitigation?

Accepted Answer

Encode or strip CR/LF and other control characters before writing user input to logs

Answer

Neutralizing line-break and control characters prevents log forging (CWE-117).

Question 3

What is the most secure way to handle uncaught exceptions in a Java EE web application?

Accepted Answer

Configure a global <error-page> in web.xml that shows a generic message while details are logged server-side

Answer

A global error page hides internal details from users while the full error is logged securely.

Question 4

An exception is thrown during an authorization check. Following the fail-secure principle, what should happen?

Accepted Answer

Deny access and log the failure

Answer

Fail-secure (fail-closed) means denying access by default when a security control errors out.

Question 5

Which of the following SHOULD be recorded in a security log?

Accepted Answer

A failed login attempt with timestamp, username, and source IP

Answer

Security events should be logged with context, but never secrets like passwords, tokens, or full card numbers.

(CASE) Certified Application Security Engineer Practice Test