CASE Secure Error Handling & Logging 3

Question 1

In ASP.NET web.config, which customErrors mode displays detailed error information, including stack traces, to remote users?

Accepted Answer

Off

Answer

mode="Off" shows detailed ASP.NET errors to all users, including remote ones, leaking internal information.

Question 2

Which login failure message best prevents username enumeration?

Accepted Answer

"Invalid username or password."

Answer

A generic message does not reveal whether the username or the password was wrong.

Question 3

What is the primary security risk of an empty catch block?

Accepted Answer

Errors are silently ignored, so the application may continue in an unsafe or inconsistent state

Answer

Swallowing exceptions hides failures and can let security-relevant errors go unhandled and undetected.

Question 4

Why should database connections and file handles be released in a finally block (or equivalent)?

Accepted Answer

To ensure resources are freed even when an exception occurs, preventing resource exhaustion

Answer

finally executes regardless of exceptions, so resources are always released and DoS via leaks is prevented.

Question 5

The Log4Shell vulnerability (CVE-2021-44228) allowed remote code execution through which mechanism?

Accepted Answer

JNDI lookups processed in logged strings in Log4j 2

Answer

Log4j 2 evaluated ${jndi:...} lookups in logged data, letting attackers load remote malicious classes.

(CASE) Certified Application Security Engineer Practice Test