CASE Secure Error Handling & Logging 4

Question 1

Which information disclosed in a verbose stack trace is most useful to an attacker?

Accepted Answer

Framework/library versions, internal file paths, and query structure

Answer

Versions, paths, and query details help attackers find known vulnerabilities and craft targeted exploits.

Question 2

What are appropriate file permissions for application log files?

Accepted Answer

Append/write for the application account and read access restricted to authorized administrators

Answer

Least privilege on logs prevents unauthorized reading or modification of sensitive audit data.

Question 3

Under PCI DSS, how long must audit log history be retained?

Accepted Answer

At least one year, with the most recent three months immediately available

Answer

PCI DSS requires one year of audit trail history with at least three months readily available for analysis.

Question 4

When logging a payment event, how should the primary account number (PAN) be handled?

Accepted Answer

Mask it so that only the last four digits are visible

Answer

Masking/truncation prevents exposure of cardholder data; Base64 is encoding, not protection.

Question 5

Review: boolean isAdmin = true; try { isAdmin = checkRole(user); } catch (Exception e) { log.error(e); } — what is the flaw?

Accepted Answer

It fails open: if checkRole throws, the user is treated as an admin

Answer

Initializing to true means an exception leaves privileged access granted; it should default to false.

(CASE) Certified Application Security Engineer Practice Test