CPP Security & Error Handling 2 — Questions and Answers
Question 1: What is the purpose of using checked vs unchecked exceptions in Java?
- Checked exceptions are faster; unchecked are slower
- Checked exceptions must be declared or caught, representing recoverable conditions; unchecked exceptions represent programming errors (Correct answer)
- Unchecked exceptions are thrown by the JVM only
- Checked exceptions only occur at compile time
Correct answer: Checked exceptions must be declared or caught, representing recoverable conditions; unchecked exceptions represent programming errors
Checked exceptions (e.g., IOException) signal conditions callers should handle; unchecked (RuntimeException) signal bugs that should be fixed.
Question 2: What is a buffer overflow vulnerability?
- Filling a database table beyond its capacity
- Writing more data into a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution (Correct answer)
- Overflowing a Java ArrayList by adding too many elements
- Exceeding the maximum size of an integer
Correct answer: Writing more data into a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution
Buffer overflows in C/C++ allow attackers to overwrite return addresses or function pointers, leading to arbitrary code execution.
Question 3: What is exception chaining (wrapping)?
- Throwing multiple exceptions simultaneously
- Catching an exception and re-throwing it wrapped in a new exception to preserve the original cause (Correct answer)
- Logging exceptions in a chain pattern
- Defining a hierarchy of exception classes
Correct answer: Catching an exception and re-throwing it wrapped in a new exception to preserve the original cause
Exception chaining preserves the root cause by embedding the original exception as the 'cause' of a new higher-level exception.
Question 4: What is the difference between authentication and authorization?
- They are synonyms for verifying user identity
- Authentication verifies who you are; authorization determines what you are allowed to do (Correct answer)
- Authentication is for APIs; authorization is for databases
- Authorization happens before authentication
Correct answer: Authentication verifies who you are; authorization determines what you are allowed to do
Authentication confirms identity (login with credentials); authorization checks permissions (can this user access this resource?).
Question 5: What is a cryptographic hash function used for in software security?
- Encrypting and decrypting data with a key
- Generating a fixed-size digest of data that cannot be reversed, used for integrity checking and password storage (Correct answer)
- Compressing data for storage efficiency
- Generating unique session tokens
Correct answer: Generating a fixed-size digest of data that cannot be reversed, used for integrity checking and password storage
Cryptographic hash functions like SHA-256 produce irreversible digests, making them suitable for password hashing and data integrity verification.
Question 6: What is secure coding practice regarding sensitive data in logs?
- Log all data for maximum debuggability
- Never log passwords, tokens, credit card numbers, or PII; mask or omit sensitive fields (Correct answer)
- Encrypt log files after writing
- Store logs in a separate database
Correct answer: Never log passwords, tokens, credit card numbers, or PII; mask or omit sensitive fields
Logging sensitive data creates a secondary attack surface; if logs are exfiltrated, attackers gain credentials or personal information.
CPP Security & Error Handling 2
What is the purpose of using checked vs unchecked exceptions in Java?