Disclaimer:
Educational Use Only:
The website links provided are to be used strictly for educational and knowledge-gaining purposes only.
No Misuse:
Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.
Respect for Websites and Businesses:
Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.
Acknowledge Value of Knowledge:
Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.
No Endorsement:
The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.
User Responsibility:
By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.
- What is the main goal of error handling in cybersecurity?
a. To make systems run faster
b. To gracefully manage unexpected events and avoid information leaks
c. To completely ignore system errors
d. To make error messages colorful
Answer: b. To gracefully manage unexpected events and avoid information leaksexamradar+1 - Why should error messages in web applications avoid exposing internal system details?
a. To help attackers understand the application design
b. To make the interface less attractive
c. To prevent giving clues for potential attacks
d. To increase debugging speed for users
Answer: c. To prevent giving clues for potential attacksowasp+2 - What is a recommended practice when displaying error messages to users?
a. Show the full stack trace
b. Only show brief, generic messages
c. Provide the database schema
d. Reveal backend server names
Answer: b. Only show brief, generic messagesiansresearch+2 - What can happen if an application fails to handle errors properly?
a. Enhanced user satisfaction
b. Exposure of sensitive details and increased vulnerability
c. Fewer security checks
d. Less frequent maintenance
Answer: b. Exposure of sensitive details and increased vulnerabilityexamradar+1 - What is the benefit of logging errors in cybersecurity?
a. Logging is irrelevant
b. Logs help analyze and debug issues for better security
c. Logs slow down the system
d. Logs are only useful to end-users
Answer: b. Logs help analyze and debug issues for better securityiansresearch+1 - Why is it important not to disclose whether a login error was due to a wrong username or password?
a. To speed up registration
b. To prevent username enumeration by attackers
c. To reduce application complexity
d. To increase traffic
Answer: b. To prevent username enumeration by attackersowasp+1 - What information should never be displayed in error messages?
a. “Invalid input”
b. Stack traces and server configurations
c. General notifications
d. Page load time
Answer: b. Stack traces and server configurationsiansresearch+1 - How can attackers exploit detailed error messages?
a. By using them as user guides
b. By learning about the application’s internal structure
c. By speeding up searches
d. By reducing data usage
Answer: b. By learning about the application’s internal structureexamradar+1 - What type of error messages should public-facing systems display?
a. Detailed technical messages
b. Generic, non-specific messages
c. Source code snippets
d. Database queries
Answer: b. Generic, non-specific messagessonarsource+2 - What role does user input validation play in error handling?
a. It is not related
b. Ensures only valid data reaches the application, reducing harmful errors
c. It always causes system crashes
d. Deletes user data
Answer: b. Ensures only valid data reaches the application, reducing harmful errorssonarsource+1 - What is meant by “failing safe” in error handling?
a. Allowing all actions after an error
b. Denying access or stopping processes to avoid further issues
c. Displaying passwords in errors
d. Ignoring user reports
Answer: b. Denying access or stopping processes to avoid further issuesowasp+1 - What is a potential problem with silent error handling?
a. Attackers stay unaware
b. Legitimate errors go unnoticed and unaddressed
c. It simplifies coding
d. It accelerates loading
Answer: b. Legitimate errors go unnoticed and unaddressedsonarsource+1 - What must a secure error handler always do with application errors?
a. Ignore them
b. Catch and handle them, never exposing internals
c. Print them to the user’s screen
d. Notify social media
Answer: b. Catch and handle them, never exposing internalsiansresearch+1 - Which of the following is a best practice when logging errors?
a. Log sensitive data without masking
b. Log only non-sensitive, relevant information
c. Avoid logging for performance
d. Log all user inputs and passwords
Answer: b. Log only non-sensitive, relevant informationsonarsource+1 - Why should errors related to networking or the database be handled carefully?
a. These errors are never security threats
b. They may expose sensitive configuration information
c. Users need full technical details
d. None of the above
Answer: b. They may expose sensitive configuration informationexamradar+1 - What is information leakage in the context of errors?
a. Public displaying of internal system details through errors
b. Increasing page speed
c. Compressing error logs
d. Formatting error messages
Answer: a. Public displaying of internal system details through errorsowasp+1 - How can validating and sanitizing user input improve error handling security?
a. It cannot
b. Prevents injection attacks and malicious errors
c. Makes errors look better
d. Slows down the system
Answer: b. Prevents injection attacks and malicious errorsexamradar+1 - What is the best way to notify administrators about critical errors?
a. Ignore the issue
b. Trigger logs and alerts
c. Show only to end-users
d. Display on the public homepage
Answer: b. Trigger logs and alertsiansresearch+1 - When is it acceptable to display full error details to users?
a. Always
b. Only during internal testing, never in production
c. For password errors
d. After login failures
Answer: b. Only during internal testing, never in productionowasp+1 - How does proper error handling help prevent security misconfigurations?
a. It does not help
b. By reducing risk of accidental exposure through generic handling
c. By exposing all errors
d. By deleting logs
Answer: b. By reducing risk of accidental exposure through generic handlingexamradar+1 - What does “fail open” mean in security error handling?
a. System becomes accessible upon error
b. System denies access when unsure
c. System fixes all errors automatically
d. None of the above
Answer: a. System becomes accessible upon errorowasp - Why is global exception (catch-all) handling useful?
a. It hides all details from users and catches unexpected issues
b. It prints errors to the screen
c. It makes code slower
d. It alerts attackers
Answer: a. It hides all details from users and catches unexpected issuessonarsource+1 - What is a “stack trace” in error handling?
a. A hiking tool
b. A detailed error path through code, revealing internal logic
c. A summary report
d. User notes
Answer: b. A detailed error path through code, revealing internal logicowasp - What type of message should a user see if their access is denied due to permissions?
a. “Access denied” or similar generic response
b. The permission matrix
c. Server file names
d. The role list
Answer: a. “Access denied” or similar generic responseowasp - What is a common mistake when dealing with configuration errors?
a. Showing config file contents in messages
b. Keeping details hidden in internal logs only
c. Blocking all errors
d. Increasing server load for debugging
Answer: a. Showing config file contents in messagessonarsource+1 - Why should all application errors be handled explicitly in code?
a. To prevent leaks and improve resilience
b. To simplify UI
c. To make attackers’ job easier
d. To save memory
Answer: a. To prevent leaks and improve resilienceiansresearch+1 - What is the preferred way to handle a fatal configuration error?
a. Terminate the program gracefully after logging
b. Expose the config file to the user
c. Keep running in an unstable state
d. Ignore the error
Answer: a. Terminate the program gracefully after loggingsonarsource - What impact can unhandled errors have on service availability?
a. No effect
b. May crash or reduce system’s availability to users
c. Adds new features
d. Speeds up computation
Answer: b. May crash or reduce system’s availability to usersowasp - How does consistent error messaging improve security?
a. Attackers cannot distinguish between different causes
b. It confuses users
c. It speeds up loading
d. It deletes sensitive data
Answer: a. Attackers cannot distinguish between different causesowasp - What is the risk of including user-supplied input in error messages?
a. No risk
b. May allow for injection or XSS attacks
c. Makes messages longer
d. Only improves readability
Answer: b. May allow for injection or XSS attackssonarsource+1 - Which area should get detailed error messages for troubleshooting?
a. Only internal application logs
b. Public user pages
c. External social feeds
d. Landing page
Answer: a. Only internal application logsiansresearch+1 - What does “sanitize” mean in the context of logging errors?
a. Clean out sensitive data before logging
b. Display errors on homepages
c. Send logs to third-parties unencrypted
d. Compress log files
Answer: a. Clean out sensitive data before loggingappknox+1 - What is the result of “leaking” error information via logs?
a. Attacker gains no benefit
b. Attacker may exploit the revealed details
c. User experience improves
d. Database runs faster
Answer: b. Attacker may exploit the revealed detailsveracode+1 - Why should error handling distinguish between recoverable and unrecoverable errors?
a. So the system can try to fix minor issues or stop for major ones
b. To make code longer
c. To confuse admins
d. To create error art
Answer: a. So the system can try to fix minor issues or stop for major onessonarsource - Why avoid showing precise error codes during failed login attempts?
a. To make attackers guess and not automate attacks
b. To improve animation speed
c. For SEO reasons
d. To increase password length
Answer: a. To make attackers guess and not automate attacksiansresearch+1 - What is a benefit of using standard/generic error pages?
a. Generic pages prevent detailed information leakage
b. They take up less storage
c. Search engines like them better
d. They can be ignored by users
Answer: a. Generic pages prevent detailed information leakageexamradar+1 - Why should error handling be part of a cybersecurity policy?
a. Consistent handling promotes security and compliance
b. It wastes time
c. It makes documentation lengthy
d. Users dislike it
Answer: a. Consistent handling promotes security and complianceveracode+1 - What does “catch” mean in error handling?
a. Trapping and processing errors that occur
b. Writing new code
c. Deleting all logs
d. Catching up on work
Answer: a. Trapping and processing errors that occuriansresearch+1 - What can occur if detailed backend errors are sent to a user’s browser?
a. Increased risk of security vulnerabilities
b. Decreased risk of attacks
c. Faster page loads
d. Server memory increases
Answer: a. Increased risk of security vulnerabilitiesveracode+1 - What is a recommended method for responding to invalid user input?
a. Display a generic message and validate before processing
b. Ignore the input entirely
c. Show full input to all users
d. Only check for numbers
Answer: a. Display a generic message and validate before processingexamradar+1 - Why is it risky to allow system exceptions to “bubble up” to the user interface?
a. Users may learn about backend logic, enabling attacks
b. It helps with debugging
c. It makes errors easier to find
d. It improves security
Answer: a. Users may learn about backend logic, enabling attackssonarsource+1 - How should sensitive error logs be protected?
a. By encrypting logs and controlling access
b. By sharing logs publicly
c. By not logging at all
d. By posting on forums
Answer: a. By encrypting logs and controlling accessappknox+1 - Why should logs be regularly reviewed in error handling?
a. Helps detect security incidents and abnormal activity
b. Increases file size
c. Makes code faster
d. Reduces admin workload
Answer: a. Helps detect security incidents and abnormal activityveracode+1 - What is a zero-day vulnerability in error handling?
a. Newly discovered flaw not yet patched, often exposed through errors
b. A typo error
c. Friday-only error
d. Repeated system crash
Answer: a. Newly discovered flaw not yet patched, often exposed through errorsautomationcommunity+1 - Which approach reduces the attack surface related to errors?
a. Hiding all errors from users
b. Generic error handling, with detailed info restricted to admins
c. Publishing error logs online
d. Never checking user input
Answer: b. Generic error handling, with detailed info restricted to adminsexamradar+1 - What’s the first step to secure error handling in development?
a. Define rules for what errors are logged/shown
b. Let everyone code as they want
c. Never look at errors
d. Only focus on style
Answer: a. Define rules for what errors are logged/shownveracode+1 - How can improper error handling help an attacker perform reconnaissance?
a. By revealing structure, file locations, or technologies used
b. By hiding URLs
c. By encrypting all data instantly
d. By showing weather info
Answer: a. By revealing structure, file locations, or technologies usedveracode+1 - What is the recommended reaction to an unrecoverable error?
a. Log the problem and stop the affected process
b. Let the system continue with unknown state
c. Ignore the event
d. Reset all passwords
Answer: a. Log the problem and stop the affected processexamradar+1 - Why use consistent error formats?
a. Makes errors easier to analyze and less risky to expose
b. Makes logs bigger
c. Increases programmer workload
d. Reduces website speed
Answer: a. Makes errors easier to analyze and less risky to exposeexamradar+1 - Which is a common security framework recommending best practices for error handling?
a. OWASP
b. HTML
c. SQL
d. CSS
Answer: a. OWASPowasp+1
- https://examradar.com/error-handling-in-application-logic-mcqs/
- https://owasp.org/www-community/Improper_Error_Handling
- https://www.sonarsource.com/resources/library/error-handling-guide/
- https://www.iansresearch.com/resources/all-blogs/post/security-blog/2023/08/17/error-handling-and-logging-checklist
- https://www.appknox.com/blog/error-message-vulnerabilities-why-you-should-care-about-information-exposure
- https://www.veracode.com/security/error-handling-flaws-information-and-how-fix-tutorial/
- https://automationcommunity.com/100-mcqs-mastery-on-cybersecurity/
- https://www.sanfoundry.com/1000-cyber-security-questions-answers/
- https://www.igmguru.com/blog/cyber-security-mcqs
- https://testbook.com/objective-questions/mcq-on-error-detecting-codes–5eea6a0d39140f30f369e243
- https://www.placementpreparation.io/mcq/cyber-security/
- https://www.sanfoundry.com/cyber-security-questions-answers-bugs-vulnerabilities/
- https://sharncommerce.org/wp-content/uploads/2024/03/B.com-V-Sem-NEP-Cyber-Security-Solved-MCQs.pdf
- https://www.yeahhub.com/cyber-security-ethical-hacking-mcq-questions-answers-part1/
- https://www.scribd.com/document/872555458/Cybersecurity-Fundamentals-MCQ
- https://www.scribd.com/document/468652102/Error-Detection-and-Correction-MCQ-Data-Communication-and-Networking-ExamRadar-pdf
- https://www.w3schools.com/cybersecurity/cybersecurity_quiz.php
- https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf
- https://success.skyhighsecurity.com/Skyhigh_Secure_Web_Gateway_(On-Prem)/Secure_Web_Gateway_Product_Guide/Monitoring/Error_Handling/Best_practices_-_Working_with_the_Error_Handler
- https://svenruppert.com/2024/05/07/mastering-secure-error-handling-in-java-best-practices-and-strategies/
