CAS-005 · Question #435
A penetration tester discovers a condition that causes unexpected behavior in a web application. This results in the dump of the interpreter's debugging information, which includes the interpreter's…
The correct answer is A. Include routines in the application for message handling. By implementing structured error-handling routines (e.g., try/catch blocks with generic user-facing error messages and internal logging of detailed debug information), you prevent the application from exposing sensitive interpreter details to end users. This practice ensures…
Question
A penetration tester discovers a condition that causes unexpected behavior in a web application. This results in the dump of the interpreter’s debugging information, which includes the interpreter’s version, full path of binary files, and the user ID running the process. Which of the following actions would best mitigate this risk?
Options
- AInclude routines in the application for message handling.
- BAdopt a compiled programming language instead.
- CPerform SAST vulnerability scans on every build.
- DValidate user-generated input.
How the community answered
(58 responses)- A72% (42)
- B5% (3)
- C9% (5)
- D14% (8)
Explanation
By implementing structured error-handling routines (e.g., try/catch blocks with generic user-facing error messages and internal logging of detailed debug information), you prevent the application from exposing sensitive interpreter details to end users. This practice ensures that, even when an unexpected condition occurs, only a sanitized error page is shown, mitigating information-leakage risks at their source.
Community Discussion
No community discussion yet for this question.