During a security assessment, you find that verbose error messages are enabled. What is the immediate action you should recommend?

Question

Options

• ADisabling verbose error messages and replacing them with generic ones
• BRunning additional port scans to identify vulnerabilities
• CDisabling all authentication mechanisms
• DFlooding the server with HTTP requests

• A
  74% (14)
• B
  5% (1)
• C
  16% (3)
• D
  5% (1)

Explanation

Verbose error messages expose internal system details - stack traces, database names, file paths, framework versions - that attackers use to craft targeted exploits, making their immediate suppression (option A) the correct remediation. Option B (port scans) gathers more information but doesn't fix the disclosed vulnerability already in front of you. Option C (disabling authentication) would catastrophically worsen security, not improve it. Option D (flooding with HTTP requests) is a denial-of-service attack, which is both harmful and irrelevant to the finding.

Memory tip: Think "least privilege for error information" - just as users only get the access they need, error messages should only reveal what the end user needs (a generic "something went wrong" message), never internal system details.

No community discussion yet for this question.