CISSP Software Development Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Display generic error messages to users and log detailed errors for admins

  Why this is correct

  Displaying generic error messages like 'An unexpected error occurred' to users is a critical security practice that prevents the inadvertent disclosure of sensitive system information, such as database schemas, server configurations, or internal file paths. Concurrently, logging detailed error messages, including stack traces and specific error codes, for administrators is essential for effective debugging, incident response, and proactive identification of application vulnerabilities. This balanced approach ensures operational efficiency and maintainability without compromising the application's security posture by exposing internal workings to potential attackers.

• ✗

  Display detailed errors to users for troubleshooting

  Why it's wrong here

  Exposing detailed error messages directly to users, such as full stack traces, SQL error messages, or internal file system paths, provides attackers with invaluable reconnaissance data. This information can reveal the application's underlying technologies, database structure, and potential vulnerabilities, enabling them to craft more targeted and effective exploits. Such disclosures significantly increase the attack surface and can lead to serious security breaches, including data exfiltration, privilege escalation, or remote code execution by providing a roadmap to system internals.

• ✗

  Disable all error reporting to eliminate information leakage

  Why it's wrong here

  Completely disabling all error reporting creates a dangerous blind spot, preventing administrators from detecting and diagnosing critical application failures or security vulnerabilities in a timely manner. While it might seem to eliminate information leakage, it merely hides problems, allowing silent failures to persist, potentially leading to data corruption, service outages, or unpatched security flaws that attackers could still discover and exploit through other means. This approach severely hampers incident response capabilities and overall system resilience, making it impossible to address issues proactively.

• ✗

  Encrypt error messages before displaying to users

  Why it's wrong here

  Encrypting error messages before displaying them to users offers no practical security benefit against information leakage if the user, or an attacker impersonating a user, possesses the means to decrypt the message. The core problem of sensitive data disclosure remains unaddressed, as the information is merely obfuscated rather than truly protected from the intended recipient. This method introduces unnecessary computational overhead and complexity without mitigating the fundamental risk of exposing internal system details to anyone who can access and decrypt the message.

Go deeper

Related to this question