CISSP Software Development Security Practice Question
During a security review of a web application, testers discover that the application discloses detailed error messages to users, including stack traces. Which secure coding best practice is being violated?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Error handling
Error handling best practices dictate that generic error messages should be shown to users, while detailed errors (e.g., stack traces) should be logged internally to avoid information disclosure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Input validation
Why it's wrong here
Input validation is a fundamental security control that ensures all data received from external sources conforms to expected formats, types, and ranges before being processed by the application. Its primary role is to prevent various injection attacks, buffer overflows, and other vulnerabilities arising from malformed or malicious input. However, input validation operates at the data acceptance stage and does not govern how an application handles or presents error messages when internal system failures or exceptions occur, which is a separate concern related to application robustness and information disclosure.
- ✓
Error handling
Why this is correct
Proper error handling is the direct solution to preventing sensitive information disclosure through error messages. It mandates that applications gracefully intercept all exceptions and internal failures, subsequently presenting only generic, non-informative messages to end-users. Crucially, detailed diagnostic information, such as stack traces or database errors, must be securely logged on the server-side for administrators to troubleshoot, ensuring that no sensitive system details are inadvertently exposed to potential attackers or unauthorized individuals.
- ✗
Secure logging
Why it's wrong here
Secure logging focuses on protecting the integrity, confidentiality, and availability of the log files themselves, ensuring they are tamper-proof, immutable, and accessible only to authorized personnel. This practice is vital for auditing, forensic analysis, and incident response, providing an unalterable record of system events. However, secure logging does not dictate what information an application displays to end-users when an error occurs; it addresses the security of the storage and management of diagnostic data, not the presentation of error messages.
- ✗
Output encoding
Why it's wrong here
Output encoding is a critical security measure primarily designed to prevent Cross-Site Scripting (XSS) attacks by sanitizing user-supplied data before it is rendered in a web browser. It converts potentially malicious characters into their harmless HTML entity equivalents, ensuring that embedded scripts are treated as text rather than executable code. While essential for client-side security, output encoding does not address the server-side issue of an application inadvertently revealing internal system errors, stack traces, or other sensitive information directly to users, which is a distinct problem of information disclosure.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Secure coding
Secure coding is the practice of writing software in a way that protects it from vulnerabilities and attacks by following security best practices throughout the development process.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.