SSCP Systems and Application Security Practice Question
A financial services company runs a customer-facing mobile banking API on Linux containers. A penetration test reveals that when the API receives an oversized JSON payload, the application returns a stack trace containing internal file paths and database connection strings. The developer wants to prevent this information disclosure without changing the API's core business logic. Which control should the security practitioner recommend FIRST?
⚠ Common exam trap
The trap here is assuming that a perimeter control such as a WAF or expanded logging eliminates the disclosure, when the flaw actually lives in how the application constructs its error responses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the application to return generic error messages and log detailed exceptions server-side only.
The core issue is an information disclosure vulnerability caused by improper error handling. Returning generic messages to clients while logging details internally removes the sensitive data from the response path and preserves troubleshooting capability. WAFs and logging are useful compensating or detective controls, but they do not eliminate the root cause, which is the application revealing internal implementation details.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a web application firewall in blocking mode with signatures for known stack trace patterns.
Why it's wrong here
A WAF can filter some responses, but relying on signature matching for stack traces is brittle and does not fix the root cause in the application. Attackers can craft payloads that bypass pattern-based filters, and the underlying code still leaks data if the WAF is misconfigured or bypassed. It is a compensating control, not the first corrective step for insecure error handling.
- ✓
Configure the application to return generic error messages and log detailed exceptions server-side only.
Why this is correct
Generic client-facing errors with detailed server-side logging prevent attackers from learning internal file paths and connection strings while preserving diagnostic data for developers. This directly addresses the information disclosure observed in the stack trace without altering business logic. It is a standard secure coding practice aligned with SSCP guidance on error handling and preventing sensitive data exposure in application responses.
- ✗
Increase the maximum allowed request body size in the API gateway to reject oversized payloads.
Why it's wrong here
Raising the body size limit makes the problem worse by allowing larger payloads to reach the application. Even lowering the limit would not address the underlying flaw, because the stack trace is triggered by how the application handles malformed or oversized input, not by the gateway's size threshold. The disclosure would persist for any payload that still triggers the exception.
- ✗
Enable full verbose logging in the API and ship logs to a centralized SIEM for alerting.
Why it's wrong here
Verbose logging improves detection but does not stop the application from returning sensitive details to the client. The stack trace is generated in the HTTP response, not just in logs, so the attacker still obtains internal paths and connection strings. Logging is a detective control and must be paired with a preventive fix such as generic error responses.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.