Security & Error Handling Flashcards

What is the purpose of using checked vs unchecked exceptions in Java?

Answer: Checked exceptions must be declared or caught, representing recoverable conditions; unchecked exceptions represent programming errors

Checked exceptions (e.g., IOException) signal conditions callers should handle; unchecked (RuntimeException) signal bugs that should be fixed.

What is a buffer overflow vulnerability?

Answer: Writing more data into a buffer than it can hold, overwriting adjacent memory and potentially allowing code execution

Buffer overflows in C/C++ allow attackers to overwrite return addresses or function pointers, leading to arbitrary code execution.

What is exception chaining (wrapping)?

Answer: Catching an exception and re-throwing it wrapped in a new exception to preserve the original cause

Exception chaining preserves the root cause by embedding the original exception as the 'cause' of a new higher-level exception.

What is the difference between authentication and authorization?

Answer: Authentication verifies who you are; authorization determines what you are allowed to do

Authentication confirms identity (login with credentials); authorization checks permissions (can this user access this resource?).

What is a cryptographic hash function used for in software security?

Answer: Generating a fixed-size digest of data that cannot be reversed, used for integrity checking and password storage

Cryptographic hash functions like SHA-256 produce irreversible digests, making them suitable for password hashing and data integrity verification.

What is secure coding practice regarding sensitive data in logs?

Answer: Never log passwords, tokens, credit card numbers, or PII; mask or omit sensitive fields

Logging sensitive data creates a secondary attack surface; if logs are exfiltrated, attackers gain credentials or personal information.