CyberCertPrepWeb App FundamentalsHTTP & Web BasicsEASYFree question
A security scan identifies that a web server returns detailed stack traces in HTTP 500 error responses visible to clients. Why is this a security problem?
- A.Stack traces expose internal code paths, framework versions, file paths, and variable names that attackers use to identify vulnerabilities and craft targeted exploits
- B.Stack traces slow down the browser's rendering engine
- C.Stack traces are too long and violate HTTP header size limits
- D.Stack traces only matter for compliance reasons, not active exploits
Why A is correct
Detailed error pages (stack traces, SQL error messages, framework debug output) are a form of information disclosure. Attackers learn the exact framework version (for known CVEs), file system paths (for path traversal attempts), database schema (for SQL injection), and internal IP addresses. Production applications must return generic error messages to clients and log detailed errors server-side only.
Know someone studying for Web App Fundamentals? Send them this one.