Unit 5: Securing Applications and Data
Cybersecurity · Unit 5 · Paper 1

Securing Applications and Data unit test

A test on this unit alone, marked as a percentage and a letter grade — for the test your class is actually sitting, rather than for May. Answer everything, then submit once: seeing the answer to question 3 before attempting question 4 makes the final percentage meaningless.

Paper 1Paper 2Paper 3
Each paper is built from this unit’s 46 terms and is the same for everyone, so a teacher can assign “Unit 5, Paper 1” and every student sits the identical test. Multiple choice is marked objectively; the written sections you mark yourself against the model answer and rubric.
Suggested time 33 min 30 points0/17 attempted
1

Mandatory access control (MAC)

2

Race condition

3

Why both are used together

4

Privilege creep

5

Data classification

6

Access review (recertification)

7

Public key infrastructure (PKI)

8

Digital signature

9

Cross-site request forgery (CSRF)

10

Asymmetric encryption

11

Key stretching

12

Directory traversal

Short answer 1. Define or explain: Insecure deserialization

3 pts

Short answer 2. Define or explain: Hardcoded secrets

3 pts

Short answer 3. Define or explain: Discretionary access control (DAC)

3 pts

Short answer 4. Define or explain: Data minimization

3 pts

Free response

6 pts

This course has no free-response prompt tagged to this unit, so one from elsewhere in the course is used. It is still worth writing — the skill transfers.

A small company stores customer passwords so that its help desk can read them back to callers who forget them. The database is encrypted at rest, and the decryption key is stored in a file on the same server. (a) Explain why storing passwords in a recoverable form is a design error, regardless of the encryption used. (b) Describe what the company should store instead, and explain the role of a salt. (c) Explain why encrypting the database provides little protection given where the key is stored. (d) The help desk still needs a way to assist users who forget passwords. Describe a secure alternative and explain why it does not require recovering the original password.