Securing Applications and Data unit test
A test on this unit alone, marked as a percentage and a letter grade — for the test your class is actually sitting, rather than for May. Answer everything, then submit once: seeing the answer to question 3 before attempting question 4 makes the final percentage meaningless.
Attribute-based access control (ABAC)
Data loss prevention (DLP)
Personally identifiable information
Public key infrastructure (PKI)
End-to-end encryption
Data at rest, in transit, in use
Digital signature
Rainbow table
Why backups must be tested and offline
Privilege creep
Hashing
Key stretching
Short answer 1. Define or explain: Code review and static analysis
3 ptsShort answer 2. Define or explain: Insecure deserialization
3 ptsShort answer 3. Define or explain: Why both are used together
3 ptsShort answer 4. Define or explain: Account lifecycle
3 ptsFree response
6 ptsThis course has no free-response prompt tagged to this unit, so one from elsewhere in the course is used. It is still worth writing — the skill transfers.
A hospital is deciding how to protect a system that stores patient records. (a) Define the confidentiality, integrity, and availability triad, and for each element give a concrete failure that would matter in this specific setting. (b) Ransomware encrypts the records and demands payment. Identify which element of the triad is most directly attacked and justify your choice. (c) Explain why a backup strategy must include restoration testing and at least one offline or immutable copy. (d) The hospital proposes requiring a second staff member to approve any bulk export of records. Name the principle this implements and explain what class of threat it addresses that technical access controls do not.