TK Study
HomeMemoriseFlashcardsNotesMaster answersPast questionsMultiple choiceMock examPractice & marker

Software Engineering › Flashcards › Secure Software Architecture (Year 12)

Secure Software Architecture (Year 12)

57 flashcards (Year 12). Study these as flip cards Random

Benefits and the development steps

Secure software Term

Software designed and built to protect data and resist attack, with security considered at every development step; benefits are data protection and fewer cyber attacks and vulnerabilities.

Example: 'Secure software protects customer data and builds trust in the product.'

Where you would use it in the test
  • Short answer: Describe the benefits of developing secure software
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.

Related past questions: 2023 Software Design and Development HSC Q23 (5 marks): Security and authentication

Memorise: Fundamental software development steps for secure code

Data protection Term

Keeping data safe from unauthorised access, change or loss using measures such as encryption, access control and backups.

Example: 'Encrypt stored card numbers to protect data.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Related past questions: 2025 HSC Q10 (1 mark): Regulatory compliance

Memorise: Fundamental software development steps for secure code

Cyber attack Term

A deliberate attempt to steal, damage or disrupt data or systems (for example phishing, malware, SQL injection, denial of service).

Example: 'Validation reduces the risk of injection attacks.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Memorise: Fundamental software development steps for secure code

Vulnerability Term

A weakness in software, hardware or process that an attacker could exploit.

Example: 'An unpatched library is a vulnerability.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: Sample exam Q8 (2 marks): SAST and DAST; 2025 HSC Q13 (2 marks): SAST and DAST

Memorise: Fundamental software development steps for secure code

Capabilities and experience of end users Term

Users' skills and experience shape secure design: less experienced users need simple, guided and forgiving interfaces (clear prompts, default safe settings), while experts can use advanced options.

Example: 'Novice users need clear warnings before deleting data.'

Where you would use it in the test
  • Short answer: Describe how user experience influences secure design features
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Memorise: Fundamental software development steps for secure code

Security concepts (CIA and more)

Confidentiality Term

Only authorised people can read the data; achieved with encryption and access controls.

Example: 'Encrypting medical records keeps them confidential.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Matching or table: Match each concept to an example (2025 Q23c)
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: 2025 HSC Q23c (3 marks): Fundamental software design security concepts

Memorise: Fundamental software design security concepts (six words)

Integrity Term

Data stays accurate and unchanged unless an authorised change is made; supported by hashes, validation and checksums.

Example: 'A hash value shows a file has not been altered.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Matching or table: Matching or table question: match it to its description, example or category.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: 2025 HSC Q23c (3 marks): Fundamental software design security concepts

Memorise: Fundamental software design security concepts (six words)

Availability Term

Authorised users can access the data and system when needed; supported by backups, redundancy and protection against denial of service.

Example: 'A backup server keeps the site available if the main one fails.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Matching or table: Matching or table question: match it to its description, example or category.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: 2025 HSC Q23c (3 marks): Fundamental software design security concepts

Memorise: Fundamental software design security concepts (six words)

Authentication Term

Proving that a user, device or system is who it claims to be (passwords, multi-factor, certificates).

Example: 'Login with a password and a one-time code is authentication.'

Where you would use it in the test
  • Multiple choice: 2025 Q6: 'Ensuring that parties exchanging information are who they claim to be'
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.
  • Matching or table: Matching or table question: match it to its description, example or category.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Related past questions: 2025 HSC Q6 (1 mark): Web protocols; 2025 HSC Q23c (3 marks): Fundamental software design security concepts; Sample exam Q19 (4 marks): Authentication and authorisation

Memorise: Fundamental software design security concepts (six words)

Authorisation Term

Deciding what an authenticated user is allowed to access or do (roles and permissions).

Example: 'A student can view marks but only a teacher can edit them.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Matching or table: Matching or table question: match it to its description, example or category.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Related past questions: Sample exam Q19 (4 marks): Authentication and authorisation; 2025 HSC Q23c (3 marks): Fundamental software design security concepts

Memorise: Fundamental software design security concepts (six words)

Accountability Term

Being able to trace actions to a user or system through logs and audit trails, so people answer for what they did.

Example: 'An audit log records who changed a record.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Matching or table: Matching or table question: match it to its description, example or category.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: 2025 HSC Q23c (3 marks): Fundamental software design security concepts

Memorise: Fundamental software design security concepts (six words)

Privacy Term

The right of people to control how their personal information is collected, used and shared.

Example: 'Collect only the data needed.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Related past questions: 2025 HSC Q16c (3 marks): Privacy by design

Memorise: Fundamental software design security concepts (six words)

Regulatory compliance Term

Meeting the laws, regulations and industry standards that apply to software and data (for example Privacy Act or GDPR). Goals include protecting sensitive data and meeting legal and industry standards.

Example: Correct 2025 Q10 ticks: protecting sensitive data; meeting legal and industry standards.

Where you would use it in the test
  • Multi-select: 2025 Q10: pick ALL the goals of regulatory compliance
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.

Related past questions: 2025 HSC Q10 (1 mark): Regulatory compliance

Memorise: Fundamental software design security concepts (six words)

Security by design and privacy by design

Security by design Term

Building security into the software from the start of development rather than adding it at the end.

Example: 'Security by design uses cryptography and sandboxing from the first design step.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Explain the contribution of cryptography and sandboxing
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Related past questions: Familiarisation Q6 (3 marks): Sandboxing; Sample exam Q3 (1 mark): Encryption

Memorise: Cryptography and sandboxing in 'security by design'

Cryptography Term

Converting readable data (plain text) into unreadable cipher text with an algorithm and key so only the holder of the right key can read it; also supports hashing and digital signatures.

Example: 'Encryption keeps the data confidential.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Related past questions: Sample exam Q3 (1 mark): Encryption

Memorise: Cryptography and sandboxing in 'security by design'

Sandboxing Term

Running code in an isolated, restricted environment so that if it is malicious or faulty it cannot affect the rest of the system.

Example: 'A browser tab runs in a sandbox so a bad page cannot read your files.'

Where you would use it in the test
  • Short answer: Discuss sandboxing (familiarisation Q6)
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: Familiarisation Q6 (3 marks): Sandboxing

Memorise: Cryptography and sandboxing in 'security by design'

Privacy by design Term

An approach that builds privacy into software from the start: proactive not reactive, embed privacy into the design, and respect user privacy.

Example: 2025 Q16c marker note: link it to the scenario, e.g. only collect live location while the app is in use, rather than listing general privacy techniques.

Where you would use it in the test
  • Short answer: Describe how the app could implement privacy by design (2025 Q16c)
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: 2025 HSC Q16c (3 marks): Privacy by design

Memorise: Cryptography and sandboxing in 'security by design'

Proactive not reactive Term

A privacy by design principle: anticipate and prevent privacy problems before they happen instead of fixing them after a breach.

Example: 'Run a privacy impact check during design.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Related past questions: 2025 HSC Q16c (3 marks): Privacy by design

Memorise: Cryptography and sandboxing in 'security by design'

Embed privacy into design Term

A privacy by design principle: privacy is part of the core system design (default settings, data minimisation, encryption), not an add-on.

Example: 'Privacy settings are on by default.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Related past questions: 2025 HSC Q16c (3 marks): Privacy by design

Memorise: Cryptography and sandboxing in 'security by design'

Respect for user privacy Term

A privacy by design principle: keep the user central with clear consent, easy control of their data and transparency.

Example: 'Ask for permission before using location.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Related past questions: 2025 HSC Q16c (3 marks): Privacy by design

Memorise: Cryptography and sandboxing in 'security by design'

Testing security and resilience

Determining vulnerabilities Term

Finding weaknesses before attackers do, using code review, SAST, DAST, vulnerability assessment and penetration testing.

Example: 'Run a vulnerability assessment before release.'

Where you would use it in the test
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Memorise: Test and evaluate security and resilience

Hardening systems Term

Reducing the attack surface by removing unused services and default accounts, applying patches and using strong configuration and least privilege.

Example: 'Disable unused ports.'

Where you would use it in the test
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Memorise: Test and evaluate security and resilience

Handling breaches Term

Responding to a security incident: detect, contain, investigate, notify those affected, fix the cause and review.

Example: 'Notify users and reset passwords after a breach.'

Where you would use it in the test
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.

Memorise: Test and evaluate security and resilience

Business continuity Term

Plans that keep critical operations running during and after a disruption (backup systems, alternative procedures).

Example: 'Switch to a backup server so orders continue.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Memorise: Test and evaluate security and resilience

Disaster recovery Term

Plans to restore IT systems and data after a major incident, guided by how quickly and how fully they must be recovered.

Example: 'Restore from the off-site backup.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Memorise: Test and evaluate security and resilience

Code review Term

Other developers read the source code to find errors, security flaws and poor practice before release.

Example: 'Peer review spots missing input validation.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Matching or table: Matching or table question: match it to its description, example or category.

Related past questions: Sample exam Q4 (1 mark): Collaboration

Memorise: Test and evaluate security and resilience

Static application security testing (SAST) Term

Analysing the source code without running it to find security flaws early in development; a white box method.

Example: SAST = code NOT running, source visible, early. DAST = program running, from outside, finds runtime flaws.

Where you would use it in the test

Related past questions: 2025 HSC Q13 (2 marks): SAST and DAST; Sample exam Q8 (2 marks): SAST and DAST

Memorise: Test and evaluate security and resilience

Dynamic application security testing (DAST) Term

Testing the running application from the outside by sending it unexpected input to find vulnerabilities, without needing the source code; a black box method.

Example: DAST: tests while running; finds issues like XSS or broken authentication.

Where you would use it in the test
  • Matching or table: 2025 Q13 table and sample Q8
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Related past questions: 2025 HSC Q13 (2 marks): SAST and DAST; Sample exam Q8 (2 marks): SAST and DAST

Memorise: Test and evaluate security and resilience

Vulnerability assessment Term

A systematic scan and review that identifies, ranks and reports known weaknesses in a system.

Example: 'A scanner lists out-of-date components.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Matching or table: Matching or table question: match it to its description, example or category.

Memorise: Test and evaluate security and resilience

Penetration testing Term

Authorised, simulated attacks on a system by testers to see whether weaknesses can really be exploited.

Example: 'An ethical hacker tries to break into the login.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Matching or table: Matching or table question: match it to its description, example or category.

Memorise: Test and evaluate security and resilience

Defensive coding

Defensive data input handling Term

Writing code that assumes input may be wrong or hostile and handles it safely using input validation, sanitisation and error handling.

Example: 'Reject non-numeric age, then ask again.'

Where you would use it in the test
  • Short answer: Explain defensive data input handling (sample Q18a)
  • Python: Write an input validation function
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.

Related past questions: Sample exam Q18a (3 marks): Defensive data input handling; Sample exam Q18b (3 marks): Developing secure code (Python input validation); Familiarisation Q9b (3 marks): Developing secure code (Python input validation); 2025 HSC Q19 (3 marks): Developing secure code (Python)

Memorise: Defensive data input handling: validation, sanitisation, error handling

Input validation Term

Checking that input meets rules (type, range, length, format, presence) before it is used.

Example: 'if not age.isdigit(): reject'

Where you would use it in the test
  • Python: Python validation function
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: Sample exam Q18b (3 marks): Developing secure code (Python input validation); Familiarisation Q9b (3 marks): Developing secure code (Python input validation); 2025 HSC Q19 (3 marks): Developing secure code (Python)

Memorise: Defensive data input handling: validation, sanitisation, error handling

Sanitisation Term

Cleaning input by removing or escaping dangerous characters so it cannot be run as code (for example HTML or SQL).

Example: 'Escape < and > so a script tag is displayed as text, not run.'

Where you would use it in the test
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: Sample exam Q18a (3 marks): Defensive data input handling

Memorise: Defensive data input handling: validation, sanitisation, error handling

Error handling Term

Detecting and managing problems (try and except in Python) so the program fails safely, shows a generic message and does not leak internal details.

Example: 'try: int(x) except ValueError: print("Enter a number")'

Where you would use it in the test
  • Python: try / except
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.

Related past questions: 2025 HSC Q19 (3 marks): Developing secure code (Python); Sample exam Q18b (3 marks): Developing secure code (Python input validation)

Memorise: Defensive data input handling: validation, sanitisation, error handling

Application programming interface (API) Term

A set of rules that lets one program request services or data from another, often over HTTP using JSON. A safe API validates input, authenticates callers, limits data returned and uses HTTPS.

Example: 'Return only the fields the client needs.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Related past questions: 2025 HSC Q5 (1 mark): API vulnerabilities

Memorise: Defensive data input handling: validation, sanitisation, error handling

Excessive data exposure Term

An API weakness where more data than intended is returned (the whole database row instead of the needed fields).

Example: 'Send name only, not the password hash.'

Where you would use it in the test
  • Multiple choice: 2025 Q5 answer: Exposure of more data than intended
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Related past questions: 2025 HSC Q5 (1 mark): API vulnerabilities

Memorise: Defensive data input handling: validation, sanitisation, error handling

Memory management Term

Allocating and freeing memory efficiently so programs do not leak memory, crash or become slow.

Example: 'Release resources when finished.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Memorise: Defensive data input handling: validation, sanitisation, error handling

Session management Term

Creating, tracking and ending a user's session securely (session ID or token, timeouts, logout), which supports both security and a smooth user experience.

Example: 2025 Q20 marker note: relate session management to code efficiency and to user experience; describe, don't just identify.

Where you would use it in the test
  • Short answer: Describe session management and efficiency (2025 Q20)
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.

Related past questions: 2025 HSC Q20 (3 marks): Session management

Memorise: Defensive data input handling: validation, sanitisation, error handling

Exception management Term

Handling runtime exceptions (try and except) so a failure is caught, logged and recovered from instead of crashing the program.

Example: 'Catch FileNotFoundError and show a message.'

Where you would use it in the test
  • Python: Python question: write or complete it in the online Python tool.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.

Memorise: Defensive data input handling: validation, sanitisation, error handling

Attacks on user actions, files and hardware

Broken authentication and session management Term

Weaknesses in login or session handling (weak passwords, guessable or reused session IDs, no timeout) that let attackers act as another user.

Example: 'Use long random session IDs and timeouts.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: 2025 HSC Q8 (1 mark): User action controls

Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions

Cross-site scripting (XSS) Term

An attack that injects malicious script into a web page that other users then run in their browser. Prevent it by sanitising and escaping output.

Example: 'Escape user comments so scripts cannot run.'

Where you would use it in the test

Related past questions: Familiarisation Q11a (1 mark): Cross-site scripting; Familiarisation Q11b (2 marks): Cross-site scripting

Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions

Cross-site request forgery (CSRF) Term

An attack that tricks a logged-in user's browser into sending an unwanted request to a site that trusts them. Prevent it with anti-CSRF tokens.

Example: 'A hidden form submits a bank transfer.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: 2025 HSC Q8 (1 mark): User action controls

Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions

Invalid forwarding and redirecting Term

An attack that sends users to an untrusted site because the destination in a redirect or forward is taken from unvalidated input. Prevent it by validating or whitelisting destinations.

Example: 'Only redirect to pages on your own site.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Related past questions: 2025 HSC Q8 (1 mark): User action controls

Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions

Race condition Term

A fault where the outcome depends on the timing of two or more processes using the same data, so results are unpredictable (for example two users buying the last ticket).

Example: 'Two withdrawals read the same balance at once.' Prevent with locking.

Where you would use it in the test

Related past questions: 2025 HSC Q8 (1 mark): User action controls; Sample exam Q22b (3 marks): Race conditions

Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions

File attacks Term

Attacks that abuse file handling, such as malicious uploads, path traversal (../) or tampering with stored files. Protect by validating file type and size, storing outside the web root and using permissions.

Example: 'Reject uploaded .exe files.'

Where you would use it in the test
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.

Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions

Side channel attack Term

An attack that learns secrets from indirect information such as timing, power use or electromagnetic emissions rather than breaking the algorithm. Protect with constant-time code, noise and physical shielding.

Example: 'Measuring response time to guess a password character.'

Where you would use it in the test
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions

Benefits of collaboration (secure development) Term

Considering various points of view, delegating tasks by expertise and improving the quality of the solution.

Example: 'A security specialist reviews the login code.'

Where you would use it in the test
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.

Memorise: Describe the benefits of developing secure software

Benefits to an enterprise of secure development Term

Improved products or services, influence on future software development, improved work practices, productivity and business interactivity.

Example: 'Secure practices reduce rework, so productivity rises.'

Where you would use it in the test
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Memorise: Describe the benefits of developing secure software

Employment (impact) Term

How software changes jobs: roles removed or created and new skills needed.

Example: 'Automation removes data entry jobs but creates support roles.'

Where you would use it in the test
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Related past questions: 2025 HSC Q24 (5 marks): Safety of workers (impact of automation)

Memorise: Describe the benefits of developing secure software

Intellectual property Term

Creations of the mind (code, designs, brands) that are legally owned and protected by the creator.

Example: 'Protect the app's source code as IP.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Related past questions: 2022 Software Design and Development HSC Q21 (3 marks): Social, ethical and legal responsibilities

Memorise: Describe the benefits of developing secure software

Digital disruption Term

Change caused when new technology transforms how an industry or society works, often overturning existing businesses.

Example: 'Ride-sharing apps disrupted taxis.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Memorise: Describe the benefits of developing secure software

Programmed backup Term

Automatic scheduled copies of data (ideally off-site or in the cloud) supporting integrity and availability and reducing human error.

Example: 'A nightly automatic backup to the cloud.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Fill in the blanks: Fill in the blanks or dropdown: choose this term to complete a statement or table.

Memorise: Describe the benefits of developing secure software

Software development steps for secure code (order) Process

Requirements definition, determining specifications, design, development, integration, testing and debugging, installation and maintenance, with security considered at each step.

Example: 'Security is considered in requirements, then design, then testing.'

Where you would use it in the test
  • Drag into order: Drag into order (familiarisation Q1)
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.

Related past questions: Familiarisation Q1 (1 mark): Development steps; Sample exam Q1 (1 mark): Software development steps

Memorise: Describe the benefits of developing secure software

SQL injection Term

An attack where malicious SQL is inserted through input so it runs on the database; stopped by parameterised queries and validation.

Example: "' OR 1=1 --" typed into a login box.

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Code reading: Code or algorithm reading: interpret a fragment and state its output or purpose.

Related past questions: Sample exam Q18a (3 marks): Defensive data input handling

Memorise: Describe the benefits of developing secure software

Check this one: The course specification names XSS and defensive input handling; SQL injection is the standard example the school notes use.

General Data Protection Regulation (GDPR) Term

The European Union law on collecting and protecting personal data; it applies to any organisation handling EU residents' data.

Example: 'An Australian site with EU customers must follow GDPR.'

Where you would use it in the test
  • Multiple choice: Multiple choice: pick the option that matches the definition or example.
  • Short answer: Short answer (2 to 4 marks): define, outline or explain it and tie it to the scenario.
  • Extended response: Extended response (5 to 8 marks): use it as a supporting point linked to the stimulus.

Related past questions: 2025 HSC Q10 (1 mark): Regulatory compliance

Memorise: Describe the benefits of developing secure software

Check this one: The syllabus says regulatory compliance without naming laws; GDPR comes from the school notes.

← Programming Mechatronics (Year 11)Programming for the Web (Year 12) →