Home Memorise Flashcards Notes Master answers Past questions Multiple choice Mock exam Practice & marker

Master answers › Secure Software Architecture (Year 12)

Secure Software Architecture (Year 12)

Sample exam Q19 · Authentication and authorisation 4 marks

Topic: Authentication and authorisation. Source: NESA Sample Exam marking guidelines.

Question

An app is being developed for use in a school. It will allow teachers to upload and assign work, and track student homework. Students can download work and upload their completed responses for marking. Explain how authentication and authorisation could be applied to this app. (4 marks, max 75 words)

Marking criteria (NESA)

4: Explains how authentication AND authorisation could be applied. 3: Explains how authentication OR authorisation could be applied, OR outlines how both could be applied. 2: Outlines some features of authentication and/or authorisation. 1: Some relevant information.

Model answer (NESA sample answer / MG)

Authentication ensures that only staff and students with valid usernames and passwords, which should be encrypted in storage (eg using hashing), can access the app. Authorisation controls access to specific features of the app based on user roles or groups. Teachers may have permissions to upload, assign and track homework, while students can only download tasks and upload completed work. By organising users into specific roles or groups, the app restricts access to appropriate functionality, ensuring that each user can only perform actions relevant to their role or group.

Familiarisation Q11b · Cross-site scripting 2 marks

Topic: Cross-site scripting. Source: NESA Familiarisation exam marking guidelines.

Question (NESA did not publish the exact wording; this is reconstructed from the marking guideline)

[Question stem not available as text (it is on the interactive NESA familiarisation site). Task per the NESA mapping grid: explain ONE way to minimise the XSS vulnerability]

Marking criteria (NESA)

2: Explains ONE way to minimise the vulnerability. 1: Some relevant information.

Model answer (NESA sample answer / MG)

The website could check and change user input so that markup and script become plain text. This will still allow the page to display the information but will prevent it from executing script code.

Note: Note (MG): special characters such as < > and ( ) would be encoded to their HTML equivalent (%3C %3E and %28 %29).

Sample exam Q18a · Defensive data input handling 3 marks

Topic: Defensive data input handling. Source: NESA Sample Exam marking guidelines.

Question

An online site requires users to create accounts using a 'Create Profile' web form (username, password, first name, last name, mobile number, date of birth). Each username must: 1. be at least 8 characters long; 2. start with an uppercase letter; 3. have a lowercase letter as the second last character; 4. have a numeric last character. Valid example: NESA24a3. (a) Explain how defensive data input handling practices can be implemented for this website. (3 marks, max 75 words)

Marking criteria (NESA)

3: Explains how defensive data input handling practices can be implemented for the website. 2: Outlines some features of data input handling practices. 1: Some relevant information.

Model answer (NESA sample answer / MG)

Data sanitisation using client-side scripting can clean the data and remove dangerous input. Input validation on the client-side can check that entered data meets all of the requirements before getting processed by the server. Errors generated by data not meeting rules can be shown to the user.

Note: Add server-side validation too (client-side checks can be bypassed), and use parameterised queries; the MG sample only gives the client-side answer.

Sample exam Q18b · Developing secure code (Python input validation) 3 marks

Topic: Developing secure code (Python input validation). Source: NESA Sample Exam marking guidelines.

Question

(b) Write a function in Python that will check whether a username satisfies the rules (the four username rules in 18a). (3 marks)

Marking criteria (NESA)

3: Correct function in Python to check whether a username satisfies the rules. 2: Partially correct function. 1: Some understanding of the problem and Python.

Model answer (NESA sample answer / MG)

def validate_username(username):
     valid = True

     # length check
     if len(username) < 8:
          valid = False
     elif (not username[0].isupper()):
          valid = False
     elif (not username[-2].islower()):
          valid = False
     elif (not username[-1].isdigit()):
          valid = False

     return valid

Note: Remember to call the function in the main program after defining it, e.g. print(validate_username(input('Username: '))).

Familiarisation Q9b · Developing secure code (Python input validation) 3 marks

Topic: Developing secure code (Python input validation). Source: NESA Familiarisation exam marking guidelines.

Question (NESA did not publish the exact wording; this is reconstructed from the marking guideline)

[Question stem not available as text (it is on the interactive NESA familiarisation site). Task per the NESA mapping grid: a Python function that checks whether a username satisfies given rules (stem not available)]

Marking criteria (NESA)

3: Correct function in Python that checks whether a username satisfies the rules. 2: Partially correct function. 1: Some understanding of the problem and Python.

Model answer (NESA sample answer / MG)

def validateUsername(username):

      # Length check
      if len(username) > 8:
          return False

      # Alpha character only check
      elif username.isalpha() == False:
          return False

      # < character check
      elif "<" in username:
          return False

      # If we reach here then the username meets the requirements
      return True

Note: Answers may include print statements to test the code, e.g. print(validateUsername("test")). The rules implied by the sample: no more than 8 characters, letters only, no '<'.

2025 HSC Q19 · Developing secure code (Python) 3 marks

Topic: Developing secure code (Python). Source: NESA 2025 HSC exam marking guidelines.

Question

In an organisation, temporary passwords are automatically generated for new user accounts. Each password is created from the first three letters of the username followed by '123'. For example, the username 'NESA' will have the password 'NES123'. When a user logs in for the first time, they are asked for their username and password. They receive a welcome message or an error message, depending on whether the password entered follows the rules of new user accounts. Write a Python program that asks a new user for their username and password, and then checks whether the password rule has been followed. (3 marks)

Marking criteria (NESA)

3: Correct code for the problem. 2: Partially correct code that includes a correct selection structure OR password creation. 1: Some understanding of the scenario and Python.

Model answer (NESA sample answer / MG)

uName = input('What is your username?')
password = input('What is your password?')
passwordP1 = uName[:3]
passwordP1= passwordP1 + '123'
if passwordP1 == password:
      print ('Welcome!')
else:
      print ('Incorrect password entered')

Note: Marker feedback: process string inputs; use a selection structure; code must execute in the environment; use correct indentation; call functions in the main program after defining them.

2025 HSC Q16c · Privacy by design 3 marks

Topic: Privacy by design. Source: NESA 2025 HSC exam marking guidelines.

Question

(c) Describe ONE way that the 'privacy by design' approach could be implemented in this weather app. (3 marks)

Marking criteria (NESA)

3: Describes ONE way privacy by design could be implemented in the weather app. 2: Outlines ONE feature of privacy by design. 1: Identifies a feature of privacy by design.

Model answer (NESA sample answer / MG)

Embedded within the design of the weather app would be a process for regularly deleting identifiable data. For example, the app would likely record a person's live location to deliver relevant weather details. The privacy by design approach would incorporate a regular process to delete these locations from cache.

Note: Marker feedback: understand privacy by design (proactive not reactive; embed privacy into design; respect for user privacy) rather than generalising about privacy techniques; link to the scenario, e.g. live location data.

Sample exam Q22b · Race conditions 3 marks

Topic: Race conditions. Source: NESA Sample Exam marking guidelines.

Question

Race conditions have been identified as a potential issue for this database. Provide an example of when a race condition may occur in this scenario and outline how secure code could be implemented to prevent it. (3 marks, max 75 words)

Marking criteria (NESA)

3: Provides an example of when a race condition may occur AND outlines how secure code could prevent it. 2: Outlines some features of race conditions. 1: Some relevant information.

Model answer (NESA sample answer / MG)

With multiple teachers potentially accessing the database at the same time, race conditions can allow malicious users to gain unauthorised access. Authentication could be used to restrict access to the database, and code can be written to use atomic transactions and database locks to time the reading and writing of data.

Note: A clearer example for this scenario: two teachers update the same student's Attended count at once; both read 4, both write 5, so one update is lost. Fix: atomic transactions / row locks so the read-modify-write cannot be interleaved. (Reasoned example, not from the MG.)

2025 HSC Q10 · Regulatory compliance 1 marks

Topic: Regulatory compliance. Source: NESA 2025 HSC exam marking guidelines.

Question

Identify ALL the items that are the goals of regulatory compliance in relation to software development. Options: Limiting the need for software updates; Protecting sensitive data from unauthorised access; Allowing developers to bypass security features when needed; Reducing the testing time required during software development; Ensuring software applications meet legal and industry standards.

Marking criteria (NESA)

1: Identifies ALL the items that are the goals of regulatory compliance.

Model answer (NESA sample answer / MG)

Protecting sensitive data from unauthorised access; Ensuring software applications meet legal and industry standards.

Sample exam Q8 · SAST and DAST 2 marks

Topic: SAST and DAST. Source: NESA Sample Exam marking guidelines.

Question

The strategies below can be used to test the security of a web application that contains a database. Classify each as EITHER SAST OR DAST: (1) Simulate attacks on the web application; (2) Check the way SQL queries are constructed; (3) Test the database's web interface for vulnerabilities; (4) Test the web application used to interact with the database when it is running; (5) Analyse the code for connecting to the database to identify security vulnerabilities.

Marking criteria (NESA)

2: Correctly classifies all the strategies. 1: Correctly classifies THREE strategies, which must include ONE SAST and ONE DAST.

Model answer (REASONED, not copied: the official answer was an image)

SAST: (2) and (5). DAST: (1), (3) and (4).

Note: REASONED (not copied): the MG answer is an image/table that could not be extracted. SAST = static, analyses code without running it; DAST = dynamic, tests the running application (simulated attacks, probing interfaces).

Familiarisation Q6 · Sandboxing 3 marks

Topic: Sandboxing. Source: NESA Familiarisation exam marking guidelines.

Question (NESA did not publish the exact wording; this is reconstructed from the marking guideline)

[Question stem not available as text (it is on the interactive NESA familiarisation site). Task per the NESA mapping grid: a discussion of the use of sandboxing in the operating system]

Marking criteria (NESA)

3: Thorough discussion of the use of sandboxing in the operating system. 2: Some understanding of the advantages and/or disadvantages. 1: Identifies a feature of sandboxing.

Model answer (NESA sample answer / MG)

Sandboxing allows each application to be isolated so that it cannot pose a security risk by accessing system resources or other applications. However, it requires more resources as each application requires its own container. It may also be less convenient for users to access resources such as the device's camera or files as the sandbox will either prevent access or make it more difficult.

Note: Answers could include: sandboxing limits the resource use of different processes running on the device, ensuring that if a process contains bad code, such as a memory leak, it does not consume all the resources of the operating system.

sdd2023-q23 · Security and authentication 5 marks

Topic: Security and authentication. Source: NESA old SDD HSC marking guidelines (OLD SYLLABUS). OLD SYLLABUS item: use for the technique, not the content.

Question

An online medical database stores the medical history of patients. It is updated each time a person seeks medical treatment. (a) | Give TWO reasons why security is important for this database. | 2 (b) | To provide increased security for the database, two-step authentication is | 3 implemented which requires a user to: • provide a valid username and password • enter an automatically generated six-digit verification code which is sent to their mobile phone. Complete the system flowchart for this two-step authentication process. UserID and password

Marking criteria (NESA)

[Question 23 (a)] Criteria | Marks • Provides TWO reasons for the importance of security of this database | 2 • Demonstrates some understanding of the importance of data security | 1 Criteria | Marks • Provides a substantially correct system flowchart for the authentication process, using appropriate symbols • Provides a partially correct system flowchart | 2 • Provides a diagram that shows some understanding of the process | 1

Model answer (NESA sample answer / MG)

Sample answer: Unintentional/malicious changes to the data may cause harm to the patients. Privacy of the patient may be compromised if the data is made public.

[Question 23 (b)] Sample answer:

Note: Old-syllabus question. Diagrams, tables and flowcharts in the paper and MG are images and were lost in text extraction, so some parts are incomplete. Use for practice on the overlapping skill only. The new Software Engineering exam does not use the old SDD terms (e.g. CASE tools, system flowcharts, EBNF, assembly).

2025 HSC Q20 · Session management 3 marks

Topic: Session management. Source: NESA 2025 HSC exam marking guidelines.

Question

Describe how session management can affect the efficiency of code execution for the user. (3 marks)

Marking criteria (NESA)

3: Describes how session management can affect code execution efficiency. 2: Identifies some features of session management. 1: Some relevant information.

Model answer (NESA sample answer / MG)

Efficient session management limits memory consumption by restricting session data size and lifetime. Excessive reading, writing or storing large objects increases input/output operations and slows code execution for the user. Removing sessions when they are no longer required is essential to prevent unnecessary resource consumption.

Answers could include ['Reducing database and network bottlenecks', 'Preventing memory leaks', 'Enabling scalable, responsive systems (asynchronous or lazy cleanup)']

Note: Answers could include: reducing database and network bottlenecks (frequent access to session stores, especially distributed, causes latency); preventing memory leaks (poor server-side session handling triggers more garbage collection and degrades performance); enabling scalable, responsive systems (asynchronous or lazy cleanup). Marker feedback: DESCRIBE features rather than just identifying them; relate to code efficiency AND user experience.

2025 HSC Q23a · Social and ethical issues 3 marks

Topic: Social and ethical issues. Source: NESA 2025 HSC exam marking guidelines.

Question

A food delivery service offers prepackaged meals tailored to different dietary preferences, for example, vegetarian and gluten-free. It has developed a website for customers to place orders. The website is ready for testing and feedback. The website includes: a menu that dynamically updates based on meal availability; user accounts where customers can track deliveries and manage subscriptions; a backend that processes orders and payments, updates stock and communicates with the delivery team. (a) Outline potential social and ethical issues associated with the use of this website. (3 marks)

Marking criteria (NESA)

3: Outlines relevant social and ethical issues. 2: Outlines ONE social or ethical issue OR identifies relevant issues. 1: Identifies ONE relevant issue.

Model answer (NESA sample answer / MG)

The website will need to ensure payment and address data is appropriately secured and accessible only to authorised personnel. It also needs to ensure that pages can be viewed in a wide variety of languages and that the information about dishes displayed is accurate and representative of the product.

Note: Marker feedback: outline MULTIPLE issues; draw on the stimulus.

sdd2021-q25 · Implementation and development approach 11 marks

Topic: Implementation and development approach. Source: NESA old SDD HSC marking guidelines (OLD SYLLABUS). OLD SYLLABUS item: use for the technique, not the content.

Question

A mobile phone app is to be developed to allow two people speaking different languages to have a conversation. The app translates the speaker’s language into the language of the listener. (a) | Describe ONE social or ethical issue associated with this app. | 2 (b) | Outline an appropriate method of installation for this app. | 2 (c) | Justify an appropriate software development approach for this app. | 3 (d) | Describe ONE compatibility issue and ONE performance issue relevant to this | 4 app.

Marking criteria (NESA)

[Question 25 (a)] Criteria | Marks • Describes ONE relevant social or ethical issue | 2 • Demonstrates a basic understanding of a social or ethical issue | 1 Criteria | Marks • Outlines an appropriate installation method relevant to this app | 2 • Identifies an installation method | 1 Criteria | Marks • Justifies an appropriate software development approach for this app | 3 • Describes a software development approach | 2 • Demonstrates a basic understanding of software development | 1 Criteria | Marks • Describes ONE performance issue and ONE compatibility issue relevant to this app • Outlines ONE performance issue and ONE compatibility issue relevant to this app • Outlines a performance or compatibility issue OR | 2 • Identifies performance and/or compatibility issues • Provides some relevant information | 1

Model answer (NESA sample answer / MG)

Sample answer: Privacy As the conversations are transmitted and possibly stored for processing, concerns may arise regarding the security of private conversations.

[Question 25 (b)] Sample answer: Direct cutover: each individual gets the complete system as soon as they purchase the application.

[Question 25 (c)] Sample answer: Agile This approach enables the development of this application relatively quickly in a possibly competitive environment. The agile approach means the system can be offered initially with two or three languages and limited functionality, but with updates offered after a short period of time to progressively include more languages and more features in response to feedback.

[Question 25 (d)] Sample answer: Compatibility: The application must execute consistently between different mobile phones, operating systems and networks. This means that the system must be tested using a wide range of environments. Performance: Processing times must allow normal conversations to proceed without delays. Some language translations do not lend themselves to word for word conversions, meaning longer processing times are required. The application must load quickly to minimise frustration.

sdd2022-q21 · Social, ethical and legal responsibilities 3 marks

Topic: Social, ethical and legal responsibilities. Source: NESA old SDD HSC marking guidelines (OLD SYLLABUS). OLD SYLLABUS item: use for the technique, not the content.

Question

Describe TWO responsibilities of software developers when developing new systems. | 3

Marking criteria (NESA)

[Question 21] Criteria | Marks • Describes TWO responsibilities of software developers | 3 • Describes ONE responsibility of software developers OR | 2 • Outlines TWO responsibilities • Demonstrates some understanding of software developers’ responsibilities

Model answer (NESA sample answer / MG)

Sample answer: Intellectual property – appropriate acknowledgement of intellectual property means that a developer cannot use copied code fragments without first contacting the author, asking their permission and acknowledging the authorship visibly in their product. Response to user issues – a developer should respond appropriately and promptly, possibly by amending code.