Past questions: Secure Software Architecture (Year 12)

1: Identifies the correct answer.

Exposure of more data than intended

1: Identifies the correct answer.

Race conditions

1: Identifies ALL the items that are the goals of regulatory compliance.

Protecting sensitive data from unauthorised access; Ensuring software applications meet legal and industry standards.

2: Correctly identifies the timing and source code access for each strategy. 1: Correct for ONE strategy, OR correct timing for each strategy.

3: Describes ONE way privacy by design could be implemented in the weather app. 2: Outlines ONE feature of privacy by design. 1: Identifies a feature of privacy by design.

Embedded within the design of the weather app would be a process for regularly deleting identifiable data. For example, the app would likely record a person's live location to deliver relevant weather details. The privacy by design approach would incorporate a regular process to delete these locations from cache.

3: Correct code for the problem. 2: Partially correct code that includes a correct selection structure OR password creation. 1: Some understanding of the scenario and Python.

uName = input('What is your username?') password = input('What is your password?') passwordP1 = uName[:3] passwordP1= passwordP1 + '123' if passwordP1 == password: print ('Welcome!') else: print ('Incorrect password entered')

3: Describes how session management can affect code execution efficiency. 2: Identifies some features of session management. 1: Some relevant information.

Efficient session management limits memory consumption by restricting session data size and lifetime. Excessive reading, writing or storing large objects increases input/output operations and slows code execution for the user. Removing sessions when they are no longer required is essential to prevent unnecessary resource consumption.

3: Outlines relevant social and ethical issues. 2: Outlines ONE social or ethical issue OR identifies relevant issues. 1: Identifies ONE relevant issue.

The website will need to ensure payment and address data is appropriately secured and accessible only to authorised personnel. It also needs to ensure that pages can be viewed in a wide variety of languages and that the information about dishes displayed is accurate and representative of the product.

3: ALL items correct. 2: THREE items correct. 1: ONE item correct.

1: Identifies the correct answer.

Implement data encryption

2: Correctly classifies all the strategies. 1: Correctly classifies THREE strategies, which must include ONE SAST and ONE DAST.

SAST: (2) and (5). DAST: (1), (3) and (4).

3: Explains how defensive data input handling practices can be implemented for the website. 2: Outlines some features of data input handling practices. 1: Some relevant information.

Data sanitisation using client-side scripting can clean the data and remove dangerous input. Input validation on the client-side can check that entered data meets all of the requirements before getting processed by the server. Errors generated by data not meeting rules can be shown to the user.

3: Correct function in Python to check whether a username satisfies the rules. 2: Partially correct function. 1: Some understanding of the problem and Python.

def validate_username(username): valid = True

 # length check
 if len(username) < 8:
      valid = False
 elif (not username[0].isupper()):
      valid = False
 elif (not username[-2].islower()):
      valid = False
 elif (not username[-1].isdigit()):
      valid = False

 return valid

4: Explains how authentication AND authorisation could be applied. 3: Explains how authentication OR authorisation could be applied, OR outlines how both could be applied. 2: Outlines some features of authentication and/or authorisation. 1: Some relevant information.

Authentication ensures that only staff and students with valid usernames and passwords, which should be encrypted in storage (eg using hashing), can access the app. Authorisation controls access to specific features of the app based on user roles or groups. Teachers may have permissions to upload, assign and track homework, while students can only download tasks and upload completed work. By organising users into specific roles or groups, the app restricts access to appropriate functionality, ensuring that each user can only perform actions relevant to their role or group.

3: Provides an example of when a race condition may occur AND outlines how secure code could prevent it. 2: Outlines some features of race conditions. 1: Some relevant information.

With multiple teachers potentially accessing the database at the same time, race conditions can allow malicious users to gain unauthorised access. Authentication could be used to restrict access to the database, and code can be written to use atomic transactions and database locks to time the reading and writing of data.

1: Correctly orders the steps.

3: Thorough discussion of the use of sandboxing in the operating system. 2: Some understanding of the advantages and/or disadvantages. 1: Identifies a feature of sandboxing.

Sandboxing allows each application to be isolated so that it cannot pose a security risk by accessing system resources or other applications. However, it requires more resources as each application requires its own container. It may also be less convenient for users to access resources such as the device's camera or files as the sandbox will either prevent access or make it more difficult.

3: Correct function in Python that checks whether a username satisfies the rules. 2: Partially correct function. 1: Some understanding of the problem and Python.

def validateUsername(username):

  # Length check
  if len(username) > 8:
      return False

  # Alpha character only check
  elif username.isalpha() == False:
      return False

  # < character check
  elif "<" in username:
      return False

  # If we reach here then the username meets the requirements
  return True

1: Identifies the correct answer.

Cross site scripting

2: Explains ONE way to minimise the vulnerability. 1: Some relevant information.

The website could check and change user input so that markup and script become plain text. This will still allow the page to display the information but will prevent it from executing script code.

[Question 25 (a)] Criteria | Marks • Describes ONE relevant social or ethical issue | 2 • Demonstrates a basic understanding of a social or ethical issue | 1 Criteria | Marks • Outlines an appropriate installation method relevant to this app | 2 • Identifies an installation method | 1 Criteria | Marks • Justifies an appropriate software development approach for this app | 3 • Describes a software development approach | 2 • Demonstrates a basic understanding of software development | 1 Criteria | Marks • Describes ONE performance issue and ONE compatibility issue relevant to this app • Outlines ONE performance issue and ONE compatibility issue relevant to this app • Outlines a performance or compatibility issue OR | 2 • Identifies performance and/or compatibility issues • Provides some relevant information | 1

Sample answer: Privacy As the conversations are transmitted and possibly stored for processing, concerns may arise regarding the security of private conversations.

[Question 25 (b)] Sample answer: Direct cutover: each individual gets the complete system as soon as they purchase the application.

[Question 25 (c)] Sample answer: Agile This approach enables the development of this application relatively quickly in a possibly competitive environment. The agile approach means the system can be offered initially with two or three languages and limited functionality, but with updates offered after a short period of time to progressively include more languages and more features in response to feedback.

[Question 25 (d)] Sample answer: Compatibility: The application must execute consistently between different mobile phones, operating systems and networks. This means that the system must be tested using a wide range of environments. Performance: Processing times must allow normal conversations to proceed without delays. Some language translations do not lend themselves to word for word conversions, meaning longer processing times are required. The application must load quickly to minimise frustration.

[Question 21] Criteria | Marks • Describes TWO responsibilities of software developers | 3 • Describes ONE responsibility of software developers OR | 2 • Outlines TWO responsibilities • Demonstrates some understanding of software developers’ responsibilities

Sample answer: Intellectual property – appropriate acknowledgement of intellectual property means that a developer cannot use copied code fragments without first contacting the author, asking their permission and acknowledging the authorship visibly in their product. Response to user issues – a developer should respond appropriately and promptly, possibly by amending code.

[Question 23 (a)] Criteria | Marks • Provides TWO reasons for the importance of security of this database | 2 • Demonstrates some understanding of the importance of data security | 1 Criteria | Marks • Provides a substantially correct system flowchart for the authentication process, using appropriate symbols • Provides a partially correct system flowchart | 2 • Provides a diagram that shows some understanding of the process | 1

Sample answer: Unintentional/malicious changes to the data may cause harm to the patients. Privacy of the patient may be compromised if the data is made public.

[Question 23 (b)] Sample answer: