Software Engineering › Key terms › Y12 Secure Software Architecture › Vulnerability
Vulnerability
Term Y12 Secure Software Architecture
Definition
A weakness in software, hardware or process that an attacker could exploit.
Example: An unpatched library is a vulnerability.
Found in: syllabus, sample exam and familiarisation guidelines, school notes.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Multiple choice: Pick the option that matches the definition or example.
- Short answer: Define, outline or explain it and tie it to the scenario.
- Fill in the blanks: Choose this term to complete a statement or table.
Where it has appeared in the paper
Secure Software Architecture (Part A, B). Part letters follow each paper’s own layout.
Related past questions
- Sample exam Q8 (2 marks): SAST and DAST Secure Software Architecture (Part B) · 2 marks
- 2025 HSC Q13 (2 marks): SAST and DAST Secure Software Architecture (Part A) · 2 marks
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Other questions that mention it
- Familiarisation Q11b Secure Software Architecture (Part C) · 2 marks
- Sample exam Q25 Software Automation (Part B) · 8 marks
- Familiarisation Q11a Secure Software Architecture (Part C) · 1 mark
Study links
- Flashcard: Vulnerability in Secure Software Architecture (Year 12) · study that set
- Memorise: Fundamental software development steps for secure code
- Notes: Apply and evaluate strategies used by software developers to manage the security of… (Secure Software Architecture (Year 12))
- Notes: Code security strategies: code review, SAST, DAST, vulnerability assessment, pen testing (Secure Software Architecture (Year 12))
- Notes: Test and evaluate the security and resilience of software by determining… (Secure Software Architecture (Year 12))
- Master answer: fam-q11b (2 marks, short answer (explain)) (Master model answers: Secure Software Architecture)
How to use it in an answer
A model sentence
“A weakness in software, hardware or process that an attacker could exploit.” Then apply it: An unpatched library is a vulnerability.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
Technique for the question types
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
- Fill in the blanks: Choose the right word from a list; use exact syllabus terms.
What the marking guidelines and feedback say
SAST = static, analyses code without running it; DAST = dynamic, tests the running application (simulated attacks, probing interfaces).
For revision: SAST = static, done before/without running the program, needs source code access. DAST = dynamic, done while the program is running, no source code access needed (reasoned from the syllabus, not copied from the image).
Worked answers from the marking guidelines
Sample exam Q8 (2 marks): SAST and DAST (2 marks): criteria and sample answer
Criteria
2: Correctly classifies all the strategies. 1: Correctly classifies THREE strategies, which must include ONE SAST and ONE DAST.
Sample answer
SAST: (2) and (5). DAST: (1), (3) and (4).
Common mistakes
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Secure software · Data protection · Cyber attack · Capabilities and experience of end users