Week 8
← all weeks · readme · exam
marp: true theme: default paginate: true header: "Software Security · Week 8 · Midterm"
Week 8
Midterm — Written Exam
Covers Weeks 1–6
<!-- Proctor deck. Before starting: confirm exam version (rotate from exams/item-bank.md each cohort), state time, closed/open-note rule, and integrity policy. Keep talking minimal once the clock starts. -->
Format
- Duration: (set by instructor)
- Closed / open-note: (instructor's choice)
- Mixed question types — concepts + applied reasoning
<!-- Fill the blanks aloud (e.g. 120 min, open one-page cheat sheet if you allowed it in W7). State no phones/AI; sections A–D = concepts / spot-the-vuln / applied / design (100 pts). -->
What's assessed
- Threat modeling: build/critique a STRIDE model, identify trust boundaries
- CWE/OWASP mapping: classify given vulnerabilities
- Spot the vuln: find & explain the flaw in a code snippet
- Secure design: least privilege, defense in depth, fail closed
<!-- Show briefly so expectations are clear, then move on — this is exam day, not teaching. Mirrors the W7 mock. -->
Tips
- Read the code carefully before answering "spot the vuln"
- Name the fix, not just the bug
- Map every finding to a CWE / OWASP category
<!-- The single biggest score-saver: name the FIX + CWE, not just "this is SQLi". Say it once, then start the clock. -->
Good luck
Week 9: hands-on CTF practical
<!-- Close: remind W9 is the hands-on CTF — VM/tools must be ready. Collect papers; grade with exams/week08-…-answers.md. -->