Week 8 — Midterm: Written / Concept Exam

Covers Weeks 1–6.

✅ This week — what to do

1. Before — study Weeks 1–6.
2. In class — written midterm (exam.md); bring what the format allows (closed/open-note — instructor's choice).
3. After — answers reviewed in the next session.

Time breakdown: AGENDA.md (../../AGENDA.md).

Format

Closed/open-note (instructor's choice). Question types:

• Threat modeling: build/critique a STRIDE model and identify trust boundaries.
• CWE/OWASP mapping: classify given vulnerabilities.
• "Spot the vuln": find and explain the flaw in a code snippet (injection, XSS, auth, crypto misuse).
• Applied SQL injection: given a vulnerable endpoint, write the payload and the one-line reasoning — this is a full section of the paper (30 of 100 pts), not a single question. No fix credit here — that's Section D's job.
• Secure-design short answers (least privilege, defense in depth, fail closed).

Pairs with

Week 9 — Midterm Practical (CTF).