Data Security and Privacy: CIA, API Authorization, Cloud Access, and Governance

Records are stolen, pages are changed, and the service is forced into maintenance. Map the CIA impacts.

Theft → confidentiality; page changes → integrity; maintenance disruption → availability.

An authorized employee accidentally deletes registration records and prevents enrollment. Which CIA goals are affected?

Integrity and availability.

What should a university determine first before building a student-support prediction system?

The necessary data and its lifecycle.

Who should receive academic-risk scores: instructors, advisors, housing staff, or a vendor?

First determine who needs the score for the student-support purpose.

What must be established before a fitness app continuously collects precise location?

The purpose and necessary scope of collection.

What does encryption leave unresolved in a student-analytics system?

Whether the collection and intended uses are appropriate.

Detailed location histories remain after the service no longer needs them. What is the best response?

Define and apply a justified retention and disposal schedule.

A university and vendor retain identifiable survey data indefinitely; only the university copy is deleted. What is the fix?

Govern sharing, retention, and deletion at both locations.

An attacker reads patient records without changing them or causing an outage. What kind of failure is this?

A confidentiality failure that may also produce privacy harm.

Approved analysts want to infer counseling attendance from encrypted student-location data. What comes first?

First determine whether the inference is necessary for the stated purpose.

Which database actions deserve focused audit coverage?

Privilege changes, bulk exports, sensitive reads, and administrative changes.

What is a limitation of encrypting a field used for exact-match search and sorting?

Encryption can disrupt indexing, comparison, and query behavior.

Why design useful database logs before deployment?

To detect abuse or misuse early enough to respond.

An application concatenates a user-supplied surname into SQL. What fixes the problem?

Use parameterized queries and separate query structure from data.

A signed download URL is valid for 30 days and can be forwarded. How can exposure be limited?

Use short expiration, narrow object scope, and issue it only after authorization.

Real-time replicas immediately copy a bad update. What additional capability is needed?

Tested point-in-time recovery or protected backups.

Researchers should see only rows for assigned studies. What directly enforces this in the database?

Row-level security using authenticated project context.

A database has API, reporting, administration, and backup access. What should a review do first?

Map each access path, identity, operation, and data boundary.

A team wants stronger separation from its cloud provider and accepts more operational work. What fits?

Customer-managed or application-side encryption with controlled keys.

Deleting a database row leaves indexes, caches, exports, replicas, and backups unchanged. What is wrong?

Retention and deletion were not designed across every copy.

A valid researcher Bearer token is used to delete another project's file. What check is required?

Authorization for that action on that specific object.

A researcher can view data but receives 403 from /admin/export. Which layer is enforced?

Function-level authorization.

A researcher can view a record but receives unauthorized birth-date and internal-note fields. What is this flaw?

Broken Object Property Level Authorization (BOPLA).

An attacker compromises a developer machine inside a private subnet. What is still required?

Identity, authorization, and scope checks at each service boundary.

What prevents an API user from changing their role to admin?

Check that the property change is allowed for that caller and object.

Which OAuth entity issues the access token after consent and scope approval?

The authorization server.

A client may upload recordings but must never read or delete them. How is this enforced?

Grant upload:recordings scope and reject operations outside it.

Which security decisions protect a batch upload across the full request path?

Protect transport → validate the token → authorize the object → enforce scoped storage permissions.

An endpoint repeatedly runs expensive queries lasting over 30 seconds. What protects availability?

Per-identity rate limits, query-complexity limits, and execution timeouts.

What best governs a third-party analytics data-sharing path?

Minimize transmitted data, set timeouts, and review vendor storage and deletion.

Who is primarily accountable for deciding how participant contact information may be used?

The data owner who defines business use and access boundaries.

A researcher can read the whole database but only needs one active clinical trial. What should be done?

Remove read access outside the specific project scope.

Application logs contain request bodies with credit card numbers. What immediate change is needed?

Mask or exclude sensitive secrets and unnecessary personal data.

How should repeated login-denial alerts become an operational response?

Define a threshold, assign an owner, and trigger a block or investigation.

What design supports a safe, auditable reset of a compromised service-account password?

A separate administrator identity with strong authentication and limited duration.

What should an access review compare?

Identity, role, resource access, and last use date.

Bulk-export logs omit the project identifier and approving identity. What cannot be reliably determined?

Who approved the export and which project's data left.

A researcher moves from a public-health project to a financial-records project. What happens to old access?

Remove access to the previous dataset before granting new access.

What constitutes proper offboarding when an employee leaves?

Disable the account, revoke active sessions, and transfer data ownership.

A researcher retains access to databases from two former projects. What is this called?

Privilege creep.

Development, test, and production share one cloud account. What is the primary risk?

One compromised identity can reach production resources.

A catalog masks diagnosis values, but analysts can read the underlying bucket files. What is the problem?

They can read unmasked diagnoses directly from the files.

An engineer changes production network rules without updating the approved template. What is this?

Configuration drift.

One application customer sees another customer's records while cloud-account isolation works. Where is the flaw?

Most likely in application authorization checks.

A batch job stores a developer's SSH key in its configuration. What is the best replacement?

A workload identity with short-lived credentials.

A managed database is highly available, but deleted records must be restored within four hours. What is needed?

Back up the data and test restores regularly.

An analytics job reads two datasets but has administrator access to every bucket. What is the fix?

Limit the role to read access on the two datasets.

What does the provider's SOC 2 Type II report establish about the customer's workload configuration?

It does not establish that the customer's workloads are configured correctly.

Control-plane logs show a bucket became public. What reveals subsequent file downloads?

Data-plane access logs for the bucket.

A public traffic table is joined with Confidential student health visits. Classify the result.

Confidential.

Why can an employer name identify someone in a small town but not a large city?

Population size and available outside information.

A release has ZIP, DOB, and Sex; an outside table has Name, ZIP, and DOB. Model the attack.

Join on ZIP and DOB.

What acted as quasi-identifiers in the AOL search-log release?

The search queries themselves.

Why could Netflix ratings with substituted IDs be linked to public review profiles?

The distinctiveness of each user's ratings.

How is date of birth classified in a dataset containing names, SSNs, and birth dates?

A quasi-identifier.

An attacker knows an email address that was replaced with a deterministic hash. Why can linkage work?

The attacker can hash the known email and compare.

[Clinic table; quasi-identifiers = ZIP, Age, Sex. Rows: 1) 90840,20,F,asthma; 2) 90840,20,F,migraine; 3) 90840,20,M,asthma; 4) 90840,21,F,depression; 5) 90815,20,F,asthma; 6) 90815,20,F,diabetes; 7) 90815,20,F,migraine; 8) 90815,22,M,Fabry disease] How many rows are unique on ZIP, Age, and Sex?

3 rows: rows 3, 4, and 8.

[Same clinic table] A neighbor knows a 20-year-old woman from ZIP 90815 is in the table. How many rows must the neighbor choose among?

3 rows: rows 5, 6, and 7.

[Same clinic table] About 40 women aged 21 live in ZIP 90840, few are clinic patients. Is row 4 unique in the sample or the population?

Unique only in the sample.

[Same clinic table] Only one person in the county has Fabry disease. What does this show?

A rare sensitive value can also identify a person.

A server follows the protocol but examines received updates to learn about students. What adversary is this?

An honest-but-curious server.

Honest clients contribute weighted total +4 from 100 examples. Five fake phones each claim 20 examples and submit clipped update +1.0. What is the average update?

+0.52.

An analyst estimates whether many training examples came from international students; nationality is not a model label. What attack is this?

Property inference.

Which control most directly slows extraction of a model exposed through an API?

Query limits and label-only outputs.

Phone A has 30 examples and update +0.2; Phone B has 70 and update −0.1. What is the weighted average?

−0.01.

A record receives confidence 0.97; training records average 0.95 and unseen records 0.70. An attacker infers it was in training. What attack?

Membership inference.

[Hospital model trained with federated learning, queryable via API] An attacker sends many queries to copy the model's behavior. What attack is this?

Model extraction.

[Hospital federated model with API] An attacker uses outputs to infer typical features of patients with one diagnosis. What attack is this?

Model inversion.

[Hospital federated model with API] A client's model works normally except on one trigger that the attacker chose. What is this?

A backdoor.

[Hospital federated model with API] What is a control for attacks through the query API?

Limits on queries.

The parties cannot remain online for message exchanges. Which HE versus MPC difference matters?

HE evaluation is noninteractive; MPC usually requires communication.

What does HE hide from an outside observer during evaluation?

The plaintext values.

Two banks want customers appearing on both fraud lists without revealing either full list. What technique?

Private set intersection.

Participants follow the protocol exactly but examine every received message. Which adversary model?

The semi-honest adversary model.

Which method reveals common elements, or only how many elements are shared?

Private set intersection.

An additively homomorphic scheme combines encryptions of 5 and 3. What does the result decrypt to?

8.

[Three parties use MPC to compute the sum of their private counts; result goes to all three] What is the ideal benchmark for a secure MPC computation?

An ideal trusted party.

[3-party MPC sum] Before output release, two parties combine two shares of an input under 3-of-3 additive sharing. What do they learn about the third input?

Those two shares reveal nothing about the third input by themselves.

[3-party MPC] Why are comparisons slower than additions on shares in the quiz's MPC setting?

They need rounds of messages.

[MPC] An aggregate over only two employers lets each recover the other's salary. Best listed control?

A minimum group size.