Safe Computing
Help Questions
AP Computer Science Principles › Safe Computing
Based on the text, safe computing in a hospital billing office includes strong access control, timely updates, and careful handling of patient data. The office keeps insurance records on a shared drive, and only certain roles should open them. Privacy concerns grow when staff store files on personal devices, because control and auditing weaken. Security concerns grow when systems skip updates, because attackers exploit known weaknesses. The hospital adds data encryption, meaning files become unreadable without an authorized key. It also uses two-factor authentication, which requires a password plus a second check, such as a code. Ethical computing requires protecting vulnerable patients and avoiding unnecessary data collection. A breach occurs when an employee uses a simple password and reuses it on a social site. Attackers guess the password, enter the billing system, and expose thousands of records. The hospital pays notification costs, faces regulatory fines, and loses community trust (Health and Human Services HHS, 2021). What is the purpose of two-factor authentication in the passage?
It encrypts every file automatically, so passwords become unnecessary for accessing patient records.
It adds a second verification step, reducing harm when a password is guessed or stolen.
It works only when users reuse passwords, because repetition helps systems recognize legitimate logins.
It prevents device theft by locking office doors, which stops outsiders from entering buildings.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses authentication methods like two-factor authentication, which adds an extra layer of security beyond passwords. The passage provides the example of requiring 'a password plus a second check, such as a code' to illustrate how two-factor authentication works in protecting patient data. Choice A is correct because it accurately describes how two-factor authentication adds a second verification step, reducing harm when a password is guessed or stolen, which directly addresses the vulnerability exploited in the breach where attackers guessed a simple, reused password. Choice B is incorrect because it confuses two-factor authentication with encryption - authentication controls access while encryption scrambles data, and the passage clearly distinguishes these as separate security measures. To help students: Focus on understanding different security layers and their specific purposes. Encourage students to identify how each security measure addresses different vulnerabilities. Practice distinguishing between authentication (verifying identity) and encryption (protecting data). Watch for: confusing different security technologies, misunderstanding how security measures complement rather than replace each other, overlooking the specific vulnerability each measure addresses.
Read the passage. In a Personal Data Security lesson, students learn that safe computing includes recognizing social engineering, meaning manipulation that pressures quick decisions. Privacy concerns include strangers collecting details from public profiles. Security concerns include phishing calls that request verification codes and malware that captures screenshots. Ethical implications include refusing to prank-call others with spoofed numbers and reporting harassment. The passage notes that breaches often lead to account takeovers, financial loss, and emotional stress (National Institute of Standards and Technology NIST, 2018). What role does recognizing social engineering play in enhancing cybersecurity according to the passage?
It helps users resist pressure tactics, reducing the chance they disclose passwords or codes.
It eliminates the need for device updates because manipulation cannot affect software security.
It guarantees privacy by stopping websites from collecting any information about visitors.
It works only for companies with security teams, not for individuals at home.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses recognizing social engineering tactics, which the passage defines as manipulation that pressures quick decisions, a critical skill for protecting against human-targeted attacks. The passage emphasizes how social engineering relates to security concerns like phishing calls that request verification codes, showing how attackers exploit human psychology rather than technical vulnerabilities. Choice A is correct because it accurately captures the role of recognizing social engineering in enhancing cybersecurity by helping users resist pressure tactics, thereby reducing the chance they disclose passwords or codes - directly addressing the manipulation tactics described in the passage. Choice B is incorrect because it claims recognizing social engineering eliminates the need for device updates, misunderstanding that social and technical security measures serve different purposes, a common error when students compartmentalize security concepts. To help students: Focus on understanding how attackers exploit human psychology. Encourage analyzing pressure tactics and urgency in suspicious communications. Practice recognizing manipulation techniques across different contexts. Watch for: assuming technical measures alone provide complete security, misunderstanding the human element in security, underestimating social engineering risks.
Read the passage. A city library uses an online portal for patrons to reserve books and pay small fees. Safe computing principles include protecting accounts, limiting stored data, and monitoring for misuse. Privacy concerns involve reading histories and contact information, which can reveal sensitive preferences. Security concerns include account takeover and unauthorized purchases. The library adds rate limiting, meaning the system slows repeated login attempts to deter guessing. It also adopts two-factor authentication for staff accounts. A breach occurs when attackers repeatedly guess weak patron passwords, then change email addresses and lock users out. The library resets accounts, refunds fees, and faces reputational damage due to lost trust (FTC, 2022). What is the purpose of rate limiting in the passage?
It encrypts patron reading histories, so staff no longer need passwords to access the portal.
It increases guessing speed, because faster logins help legitimate users remember weak passwords.
It replaces refunds after breaches, because technical controls remove legal duties to notify patrons.
It slows repeated login attempts, making password guessing harder and reducing account takeover risk.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing includes defensive measures like rate limiting, which the passage defines as 'the system slows repeated login attempts to deter guessing.' The passage shows how attackers exploited weak passwords through repeated guessing, demonstrating why rate limiting is an important defense against brute force attacks. Choice A is correct because it accurately describes how rate limiting slows repeated login attempts, making password guessing harder and reducing account takeover risk, which directly addresses the attack method used in the breach where 'attackers repeatedly guess weak patron passwords.' Choice C is incorrect because it claims rate limiting increases guessing speed to help users, which is the opposite of its actual purpose and would make systems more vulnerable to the exact attack described in the passage. To help students: Focus on understanding how technical controls defend against specific attack methods. Encourage analyzing the relationship between attack techniques and defensive measures. Practice identifying how security measures balance usability with protection. Watch for: misunderstanding security measures as helping attackers, confusing the purpose of defensive controls, missing the connection between vulnerabilities and countermeasures.
Based on the text, a logistics startup secures its customer database by applying organizational safe computing practices. Principles include encrypting data, training employees, and keeping audit logs, meaning records of who accessed what and when. Privacy concerns include protecting phone numbers and delivery notes from unnecessary exposure. Security concerns include detecting unauthorized access quickly and limiting damage. The startup enables audit logs and reviews them weekly for unusual patterns. A breach occurs when a former employee’s account remains active after departure. The account is used to export customer lists, leading to spam and identity fraud attempts. The company pays investigation costs, faces contractual penalties, and updates its offboarding process (NIST, 2020). What is the purpose of audit logs in the passage?
They record access activity, helping detect misuse and supporting accountability after a suspected breach.
They replace encryption keys, because logs convert readable data into coded text for storage.
They ensure accounts deactivate automatically, so offboarding errors cannot occur in any organization.
They prevent spam by automatically blocking all outgoing messages from customer support accounts.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing requires monitoring and accountability measures like audit logs, which the passage defines as 'records of who accessed what and when.' The passage demonstrates how audit logs help detect unauthorized access when a former employee's account was misused, illustrating their role in both detection and investigation. Choice A is correct because it accurately describes how audit logs record access activity, helping detect misuse and supporting accountability after a suspected breach, which aligns with how the logs revealed unusual patterns from the former employee's account access. Choice C is incorrect because it confuses audit logs with encryption, claiming logs convert data into coded text, when the passage clearly distinguishes these as separate security measures with different purposes - logs record activity while encryption protects data. To help students: Focus on understanding different security controls and their specific functions. Encourage analyzing how monitoring supports both prevention and response. Practice distinguishing between detective controls (audit logs) and protective controls (encryption). Watch for: confusing different security technologies, missing the role of logs in accountability, overlooking the importance of monitoring in security.
Read the passage. A university uses organizational security to protect student records and research data. Administrators explain that strong password practices include long passphrases, unique passwords per site, and avoiding predictable patterns. They recommend a password manager, which securely stores many passwords in one encrypted vault. Privacy concerns include leaked grades and addresses, while security concerns include credential stuffing, where attackers reuse stolen passwords across services. The university adds two-factor authentication, requiring a password plus a temporary code, and trains staff to recognize phishing. The passage describes a breach where reused passwords allow attackers to access email accounts, leading to fraudulent refund requests and costly investigations (NIST, 2020). What is the purpose of using unique passwords per site in the passage?
It reduces damage from credential stuffing, since one leaked password cannot unlock other accounts.
It secures Wi‑Fi signals by scrambling radio waves, which prevents outsiders from joining networks.
It makes phishing harmless, because scammers cannot send messages to accounts with unique passwords.
It replaces two-factor authentication, since uniqueness alone provides a second verification step.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses password security practices that protect against credential-based attacks, with unique passwords per site being a critical defense against credential stuffing attacks. The passage provides examples such as the university experiencing a breach where reused passwords allowed attackers to access multiple accounts, leading to fraudulent refund requests and costly investigations. Choice A is correct because it accurately captures how unique passwords limit the damage from credential stuffing attacks - if one site's password database is compromised, the leaked password cannot be used to access the user's accounts on other sites. Choice B is incorrect because it misunderstands the relationship between passwords and phishing - unique passwords don't prevent phishing emails from being sent, they only limit the damage if credentials are compromised. To help students: Focus on understanding different password-related attacks and defenses. Encourage thinking about the interconnected nature of online accounts and cascade effects of breaches. Practice distinguishing between different security measures and what specific threats they address. Watch for: confusion about what password practices protect against, misunderstanding of credential stuffing attacks, and oversimplification of security benefits.
Based on the text, a subscription media service collects names, emails, and viewing histories. Safe computing principles include minimizing collected data, securing stored information, and respecting user consent. Privacy concerns center on viewing histories, because they reveal personal interests and habits. Security concerns include stopping unauthorized access and preventing data leaks. The service encrypts databases and limits access to a few administrators. Ethical implications include transparency, meaning clear communication about what data is collected and why. A breach occurs when an administrator account is compromised through phishing, and attackers copy the viewing-history table. Customers face embarrassment and targeted scams, and the company faces lawsuits and reputational damage after disclosure (NIST, 2020). What role does transparency play in enhancing cybersecurity according to the passage?
It requires collecting more data, because larger databases make intrusions easier to detect reliably.
It prevents phishing by blocking all emails, which removes the need for training programs entirely.
It tells users what data is collected and why, supporting informed consent and responsible handling.
It encrypts viewing histories automatically, because transparency is another term for data scrambling.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing includes ethical considerations like transparency, which the passage defines as 'clear communication about what data is collected and why.' The passage emphasizes how transparency supports informed consent and responsible data handling, connecting ethical practices to security outcomes. Choice A is correct because it accurately captures how transparency tells users what data is collected and why, supporting informed consent and responsible handling, which aligns with the passage's definition and emphasis on ethical implications of data collection. Choice C is incorrect because it completely misunderstands transparency, confusing it with encryption (data scrambling), when the passage clearly defines transparency as communication about data practices, not a technical security measure. To help students: Focus on understanding ethical principles alongside technical measures. Encourage analyzing how transparency builds trust and supports security. Practice distinguishing between ethical practices (transparency, consent) and technical controls (encryption, access limits). Watch for: confusing ethical concepts with technical measures, missing the connection between transparency and user trust, overlooking non-technical aspects of security.
Read the passage. A health class connects safe computing to everyday life: use secure passwords, confirm links, and limit app permissions. Privacy concerns include fitness apps sharing location patterns that reveal home addresses. Security concerns include phishing that imitates school notices and malware that steals stored photos. Ethical implications include reporting found devices rather than searching private messages. The text references the 2021 Facebook data leak, where scraped profiles enabled targeted scams and harassment (FTC, 2021). How does the passage illustrate the impact of oversharing on privacy?
It suggests oversharing is harmless if posts include humor and avoid technical language.
It argues oversharing only matters for celebrities, not ordinary students using social media.
It explains that location patterns can reveal routines, making identity theft and stalking easier.
It claims oversharing prevents malware by keeping accounts too public for attackers.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses understanding privacy risks, including how oversharing personal information can lead to serious consequences like identity theft and stalking. The passage specifically mentions fitness apps sharing location patterns that reveal home addresses as a privacy concern, illustrating how seemingly innocent data can be exploited. Choice A is correct because it accurately captures how oversharing impacts privacy by explaining that location patterns can reveal routines, making identity theft and stalking easier - directly reflecting the passage's example of fitness apps exposing home addresses through location data. Choice B is incorrect because it suggests oversharing only matters for celebrities, contradicting the passage's focus on everyday users, a common error when students underestimate their own privacy risks. To help students: Focus on identifying how personal data can be aggregated and misused. Encourage analyzing seemingly harmless information sharing. Practice recognizing privacy implications of location and routine data. Watch for: underestimating personal vulnerability, misunderstanding data aggregation risks, assuming privacy only matters for high-profile individuals.
Read the passage. During a Personal Data Security seminar, a presenter defines safe computing as protecting accounts, devices, and shared data through careful habits. Privacy concerns include oversharing photos that reveal routines and locations. Security concerns include malware that quietly copies contacts and phishing emails that request “urgent” password resets. Ethical implications include seeking consent before posting others’ information and warning friends about scams. The passage mentions the 2018 Marriott breach, which exposed travel-related personal details and increased fraud risk (Information Commissioner’s Office ICO, 2020). What is the purpose of using unique passwords in the passage?
It ensures a breach of one site does not automatically compromise accounts on other sites.
It prevents phishing by blocking all suspicious emails before they reach your inbox.
It replaces the need to log out on public devices because sessions end automatically.
It makes it safe to store passwords in plain text notes on a shared computer.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses practices like using unique passwords for different accounts to prevent cascading security failures when breaches occur. The passage mentions the 2018 Marriott breach which exposed personal details and increased fraud risk, illustrating why password compartmentalization is crucial. Choice A is correct because it accurately captures the purpose of using unique passwords - ensuring that a breach of one site does not automatically compromise accounts on other sites, which directly addresses the security principle of limiting damage from individual breaches. Choice B is incorrect because it suggests storing passwords in plain text on shared computers is safe, which contradicts fundamental security practices, a common error when students misunderstand that unique passwords alone don't eliminate all security requirements. To help students: Focus on understanding defense-in-depth strategies. Encourage analyzing how password reuse creates vulnerability chains. Practice recognizing the importance of password management tools. Watch for: assuming one security measure eliminates the need for others, misunderstanding password storage best practices, underestimating breach impacts.
Read the passage. A manufacturing company connects factory machines to an internal network for monitoring. Safe computing principles require secure configuration, limited access, and continuous patching, meaning installing updates that fix known flaws. Privacy concerns arise when employee badge data is stored alongside machine logs. Security concerns arise when attackers can disrupt production or steal design files. The company uses intrusion detection, meaning software that alerts staff about unusual network behavior. It also performs employee training on suspicious links and unexpected login prompts. A breach occurs when an unpatched server is exploited, and attackers move through the network. Production stops for two days, causing missed orders and overtime costs. The company also faces reputational damage and must review its controls (CISA, 2023). What is the purpose of patching in the passage?
It fixes known weaknesses in software, reducing the chance attackers exploit outdated systems successfully.
It hides employee badge data by deleting logs, which eliminates privacy concerns without any tradeoffs.
It replaces intrusion detection, because updates automatically alert staff about unusual network behavior.
It guarantees production never stops, because patched systems cannot be misconfigured by users.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing requires continuous maintenance including patching, which the passage defines as 'installing updates that fix known flaws.' The passage demonstrates how an unpatched server was exploited, leading to production stoppage and significant business impact, illustrating why timely patching is critical. Choice A is correct because it accurately describes how patching fixes known weaknesses in software, reducing the chance attackers exploit outdated systems, which directly addresses the vulnerability that led to the breach where 'an unpatched server is exploited.' Choice C is incorrect because it makes unrealistic guarantees about production continuity and ignores that patching addresses software vulnerabilities, not user configuration errors, demonstrating a common misconception about the scope of security measures. To help students: Focus on understanding the purpose and limitations of each security measure. Encourage analyzing how vulnerabilities are discovered and fixed through the patching process. Practice distinguishing between different types of security controls and their specific purposes. Watch for: making absolute claims about security, confusing different security measures' functions, missing the ongoing nature of security maintenance.
Read the passage. A regional hospital network adopts organizational security practices to protect patient records. It explains that privacy means controlling who sees sensitive information, while security means preventing unauthorized access or alteration. The network encrypts stored files, meaning it converts readable text into coded form that requires a key. It also encrypts data “in transit,” so intercepted messages remain unreadable. Network security includes a firewall, a digital gatekeeper that blocks suspicious connections, plus monitoring that flags unusual logins. Staff complete training on phishing, a scam that imitates trusted messages to steal credentials, and on malware, harmful software that can steal or damage data. Leaders stress ethics: employees should access records only for care needs, not curiosity, and should report errors promptly. The passage cites the WannaCry ransomware incident, where malware locks systems and demands payment, forcing cancelled appointments and costly recovery (NIST, 2020). What is the purpose of encrypting data “in transit” in the passage?
It ensures every cyberattack comes from phishing, so other threats can be ignored.
It prevents computers from being stolen because encrypted devices are too heavy to carry.
It makes intercepted messages unreadable without the key, protecting privacy during transmission.
It stops employees from forgetting passwords by automatically logging them into all systems.
Explanation
This question tests understanding of safe computing principles as discussed in AP Computer Science Principles, focusing on their practical and ethical implications. Safe computing encompasses practices like encryption, network security, and ethical data handling to protect sensitive information during storage and transmission. The passage provides examples such as the hospital network encrypting data 'in transit' to ensure that intercepted messages remain unreadable without the proper decryption key. Choice A is correct because it accurately captures the purpose of transit encryption in protecting privacy by making intercepted communications unreadable to unauthorized parties, addressing the specific vulnerability of data being captured while moving between systems. Choice B is incorrect because it confuses encryption with password management systems, which are entirely different security mechanisms serving different purposes. To help students: Focus on understanding the distinction between data at rest and data in transit, and why each requires protection. Encourage students to think about the data lifecycle and vulnerabilities at each stage. Practice identifying which security measures address which specific threats. Watch for: confusion between different security technologies, misunderstanding the scope of what encryption protects, and conflating different types of security measures.