ASSIGNMENT 4 · CHAPTER 13
Turn a misuse case into a test
Use the familiar decision-and-evidence sequence. This chapter focuses on threat → control → negative test. Make the initial decision before seeing the new evidence.
- Warm-up
- FIT → TEST → BOUND → ACT + EVIDENCE
- Commit Part A
- STRESS → REFIT
- AI declaration + human review
- Export and submit in LMS
1 · WARM-UP · 5 MINUTES · NOT GRADED
A student can download their own file. Does that test show they cannot download another student’s file?
Show / hide warm-up answer
No. It tests allowed behavior. Test a distinct user’s request for a protected object and verify server-side authorization, including any export path.
No written warm-up response is required.
Lecture guide
X02, X05, X06, R09 and R18; original slides 29–43 and 59–70.
FIT identifies the relevant problem. TEST builds this chapter’s artifact. BOUND states the limits. ACT + EVIDENCE records the action, owner and verification. STRESS then tests your reasoning before REFIT.
READ BEFORE ANSWERING
How your work is assessed · 5 points
| Criterion | Scoring |
|---|---|
| FIT · 1 point | 1: Defines the chapter-specific problem accurately, distinguishes facts from assumptions and connects it to the proposed action. 0.75: Sound reasoning with one minor omission. 0.5: Partly correct, with a consequential gap. 0: Missing, materially incorrect or based on invented evidence. |
| TEST · 1 point | 1: One positive and one negative authorization test, each with actor, input, observable expected result and evidence; no invented execution result. 0.75: Sound reasoning with one minor omission. 0.5: Partly correct, with a consequential gap. 0: Missing, materially incorrect or based on invented evidence. |
| BOUND · 1 point | 1: States relevant operating assumptions, scope and an observable trigger to reconsider the claim. 0.75: Sound reasoning with one minor omission. 0.5: Partly correct, with a consequential gap. 0: Missing, materially incorrect or based on invented evidence. |
| ACT + EVIDENCE · 1 point | 1: Gives a feasible bounded action, named responsibility and inspectable evidence, while distinguishing completed from proposed verification. 0.75: Sound reasoning with one minor omission. 0.5: Partly correct, with a consequential gap. 0: Missing, materially incorrect or based on invented evidence. |
| REFIT · 1 point | 1: Explains how the new evidence affects the initial claim and justifies RETAIN, REVISE or REPLACE with a coherent final record. 0.75: Sound reasoning with one minor omission. 0.5: Partly correct, with a consequential gap. 0: Missing, materially incorrect or based on invented evidence. |
Five points use the same familiar structure. The chapter artifact changes; the LMS determines how assignment points contribute to the course grade.
Learning-outcome alignment
This task supports supplied syllabus CLO 2, 5. It practises disciplinary knowledge, engineering skills and accountable decisions. It is course-written practice, not an official national readiness assessment or an approved item-weight mapping.
Before you start
Use Save draft while working and Download draft / backup before leaving a shared device. Part A becomes read-only only after you confirm commitment. You can continue editing Part B afterward.
The new evidence opens automatically after you commit Part A. No unlock code is required. Your initial reasoning stays saved and read-only. The sequence is designed to preserve your first judgment; it is not a secure examination system.
Identity
Loaded from the entry page. Drafts are separated by Student ID in this browser.
Submission details
Check the current deadline and submission instructions in the LMS.
2 · PART A · 20 MINUTES
Assessed scenario · fictional teaching case
A fictional university portal has student and staff roles. Students should access only their own project files; staff should access only the groups assigned to them. The interface hides other students’ files. A developer reports that every ordinary upload/download test passed. The API receives a project identifier in the request, but the brief contains no cross-user authorization test. Log retention is configured, but nobody has reviewed a sample for sensitive content. You recommend release, restricted access, or hold.
Aim for 300–450 focused words overall. Use a small table or clear notation for the chapter artifact. No code or external experiment is required. Cite at least one relevant Chapter 13 unit/title or source page supporting your artifact and mechanism.
A1 · FIT · 1 POINT
Identify one asset, one threat and one plausible vulnerability from the brief. Keep a suspected weakness distinct from a demonstrated exploit.
A2 · TEST · 1 POINT
Write two test cases: one allowed request and one forbidden request. State the actor, input/object, expected result and evidence to inspect. The tests are proposed, not executed.
A3 · BOUND · 1 POINT
State which roles, objects and access paths the recommendation covers. Name an untested path and a reopening trigger.
A4 · ACT + EVIDENCE · 1 POINT
Choose a bounded release action. Link a concrete server-side control to the tests and identify the reviewer.
Name the relevant test/log/audit, the conditions it must cover, who checks it, and what evidence is still missing. Do not describe requested evidence as if it already exists.
Commit is not LMS submission. Confirmation freezes FIT, TEST, BOUND, ACT and EVIDENCE before the new information appears.