AP Cybersecurity
AP Cybersecurity / All lessons / Unit 5: Securing Applications and Data
5Unit 5: Securing Applications and Data
AP Cybersecurity topic 5.5

Protecting Applications

Secure applications validate input, use parameterized queries, encode output, keep libraries updated, and store secrets safely. Security is built in from the start (secure by design), tested with code review and scanning, and backed up so data can be restored after an attack.

Protecting Applications vocabulary

  • Parameterized query: A database query that treats user input strictly as data, blocking SQL injection.
  • Output encoding: Converting special characters so input displays as text instead of running as code.
  • Patch management: Tracking and applying software updates.
  • Backup: A copy of data kept separately so it can be restored.

AP-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

Skill: Mitigate Risk

1. A new school app ships with all data sharing turned off and the strongest privacy settings enabled until a user changes them. Which principle does this follow?

  1. (A) Security by default
  2. (B) Security through obscurity
  3. (C) Risk acceptance
  4. (D) Defense by deletion
Show answer

(A) Security by default Security by default means the out-of-the-box settings are the secure ones.

Skill: Mitigate Risk 
query = "SELECT * FROM books WHERE title = '" + userInput + "'"

2. Which change best protects this code from SQL injection?

  1. (A) Use a parameterized query so user input is treated only as data
  2. (B) Make the database password longer
  3. (C) Convert the input to uppercase
  4. (D) Run the query twice
Show answer

(A) Use a parameterized query so user input is treated only as data Parameterized queries keep input from changing the structure of the SQL command.

Skill: Mitigate Risk

3. Which of the following best describes input sanitization?

  1. (A) Removing or encoding characters in user input that could be interpreted as code
  2. (B) Encrypting the database every night
  3. (C) Deleting user accounts that are inactive
  4. (D) Backing up the website to the cloud
Show answer

(A) Removing or encoding characters in user input that could be interpreted as code Sanitization makes sure input is handled as plain data.

Skill: Mitigate Risk

4. A development team holds threat-modeling sessions before writing any code for a new app. Which principle does this demonstrate?

  1. (A) Secure by design
  2. (B) Security by default
  3. (C) Least functionality
  4. (D) Risk transference
Show answer

(A) Secure by design Planning for threats from the start builds security into the design.

Open 5.5 in the interactive course