Criteria for a data exchange solution: protection, security and interactions
Name:
Date:
Class:
A
Quick Questions
Shade in the A or B circle for each question.
1. Which is a measurable criterion for protecting personal data in a data exchange solution?
2. Which criterion best tests CONFIDENTIALITY of exchanged data?
3. Which criterion best tests INTEGRITY of exchanged data?
4. Which criterion best tests AVAILABILITY of a data exchange solution?
5. Which criterion judges how the solution interacts with OTHER SYSTEMS?
B
Match the Pairs
Draw a line connecting each item on the left to its match on the right.
| Left column | Right column | |
|---|---|---|
| 1Criterion: 100% of personal data fields are encrypted in transit and at rest | ACriterion: The exchange service is available 99.5% of the time each month | |
| 2Criterion: The API returns valid JSON that 3 partner systems can read without manual changes | BThe criterion is vague and not measurable, so nobody can test whether it has been met. It should name a target, such as 'All logins require multi-factor authentication'. | |
| 3A CIA-based security criterion must be measurable, such as setting a target for availability | CThis criterion does not judge how well personal data is protected, and collecting as much as possible goes against collecting only what is reasonably necessary. It should be a protection target such as 'Only the 4 required fields are collected and stored'. | |
| 4A criterion for interaction with users should be measurable, such as a time that a user can achieve | DCriterion: 90% of users can upload a file in under 2 minutes without help | |
| 5Criterion: The data exchange must be very secure | EA measurable interaction criterion that judges how well the solution works with other systems | |
| 6Criterion: Personal data is collected from as many users as possible | FA measurable protection criterion that judges how well personal data is kept safe during exchange and storage |
C
Definitions
data exchange criteria
D
Fill in the Blanks
Complete each line of code by filling in the missing parts.
1.
IF encrypted = ____ THEN
dataProtected ← TRUE
2.
IF failedLogins >= 3 THEN
___________()
3.
IF hashSent = ____________ THEN
integrityOk ← TRUE
4.
IF format = "JSON" ___ status = 200 THEN
exchangeOk ← TRUE
5.
uptime ← (minutesUp / totalMinutes) * ___
E
Spot the Error
Shade in the letter of the line that contains an error.
Question 1
A
target ← 99.9
B
uptime ← 99.95
C
met ← uptime ≤ target
D
PRINT met
Question 2
A
encrypted ← TRUE
B
login ← TRUE
C
secure ← encrypted OR login
D
PRINT secure
Question 3
A
hashSent ← hash(fileGot)
B
hashGot ← hash(fileGot)
C
IF hashSent = hashGot THEN
D
PRINT "Integrity met"
E
END IF
Question 4
A
total ← 0
B
FOR i FROM 1 TO 4
C
total ← total + times[i]
D
avg ← total / 5
E
met ← avg ≤ 2
Question 5
A
formats ← ["CSV", "JSON"]
B
fmt ← "JSON"
C
IF fmt = formats THEN
D
PRINT "Can exchange"
E
END IF
Answer Key
Criteria for a data exchange solution: protection, security and interactions
Section A: Quick Questions
Q1
A — All personal fields are encrypted in transit and at rest
Q2
A — Only users with an assigned role can open student records
Q3
B — The checksum of each file received matches the checksum sent
Q4
B — The API responds to 99% of requests within 2 seconds
Q5
A — The system exports and imports data in valid JSON that other apps can read
Section B: Match the Pairs
Q1
Criterion: 100% of personal data fields are encrypted in transit and at rest → A measurable protection criterion that judges how well personal data is kept safe during exchange and storage
Q2
Criterion: The API returns valid JSON that 3 partner systems can read without manual changes → A measurable interaction criterion that judges how well the solution works with other systems
Q3
A CIA-based security criterion must be measurable, such as setting a target for availability → Criterion: The exchange service is available 99.5% of the time each month
Q4
A criterion for interaction with users should be measurable, such as a time that a user can achieve → Criterion: 90% of users can upload a file in under 2 minutes without help
Q5
Criterion: The data exchange must be very secure → The criterion is vague and not measurable, so nobody can test whether it has been met. It should name a target, such as 'All logins require multi-factor authentication'.
Q6
Criterion: Personal data is collected from as many users as possible → This criterion does not judge how well personal data is protected, and collecting as much as possible goes against collecting only what is reasonably necessary. It should be a protection target such as 'Only the 4 required fields are collected and stored'.
Section C: Definitions
Q1
data exchange criteria — Measurable standards used to judge how well a data exchange solution protects data, keeps it secure (CIA) and interacts with other systems and users.Section D: Fill in the Blanks
Q1
IF encrypted = TRUE THEN
dataProtected ← TRUEQ2
IF failedLogins >= 3 THEN
lockAccount()Q3
IF hashSent = hashReceived THEN
integrityOk ← TRUEQ4
IF format = "JSON" AND status = 200 THEN
exchangeOk ← TRUEQ5
uptime ← (minutesUp / totalMinutes) * 100Section E: Spot the Error
Q1
C — An availability criterion is met when uptime is at least the target. The test should use ≥ (uptime ≥ target), not ≤, which would pass a system with poor uptime.
Q2
C — The confidentiality criterion needs BOTH encryption and a login. OR passes with only one control, so it should be encrypted AND login.
Q3
A — The sender's hash must be made from the file that was sent (fileSent). Hashing the received file twice always matches, so it can never detect changes during transfer.
Q4
B — There are 5 response times, so the loop must run to 5. Stopping at 4 leaves one time out of the total, giving a wrong average for the measurable criterion.
Q5
C — To check interoperability, test whether the partner's format is in the list of supported formats using IN. Comparing one value with = to a whole array is wrong.