Six tickets on your queue. Code reviews, incidents, and architecture reviews covering password hashing, HMAC, reset tokens, timing attacks, distribution integrity, and the low-entropy trap.
6 Tickets~20 minApplied · Scored
Triage Rules
For each ticket: Identify the failure category (algorithm / salt / comparison / entropy / storage), then pick the action that fixes the root cause.
Trap answers to watch: "switch SHA-256 to SHA-512" (same category), "add salt" when the algorithm is wrong, "use encryption" when hashing is the right operation.
Score0 / 6
Question 1
Ticket #H-3001 — Priority: Urgent
Code review catches this Python in a new authentication service: import hashlib; stored = hashlib.sha256(password.encode()).hexdigest(). Junior dev argues: 'SHA-256 is a strong hash, we're using the standard library.' Your response?
✎ Predict before reading options. Commit to your answer first.
Exam TipSHA-family for passwords in code review = REJECT. Require bcrypt or Argon2id. No exceptions.
Question 2
Ticket #H-3002 — Priority: High
Security audit finds the API authentication system validates incoming requests by comparing a user-supplied HMAC with the server's computed HMAC using Python's == operator. Why is this flagged, and how do you fix it?
✎ Predict before reading options. Commit to your answer first.
Exam TipCompare HMACs/tokens/digests with constant-time functions. hmac.compare_digest() or platform equivalent.
Question 3
Ticket #H-3003 — Priority: Medium
Pentest finding: the password reset email link contains a token generated as MD5(user_id + timestamp). Reset links are valid for 24 hours and there is no rate limiting. Triage?
✎ Predict before reading options. Commit to your answer first.
Exam TipReset tokens must be: cryptographically random + short-lived + rate-limited + single-use. MD5-of-predictable-input is a broken design.
Question 4
Ticket #H-3004 — Priority: Urgent
Incident: a previously-employed contractor accessed the production database. Passwords are stored with bcrypt (cost 12) and per-user random salts. Leadership asks: 'Can the contractor recover passwords?' Your assessment?
✎ Predict before reading options. Commit to your answer first.
Exam Tipbcrypt protects strong passwords against leaked databases for years. Weak passwords fall in days. Always force reset on breach, regardless.
Question 5
Ticket #H-3005 — Priority: High
Software release team asks: how should they distribute and verify the company's new installer? They want users to be able to verify the download hasn't been tampered with. Recommend a complete scheme.
✎ Predict before reading options. Commit to your answer first.
Exam TipDistribution integrity: SHA-256 via HTTPS + code signing. Two mechanisms, each providing a complementary guarantee.
Question 6
Ticket #H-3006 — Priority: Critical
Security engineer proposes: 'Let's store a SHA-256 hash of each user's credit card number in the database. That way we can search for duplicates without storing the actual number.' What's the critical flaw?
✎ Predict before reading options. Commit to your answer first.
Exam TipHashing protects HIGH-entropy data (strong passwords, files). Hashing does NOT protect LOW-entropy data (card numbers, SSNs, phone numbers). Use tokenization or encryption there.
Whether you're a student, parent, or teacher — I'd love to hear from you.
Just want free AP CS resources?
Enter your email below and check the subscribe box — no message needed.
Students get daily practice questions and study tips. Teachers get curriculum resources and teaching strategies.
Typically responds within 24 hours
✓
Message Sent!
Thanks for reaching out. I'll get back to you within 24 hours.
34.8% of Tanner’s CSP students score 5s. The national average is 9.6%.
I’m a Student
I’m a Teacher
✓Free AP CSP Big Ideas cheat sheet (PDF)
✓Daily practice questions covering all 5 Big Ideas
✓Create Task tips that actually work — from a real AP teacher
✓Free class codes with student progress tracking
✓3 full practice exams + Top 100 questions for your class
✓Create Task guidance and pseudocode reference sheets
Which AP CS exams are you prepping for?
✓
You’re in!
Your Big Ideas cheat sheet is on its way.
No thanks, I’ll figure it out myself
Avg student improvement: 2+ score levels | Real AP teacher, not just a tutor
AP Cybersecurity — National Launch 2026–27
Get Early Access to AP Cyber
AP Cyber launches nationally fall 2026. Get in early to help shape the course — start free with Unit 1 and the free teacher gradebook.
✓
You’re in — you’re on the AP Cyber early-access list!
Tanner will follow up personally within 48 hours. Your feedback will directly shape what gets built.
Step 1 of 4
Early Access — Limited Spots
Who are you?
Are you a teacher or a student?
I’m a Teacher
I’m a Student
Free to start — Unit 1 and the teacher gradebook are always free, no credit card.
Founding teachers unlock all 5 units and get direct input on what we build.
Not interested right now
Step 2 of 4
Your School
Tell us about your class
Other AP CS courses you teach
Your Situation
Tell us about yourself
Step 3 of 4
Classroom Needs
What does your classroom need? (select all that apply)
How You Study
What would help you most? (select all that apply)
Step 4 of 4
Almost Done
Where should we send your early-access details?
Free gradebook + Unit 1 | Your feedback shapes the course | Built by a real AP teacher