Built from your actual ETHC303 past exams (Major 1, Quiz bank) on these chapters — reverse-engineered to show WHAT the professor is really testing, not a slide summary.
Definition: Morality = a system of rules of conduct (directives + social policies) and principles of evaluation, meant to prevent harm and promote human flourishing. Ethics = the philosophical/rational STUDY of morality.
Why it matters
Every ethics essay opens with this distinction — morality is the "what," ethics is the "why/how we examine it."
Common exam wording
"Ethics is the study of morality" / "rational examination into people's moral belief and behaviour."
Example
"Don't steal" is a moral rule; asking WHY stealing is wrong is doing ethics.
Definition: Public, Informal, Rational, Impartial.
Why it matters
A classic listing question — students often forget "Informal" (no formal judges) and confuse it with law.
Common exam wording
"everyone must know the rules" (Public) / "no formal authoritative judges" (Informal) / "accessible to ordinary persons" (Rational) / "applies equitably to all" (Impartial).
Example
"Don't lie" is known by everyone (public), enforced by conscience not courts (informal), makes logical sense to anyone (rational), and applies to rich and poor alike (impartial).
Definition: Rules of Conduct = action-guiding directives (micro, individual) or social policies (macro, societal). Principles of Evaluation = standards (justice, fairness, respect) used to JUDGE those rules.
Why it matters
Tests whether you can tell a RULE ("Do not steal") from a JUSTIFICATION for that rule (fairness/justice).
Common exam wording
"directives" vs "social policies" / "evaluative standards used to justify rules."
Example
Rule: "Software should be protected" (macro/social policy). Principle justifying it: respect for others' work (fairness).
Definition: Beneficence = do good/right. Least Harm = when no option is purely good, choose the option causing least harm to fewest people. Autonomy = let people control decisions about their own lives. Justice = act fairly toward all involved.
Why it matters
Scenario questions often ask "which ethical principle is at risk/violated" — you must match the scenario detail to ONE of these four.
Common exam wording
"decision makers should focus on actions that are fair" (Justice, fill-in-blank exact wording from Major 1).
Example
A doctor rationing scarce vaccine doses to save the most lives = Least Harm reasoning.
Definition: Subjective Relativism = an action is right if the INDIVIDUAL approves of it. Cultural Relativism = an action is right if one's CULTURE approves of it.
Why it matters
Both are explicitly labeled "not a workable ethical theory" in your course — a favorite true/false trap.
Common exam wording
"gives tradition more weight than reasons or facts" / "no universal moral guidelines."
Example
"It's fine because everyone in my country does it" = Cultural Relativism reasoning.
Definition: An action is moral if it's in accordance with God's commands, and immoral if contrary to them.
Why it matters
Advantages list (objective, universal, eternal, authoritative) is commonly tested for recognition.
Common exam wording
"God's commands don't depend on what others think" / "completely objective."
Example
A believer avoids lying because their religious text commands honesty, regardless of consequences.
Definition: Focuses on CHARACTER rather than rules/consequences — a virtue is a "golden mean" between two vices (excess and deficiency); a vice is a character trait that prevents human flourishing.
Why it matters
⭐ Exact past exam item: Courage = the mean between cowardice (excess of fear) and rashness (deficiency of fear).
Common exam wording
"middle ground between X (excess) and Y (deficiency)" / "character trait that prevents flourishing = vice."
Example
Generosity = the mean between stinginess (deficiency) and wastefulness (excess).
Definition: Morality is grounded in DUTY (Greek: deon), never in the consequences of an action. Actions are guided by universal moral laws derived from logic.
Why it matters
⭐ Exact fill-in-blank: "Kant argued morality must be grounded in the concept of ___ (duty), never in the ___ (consequences) of human actions."
Common exam wording
"universal principle" / "never in the consequences."
Example
Telling the truth is your duty, even if a lie would produce a "better" outcome.
Definition: An action is right only if it can be universalized — if everyone could follow that same rule without contradiction.
Why it matters
This is the "test" Kant uses to judge any rule of conduct.
Common exam wording
"if an action can be universalized, then the action is right."
Example
Lying can't be universalized (if everyone lied, promises would mean nothing) → lying is wrong.
Definition: "Act so that you treat both yourself and others as ends, and never only as a means to an end."
Why it matters
This formulation is used constantly in scenario evaluations (e.g., informed consent cases).
Common exam wording
"treated as a means to an end and not as ends in themselves" (used when info is withheld from someone whose decision depends on it).
Example
Not telling job applicants about a risk that affects their decision treats them merely as a means.
Definition: Perfect Duty = strict, absolute, no exceptions, usually negative ("do not lie/steal"). Imperfect Duty = flexible, context-dependent, usually positive ("help others," "develop your talents").
Why it matters
Kant's known weakness: when a perfect duty conflicts with an imperfect duty, the PERFECT duty always wins (but two perfect duties in conflict = no solution).
Common exam wording
"no exceptions to perfect duties, even in extreme situations" (e.g., hiding someone from a murderer).
Example
Perfect: don't lie. Imperfect: help others when you can (you choose how/when).
Definition: An action is right (or wrong) to the extent it increases (or decreases) total happiness of affected parties. (Bentham & Mill)
Why it matters
Root concept for both Act and Rule Utilitarianism.
Common exam wording
"Happiness = advantage = benefit = good = pleasure = profit."
Example
A policy is judged "good" if it raises overall societal happiness/welfare.
Definition: Judges each INDIVIDUAL ACT by whether its own consequences produce the greatest good for the greatest number.
Why it matters
Weakness: can justify breaking a promise if doing so produces marginally more "units of good" elsewhere — ignores our innate sense of duty.
Common exam wording
"consequences that result from (X)" / "greatest amount of good for the greatest number."
Example
Breaking a promise to Y (1,000 units of good) if it creates 1,001 units of good for Z — Act Utilitarianism says break it.
Definition: Judges a RULE by whether its universal adoption produces the greatest good — you follow the rule even in individual cases where breaking it might seem better.
Why it matters
Avoids the "promise-breaking" trap of Act Utilitarianism; overlaps with Kantianism in RULES but differs in REASONING (consequences vs. duty/will).
Common exam wording
"correctness of a rule is determined by the amount of good it brings about when followed."
Example
"Always keep promises" as a rule produces more long-term happiness than deciding case-by-case.
Definition: Moral/political obligations depend on an implicit agreement among people to form a society with rules and a government to enforce them; without this, people would live in a "state of nature" — no rules, no security.
Why it matters
⭐ Exact fill-in-blank: "The natural condition of mankind would exist if there were no ___ (government/rules/social contract)."
Common exam wording
"to protect natural rights" (state's purpose) / "no one is above the rules."
Example
Traffic laws exist because everyone implicitly agrees to follow rules for collective safety.
Definition: 1st Principle: everyone gets an equal claim to basic rights/liberties. 2nd Principle: social/economic inequalities must be tied to positions everyone has fair opportunity to reach, and must benefit the LEAST advantaged (difference principle).
Why it matters
Extension of Social Contract Theory often tested as "which theory does this align with."
Common exam wording
"fully adequate number of basic rights and liberties" / "difference principle."
Example
Progressive taxation justified because it benefits the least-advantaged members of society.
Definition: Negative right = guaranteed by others simply leaving you alone (e.g., free expression). Positive right = obligates others to actively DO something for you (e.g., free education/healthcare).
Why it matters
⭐ Exact exam item: free basic healthcare for all citizens = a Positive Right.
Common exam wording
"obligating others to do something on your behalf."
Example
Right to free speech = negative right (just don't interfere). Right to free public education = positive right (state must provide it).
Definition: Employer–Employee, Client–Professional, Professional–Professional, Society–Professional.
Why it matters
Each relationship has DIFFERENT obligations — a common source of matching/scenario questions.
Common exam wording
"serve the interests of Society in general... exercise due care based on specialized knowledge" (Society-Professional).
Example
A licensed engineering body must protect public safety, not just its members' interests.
Definition: Paternalistic (professional decides everything, client has no say), Trust/Fiduciary (both share decision-making, requires mutual trust), Agency (professional does EXACTLY what client instructs).
Why it matters
⭐ Exact fill-in-blank: "Fiduciary model is an example of ___ relationship" (Client-Professional, Trust model).
Common exam wording
"client revokes all decision making" (Paternalistic) / "telling a stockbroker to buy Telkom" (Agency).
Example
A doctor who just follows exact patient instructions without offering medical judgment = Agency model.
Definition: A member (or former member) of an organization discloses an illegal/immoral practice, hoping someone will act to change it, after internal channels failed.
Why it matters
⭐ Exact fill-in-blank: "the whistle-blower makes an ___ (unauthorized) disclosure of information."
Common exam wording
"internal reporting" (told within org) vs. "external whistle-blowing" (told press/government after internal failure).
Example
An engineer reports faulty brakes to their manager first (internal); if ignored, going to the news is external whistleblowing.
Definition: The Altruist (genuine public good), The Avenger (motivated by retribution/revenge), Organization Man (loyal, reluctant), The Alarmist (raises alarm quickly/urgently), The Bounty Hunter (motivated by reward/money).
Why it matters
⭐ Exact exam item: "whistleblower motivated by retribution" = The Avenger.
Common exam wording
"motivated by goals, motivations and context."
Example
An employee who reports fraud mainly to get back at a manager who fired them = The Avenger.
Definition: Morally PERMISSIBLE when: (1) the organization will do serious/considerable harm, (2) it's been reported to the immediate supervisor, (3) internal channels/procedures have been exhausted with no result. Morally OBLIGATORY additionally when: (4) there's accessible documented evidence that would convince a reasonable/impartial observer, (5) there's good reason to believe going public will actually prevent or reduce the harm.
Why it matters
⭐ Exact past exam question: "mention 2 of the 5 questions/conditions" — memorize at least 2-3 verbatim.
Common exam wording
"before external whistleblowing becomes a moral duty."
Example
A safety engineer who reports to management first, is ignored, and has documented proof of danger meets the first 4 conditions.
Definition: Role responsibility (from assigned duties), Causal responsibility (because you caused something), Legal responsibility (assigned by law). These three are EXCLUSIVE (one person at a time). Moral responsibility is NOT exclusive — it can't be passed off ("my boss decided, not me" doesn't remove your moral responsibility).
Why it matters
⭐ Exact exam item: "responsibility borne because of a person's assigned duties" = Role responsibility.
Common exam wording
"Joe is responsible for the network being down because he released the virus" = Causal responsibility.
Example
A bookkeeper's role responsibility is paying bills on time; if they forget, that's also causal responsibility for late fees.
Definition: Statements of principles/values (e.g., ACM, BCS, IEEE-CS/ACM, LOPSA) meant to guide professional conduct. They are NOT laws and cannot provide a COMPLETE ethical framework, but they inspire public trust and act as decision-making tools.
Why it matters
⭐ Exact exam item: "Which is NOT true about codes of ethics?" → the false option is "Laws passed by public legislative bodies" (codes of ethics are NOT law).
Common exam wording
"cannot provide a complete ethical framework" / "useful tools for computer practitioners for decision-making."
Example
The ACM Code of Ethics guides behavior but breaking it isn't a crime — only a professional/reputational consequence.
Definition: Systems whose failure may cause injury or death (antilock brakes, nuclear reactors, airplane navigation, medical devices). Development requires rigorous process, thorough documentation, and vigilant checking.
Why it matters
Root concept behind N-version programming, redundancy, risk analysis, and hazard logs.
Common exam wording
"failure may cause injury or death" / "relies on flawless performance of software."
Example
An MRI machine's control software must never silently fail.
Definition: The same requirements are implemented independently N times (by different teams); versions run in parallel and a "voting algorithm" decides the output if results differ.
Why it matters
Distinguish from Redundancy (interchangeable components for the SAME implementation) — N-version uses DIFFERENT implementations.
Common exam wording
"independently implementing the same set of user requirements N times" / "voting algorithm."
Example
Three separately-coded autopilot modules cross-check each other; if one disagrees, the majority vote wins.
Definition: Providing multiple INTERCHANGEABLE software/hardware components to perform a single function, so failures can be tolerated.
Why it matters
Simpler than N-version — same component duplicated, not independently re-coded.
Common exam wording
"multiple interchangeable software components to perform a single function."
Example
A server with a backup power supply that kicks in if the main one fails.
Definition: Formal process considering what can go wrong, likelihood/consequences, and how risk is averted/mitigated/detected. A hazard log tracks hazards from project start to finish; a system safety engineer manages this logging.
Why it matters
Tests process knowledge — WHO does what during safety-critical development.
Common exam wording
"what can go wrong, likelihood and consequences... how risk can be averted, mitigated or detected."
Example
Before launch, engineers log every possible hazard a self-driving car's sensors might miss.
Definition: QA methods within the dev cycle guarantee reliable product operation. Using a standard, widely-accepted methodology reduces errors AND makes it harder to prove negligence against the organization.
Why it matters
Directly ties software process to LEGAL liability — a key ethics-meets-law point.
Common exam wording
"protects software manufacturers from legal liability" / "negligence... is harder to prove."
Example
A company that follows ISO-certified development steps has a legal defense if a bug still causes harm.
Definition: Management/staff ignore unforeseen issues that could damage a project, hoping the problems vanish on their own.
Why it matters
Classic unethical response pattern tested in scenario questions about hiding known bugs.
Common exam wording
"ignore the issues in the hope they will vanish."
Example
A team ships software with a known rare crash bug, hoping no one notices.
Definition: SAs have unrestricted "root" access to confidential data (databases, passwords, email) and can do anything with the system, including deleting critical files.
Why it matters
This unique power is WHY SAs need a strong code of ethics (e.g., LOPSA) and audits/self-policing.
Common exam wording
"unrestricted access to the root account" / "can remove critical system files."
Example
A disgruntled SA could secretly read every employee's private email — an ethical, not just technical, risk.
Definition: Confidentiality (prevent unauthorized access), Integrity (data stays accurate/reliable), Availability (systems stay usable/up).
Why it matters
Foundational security framework — every attack type can be mapped to which "leg" of the CIA triad it breaks.
Common exam wording
"loss of privacy... identity theft" (Confidentiality) / "information no longer reliable... fraud" (Integrity) / "business disruption... loss of revenue" (Availability).
Example
DDoS attacks Availability; data tampering attacks Integrity; a data breach attacks Confidentiality.
Definition: Cybertrespass = unauthorized ACCESS to systems/password-protected sites. Cybervandalism = using IT to DISRUPT operations or corrupt data. Cyberpiracy = reproducing/distributing proprietary software or data illegally.
Why it matters
Cyberpiracy is explicitly noted as MORE widespread than the other two because it requires no advanced skill.
Common exam wording
"unauthorized access" (trespass) vs "disrupt... corrupt data" (vandalism) vs "reproduce copies of proprietary software" (piracy).
Example
Guessing someone's password to peek at files = trespass. Deleting their files once in = vandalism. Copying and sharing their paid software = piracy.
Definition: DoS = attacker prevents legitimate users from accessing a service, often by flooding it with excessive/invalid requests from ONE source. DDoS = the same idea using MULTIPLE distributed sources at once.
Why it matters
The professor tests the SOURCE COUNT distinction, not the severity.
Common exam wording
"prevent legitimate users from accessing the service" / "invalid return addresses" / "flooded with data until unreachable."
Example
One computer spamming a server = DoS. A botnet of thousands of infected devices spamming it = DDoS.
Definition: Structured = carried out by individuals with advanced computing/programming skills who build custom hacking tools after researching a target. Unstructured = simpler, less skilled, often opportunistic attacks.
Why it matters
Tests whether you can judge attacker SKILL LEVEL from a scenario description.
Common exam wording
"individuals who possess advanced computing skills... create custom hacking tools."
Example
A teenager using a downloaded script = unstructured. A skilled group custom-building malware after network reconnaissance = structured.
Definition: Organization-wide practices: strong/unique passwords, account lockout policies, antivirus + firewall, audits of SA accounts, self-policing (admins follow the same rules), smart cards, biometrics, two-step verification.
Why it matters
Information security is a CULTURE, not just technology — a favorite essay/short-answer theme.
Common exam wording
"information security is not comprised only of technological superiority but should be treated as a culture."
Example
Even with the best firewall, a company is unsafe if employees reuse weak passwords.
🧠 Mnemonic: "Real Divas Don't Care, Sing Chill" → Relativism, Divine Command, Deontology, Consequence(Utilitarian), Contract, Character(Virtue).
🧠 Mnemonic: P.I.R.I. — "Please Include Rules Impartially."
Morally Permissible (first 3):
Morally Obligatory (add these 2):
| CIA Element | Risk if Broken | Typical Control |
|---|---|---|
| Confidentiality | Loss of privacy, unauthorized access, identity theft | Encryption, Authentication, Access Control |
| Integrity | Info unreliable/inaccurate, fraud | Maker/Checker, QA, Audit Logs |
| Availability | Business disruption, lost revenue/confidence | Business continuity plans, backups, sufficient capacity |
| Concept A | Concept B | Key Distinction |
|---|---|---|
| Act Utilitarianism | Rule Utilitarianism | Act = judge each act by ITS OWN consequences. Rule = judge the RULE by the good it produces when followed universally; avoids the "break a promise for marginal gain" trap. |
| Perfect Duty | Imperfect Duty | Perfect = strict, absolute, negative, no exceptions ("do not lie"). Imperfect = flexible, positive, contextual ("help others"). |
| Subjective Relativism | Cultural Relativism | Subjective = the INDIVIDUAL'S approval makes it right. Cultural = the CULTURE'S approval makes it right. Both are "not workable" theories. |
| Positive Right | Negative Right | Positive = obligates others to actively DO something (free healthcare/education). Negative = guaranteed just by others leaving you alone (free speech). |
| Internal Whistleblowing | External Whistleblowing | Internal = reporting within the organization first (preferred, less damaging). External = going to press/government after internal channels fail or are punished. |
| Role Responsibility | Causal Responsibility | Role = tied to your assigned job duties. Causal = tied to something you actually did/caused, regardless of your job title. |
| Role/Causal/Legal Responsibility | Moral Responsibility | The first three are EXCLUSIVE (one person at a time). Moral responsibility is NOT exclusive — it cannot be passed off to someone else. |
| Paternalistic Model | Agency Model | Paternalistic = professional decides everything; client has no say. Agency = professional does EXACTLY what the client instructs, no independent judgment. |
| N-Version Programming | Redundancy | N-Version = multiple INDEPENDENTLY coded versions + voting algorithm. Redundancy = multiple INTERCHANGEABLE (often identical) backup components. |
| Cybertrespass | Cybervandalism | Trespass = unauthorized ACCESS only. Vandalism = using access to DISRUPT operations or corrupt data. |
| DoS | DDoS | DoS = one attacking source. DDoS = multiple distributed attacking sources (often via a botnet). |
| Structured Attack | Unstructured Attack | Structured = advanced skills, custom tools, targeted research. Unstructured = lower skill, opportunistic, often using existing scripts. |
| Kantianism | Rule Utilitarianism | Both are rule-based, but Kantian rules come from DUTY/the Categorical Imperative (will/motivation); Rule Utilitarian rules come from maximizing COLLECTIVE HAPPINESS (consequences). |
How to recognize it: A short story about a professional (professor, engineer, banker) facing a conflict of interest, negligence, or fairness issue, followed by "what ethical principle/issue is at risk?"
Reasoning process: Identify the ROLE relationship involved (employer-employee, client-professional, professional-professional, society-professional) and match the described tension to one of the 4 ethical principles or a specific concept (e.g., conflict of interest, negligence, accountability).
Common mistakes: Picking a principle that sounds dramatic (e.g., "fraud") instead of the specific concept the scenario is built around (e.g., "conflict of interest" when a professor consults for a company they're also evaluating).
For full marks: Name the exact concept ("Conflict of Interest") not just a vague "it's unethical."
How to recognize it: A long narrative involving a technology failure causing real-world harm to an ordinary person, followed by 8-10 sequential MCQs about responsibility, ethical principles, and theories.
Reasoning process: Work through the story chronologically: (1) identify the core ethical issue (accountability for software/system malfunction), (2) identify WHO holds responsibility (usually the party whose system/software caused the harm — banks' developers/management), (3) identify what ethical VALUE is threatened (accountability, beneficence), (4) identify which ethical THEORY best supports fixing it quickly (Utilitarianism — greatest good for greatest number), (5) draw the general lesson (ethical responsibility includes managing/correcting technological failures promptly).
Common mistakes: Blaming the end-user (Maria/Javier) instead of the party that controls the system; picking "negligence" vs "fraud" incorrectly — negligence = failure to act with reasonable care (no bad intent), fraud = deliberate deception.
For full marks: Keep responsibility with the institution that has the technical CONTROL over the failure, and use Utilitarianism as the default "greatest good" justification for prompt correction.
How to recognize it: A sentence taken almost word-for-word from the slides with one or two key terms blanked out.
Reasoning process: Recall the EXACT phrase from the theory definitions in Section 1 — these are rarely paraphrased, so memorizing verbatim phrasing (duty/consequences, fiduciary/trust, justice principle, universalizable) is the highest-value use of your study time for this question type.
Common mistakes: Answering with a synonym that doesn't match the specific term taught (e.g., writing "outcome" instead of "consequences").
For full marks: Use the exact vocabulary from the slides/lists above.
How to recognize it: A short technical incident description (breach, flood of requests, social engineering) followed by "which explanation/attack type is most consistent."
Reasoning process: Map the description to CIA triad first (what's broken: confidentiality/integrity/availability), then to the specific attack category (DoS/DDoS, cybertrespass/vandalism/piracy, structured/unstructured).
Common mistakes: Confusing "unauthorized access" (trespass) with "disruption/corruption" (vandalism).
For full marks: Name the CIA element AND the specific attack type/category.
Perfect structure:
Keywords that MUST appear: duty, categorical imperative, means vs ends, greatest good for the greatest number, consequences, universalizable.
Examiner expectations: Apply EACH theory explicitly to the scenario's specific facts — don't just define the theories in the abstract.
Perfect structure:
Keywords that MUST appear: risk analysis, hazard log, N-version programming, redundancy, due care, quality assurance.
🧠 Perfect vs Imperfect Duty: Perfect = "Perfectly strict, no excuses" (negative: don't lie/steal). Imperfect = "I'm flexible" (positive: help others, when/how you choose).
🧠 Act vs Rule Utilitarianism: Act = judge the SINGLE ACT like a photo snapshot. Rule = judge the RULE like a movie playing out over and over — does following it forever produce more happiness?
🧠 Whistleblower types, by motive: Altruist = heart (public good). Avenger = grudge (revenge). Bounty Hunter = money ($$$). Alarmist = megaphone (urgency). Organization Man = loyalty (reluctant).
🧠 CIA Triad: Confidentiality = a locked diary (only you can read it). Integrity = an unaltered signature (trustworthy/accurate). Availability = a shop that's always open (usable when needed).
🧠 DoS vs DDoS: DoS = one person blocking a single doorway. DDoS = a mob blocking every doorway of the building at once (via a botnet "mob").
🧠 Society-Professional relationship: Think of it as a "license to operate" — like a driver's license, the society (government) grants the privilege, so the professional owes due care back to society.
🧠 N-version vs Redundancy: N-version = three different chefs cooking the same dish from scratch, then voting on which tastes right. Redundancy = keeping a spare identical dish warming in the kitchen just in case.
⭐⭐⭐⭐⭐ Fill-in-the-blank on exact theory definitions (duty/consequences, fiduciary/trust model, "the ___ principle states decision makers should focus on fairness") — appeared verbatim in Major 1 and is highly repeatable.
⭐⭐⭐⭐⭐ Multi-part extended scenario (technology failure causing real-world harm, 8-10 linked MCQs) — matches the exact "Maria" style question format already used.
⭐⭐⭐⭐ MCQ on whistleblower typology (Altruist/Avenger/Organization Man/Alarmist/Bounty Hunter) — a recurring, easily-tested memorization item.
⭐⭐⭐⭐ MCQ/listing on the Case Against Social Contract Theory or Case Against Kantianism — both appear multiple times in past exams as critique-recall questions.
⭐⭐⭐⭐ Listing question: "List and explain the 4 professional relationships" or "List the 5 DeGeorge conditions" — matches known preference for List-type questions.
⭐⭐⭐ Essay/scenario comparing Kantianism, Utilitarianism, and Social Contract Theory applied to a moral dilemma (Batman-style) — possible if extended-response section included.
⭐⭐⭐ MCQ distinguishing N-version programming vs. redundancy, or DoS vs. DDoS — classic comparison-based trap question.
⭐⭐⭐ Short answer: "Define Role, Causal, and Legal responsibility and explain why moral responsibility differs" — tests a distinctive, easily-confused concept.