Built directly from your past ETHC303 exam questions on these two chapters — not from the slides. Every entry below exists because it helps you answer a real exam question style, even if the professor changes the wording, the scenario, or the order of options.
Definition: "A style of computing where massively scalable IT-enabled capabilities are delivered 'as a service' to external customers using Internet technologies."
Why it matters
Every ethical/security issue in this chapter flows from one root fact: your data and programs live on someone else's infrastructure, not yours.
Common exam wording
"organization adopts cloud computing, assuming efficiency gains..." / "massively scalable... as a service"
Example
A hospital storing patient files on Google Cloud instead of an in-house server.
Definition: Service models describing what layer the cloud provider delivers.
Why it matters
A real exam question (Q5) tested exactly this: swapping SaaS and EaaS definitions to make a false statement.
Common exam wording
"X offers online application programs" vs "X offers hardware resources such as CPU and storage."
Example
Gmail = SaaS (the app). AWS EC2 = IaaS/EaaS (the raw hardware/CPU/storage).
Definition: Exposure of information not intended for public release — health, financial, PII, trade secrets, IP — caused by a targeted attack, human error, app vulnerability, or poor security.
Why it matters
The professor tests whether you can tell WHO is responsible: hacker, the provider itself, or a third party — often you never know.
Common exam wording
"attackers modify data and maintain access without exploiting infrastructure vulnerabilities..."
Example
A clinic's cloud database exposing patient records after an employee misconfigures access settings.
Definition: Permanent loss of data via malicious attack, natural disaster, or a provider-side data wipe/accidental deletion.
Why it matters
⚠️ Confused constantly with "Data Breach" (breach = exposure/theft; loss = data is gone).
Common exam wording
"Amazon... permanently destroying customer data" / "Google lost data when lightning struck its power grid."
Example
A fire destroys a data center with no backup — customer files are gone forever.
Definition: Attackers use stolen/compromised login credentials to remotely access, manipulate, or falsify cloud data and redirect users to illegitimate sites.
Why it matters
Directly threatens CIA (Confidentiality, Integrity, Availability) of the cloud service.
Common exam wording
"attackers can eavesdrop on activities... manipulate data... redirect clients to illegitimate sites."
Example
A phished employee's cloud login is used to alter shared financial reports.
Definition: Malicious script/code embedded into a cloud service so it runs as a "valid instance" of that SaaS/service.
Why it matters
Exam trap: it isn't an outside attack — the malicious code hides inside what looks like legitimate software.
Common exam wording
"scripts or code embedded into cloud services that act as valid instances."
Example
A rogue plugin uploaded to a SaaS marketplace that spies once installed.
Definition: Cloud security is split between provider (infrastructure) and client (their own passwords, access, MFA).
Why it matters
Tests whether you know a breach can be the CLIENT's fault, not the provider's.
Common exam wording
"weak protection system at the client's systems" / "fine-grain control is up to you."
Example
Dropbox secures its servers, but a user reusing a weak password is still hacked.
Definition: Attackers abuse legitimate, trusted API calls/interfaces rather than exploiting infrastructure bugs or stealing new credentials.
Why it matters
⭐ Appeared verbatim in a past exam (Q6): logs showed only "legitimate API calls" — the trick was realizing trust itself was abused.
Common exam wording
"maintain access without exploiting infrastructure vulnerabilities or stealing new credentials... only legitimate API calls."
Example
An app with over-broad API permissions is used to quietly pull more data than intended.
Definition: A long-term, stealthy, targeted attack where the attacker stays undetected in a system for an extended period.
Why it matters
Keyword trigger: "persistent" + "undetected" + "over time" = APT, not a one-off breach.
Common exam wording
"remains undetected for an extended period... continuously monitors and exploits."
Example
A nation-state actor silently sits inside a company's cloud environment for months, harvesting data.
Definition: Compliance, Discrimination, Spiteful Activity, Intellectual Property misuse, Policies ignoring customer interest, Social/affordability issues.
Why it matters
These are the "soft" ethics issues examiners love turning into true/false traps — see List section below.
Common exam wording
"vendors may prioritize high-paying clients" (Discrimination) vs "former/disgruntled employees doing harm" (Spiteful Activity).
Example
A small business can't afford the same cloud tier as a competitor → Social/affordability issue.
Definition: Privacy = the right to be let alone, freedom from interference/intrusion. Information Privacy = control over the flow of one's personal information, including its transfer and exchange.
Why it matters
The foundational definition — almost every question in this chapter is really about who controls the flow of data.
Common exam wording
"control over the flow of one's personal information."
Example
You can be "alone" in your house (privacy) yet still have your smart TV leaking viewing data (information privacy violated).
Definition: Files a website sends to/retrieves from a user's computer to collect browsing preference data; re-submitted on the next visit.
Why it matters
Cookies aren't automatically evil — they customize retrieval and store preferences, but they also enable tracking/ads.
Common exam wording
"downloading of that information onto a user's computer without informing the user."
Example
A shopping site "remembering" your cart between visits.
Definition: More persistent cookies that survive normal cookie deletion/cache clearing; cannot be removed by anti-spyware tools.
Why it matters
⭐ Exact exam wording appeared: "website cookies that are hard to detect and delete" = Flash Cookies.
Common exam wording
"hard to detect and delete" / "cannot be deleted by commercially available anti-spyware."
Example
A "Better Privacy" Firefox add-on is needed specifically because normal deletion fails.
Definition: A summary of a device's software/hardware settings (fonts, clock, browser config) unique enough to identify it, used like a cookie.
Why it matters
⭐ Exact exam wording: "Summary of the software and hardware settings collected from a computer or other device" = Fingerprinting.
Common exam wording
"leaves no evidence on a user's computer" / "impossible to know when you are being tracked."
Example
You clear all cookies but ad networks still recognize your laptop by its unique settings.
Definition: Linking a single consumer's activity across their phone, tablet, and desktop.
Why it matters
Distinguish from fingerprinting (one device) — cross-device links MULTIPLE devices to one person.
Common exam wording
"connect a consumer's activity across smartphones, tablets, and desktops."
Example
You search shoes on your phone, then see the ad on your laptop.
Definition: Data mining extracts patterns from large datasets; profiling uses those patterns to predict an individual's interests/behavior and make decisions about them.
Why it matters
⭐ Exact exam wording: "shopping data can be used to promote healthy habits, but may also influence insurance coverage" = behavioral profiling.
Common exam wording
"predict interests and behaviour" / "refusal of insurance or a credit card."
Example
An insurer raises your premium based on your grocery-purchase patterns.
Definition: Radio-Frequency Identification — chips readable from a limited distance, consisting of a tag and a reader.
Why it matters
⭐ Verbatim exam definition: "Chips can be read from a limited distance, consisting of a tag and a reader."
Common exam wording
"tag and a reader" / "limited distance."
Example
Store inventory tags, or contactless access badges.
Definition: Identify/verify identity using intrinsic physical or behavioral traits (fingerprint, iris, face, voice, DNA).
Why it matters
⭐ Unlike passwords, biometric data cannot be revoked or reissued if compromised — favorite exam fact.
Common exam wording
"verify people's identities using their intrinsic physical characteristics."
Example
iPhone Face ID / fingerprint unlock.
Definition: Unmanned aerial systems carrying cameras, heat sensors, radar, Wi-Fi crackers, and sometimes fake cell towers/less-lethal weapons.
Why it matters
Raises both privacy AND civil liberties concerns — can intercept texts/calls, not just take photos.
Common exam wording
"stay in air for hours... scan entire cities."
Example
Police drone tracking a protest crowd.
Definition: Matching = cross-checking two+ databases to find "hits" (e.g., catching law violators). Merging = integrating multiple databases into one central database (data-banking).
Why it matters
Consent given to ONE agency does not authorize sharing/integrating with OTHERS — this is the ethical crux.
Common exam wording
"contextual integrity... violated" / "individual is not aware... being integrated."
Example
Matching = comparing a welfare-recipients list against an employment-income list to find fraud. Merging = combining your bank, medical, and shopping data into one master profile.
Definition: Everyday connected devices (smart meters, thermostats, phones) generate continuous data usable for mining/profiling; GPS enables location tracking even without a GPS chip (via Wi-Fi network monitoring).
Why it matters
User autonomy is the "central theme" the professor highlights for IoT privacy.
Common exam wording
"user autonomy is a central theme" / "location data links the online world to the physical environment."
Example
A smart thermostat's usage pattern reveals when you're away from home (burglary risk).
Data-collection techniques you must be able to instantly recognize from a description:
🧠 Mnemonic: "Rich Frogs Do First Take Data In Video For Cross Bio GPS Behavior" — or simpler, group them mentally as Physical (RFID, Drone, Video, GPS) vs Digital-tracking (Cookies, Flash-cookies, Fingerprinting, Cross-device) vs Identity (Biometrics, IRIS) vs Analysis (Data Mining, Profiling).
🧠 Match by symptom → cure: Scenario mentions a virus/spyware → Anti-virus. Mentions sensitive data over a network → Encryption. Mentions employees misusing access → Raise Awareness or Access Control. Mentions login/identity → MFA.
| Concept A | Concept B | Key Distinction |
|---|---|---|
| First-party Cookies | Third-party Cookies | Set by the site you're on to improve YOUR experience/functionality vs. set by outside domains (advertisers) to track you across many sites. |
| Cookies | Flash Cookies | Regular cookies are easy to delete/expire; flash cookies ("supercookies") survive normal deletion and need special tools (e.g., Better Privacy add-on) to remove. |
| Cookies/Flash Cookies | Device Fingerprinting | Cookies leave a file on your device (can be found/deleted); fingerprinting leaves NO trace — you can never know you're tracked. |
| Computer Matching | Computer Merging | Matching = cross-checking 2+ separate databases to find "hits" (e.g., fraud detection). Merging = combining databases into ONE central file ("data-banking"). |
| Data Mining | Profiling | Data mining = extracting patterns from raw data. Profiling = USING those patterns to categorize/predict/make decisions about a specific person. |
| Privacy | Information Privacy | Privacy = right to be let alone (broad). Information Privacy = specific control over the flow/exchange of one's personal data. |
| Data Breach | Data Loss | Breach = unauthorized exposure/access (data still exists, just seen by wrong party). Loss = data permanently destroyed/gone. |
| Discrimination (cloud) | Spiteful Activity (cloud) | Discrimination = provider favors big paying clients over small ones. Spiteful Activity = insiders/ex-employees intentionally sabotage data/systems. |
| SaaS | EaaS / IaaS | SaaS = online application software provided by the cloud provider. EaaS/IaaS = raw hardware resources (CPU, storage, equipment). |
| Passive Network Attack | Active Network Attack (e.g., MITM) | Passive = attacker only listens/intercepts traffic (eavesdropping). Active = attacker also alters/injects into the communication flow, undetected. |
| Raw Personal Data | Derived/Aggregated Data (profiles) | Raw data = direct identifiers. Derived/aggregated data (behavioral profiles) can still be highly sensitive even without direct identifiers — a common exam scenario twist. |
| Cross-device Tracking | Device Fingerprinting | Cross-device links ONE user across MULTIPLE devices. Fingerprinting identifies ONE device via its unique settings. |
How to recognize it: A table/list gives short factual descriptions and asks you to match each to a term from a word bank (exactly like past Question 4).
Reasoning process: Underline the ONE distinguishing keyword in the description (e.g., "tag and reader" → RFID; "hard to detect and delete" → Flash cookies; "intrinsic physical characteristics" → Biometrics). Then check if a countermeasure is being requested — match by symptom→cure (see list above).
Common mistakes: Confusing Fingerprinting (device settings) with Biometrics (physical human traits); confusing First vs Third-party cookies; picking Firewall when Encryption fits better (data-in-transit vs blocked-access scenarios).
For full marks: Match term-for-term with no blanks; if unsure between two similar terms, pick the one whose EXACT defining phrase appears in the scenario text.
How to recognize it: A statement is given as false; you choose which of two near-identical rewordings makes it TRUE. Wrong picks lose marks (no guessing!).
Reasoning process: Identify which single word/phrase was swapped (usually a term-for-term swap like SaaS↔EaaS, Collaboration↔Insight, Data loss↔Discrimination, Nomophobia↔an actual tip, Exposure to Competitors↔Customer Insights). Recall the correct pairing from the Lists section, then pick the option restoring the correct pairing.
Common mistakes: Picking an option that "sounds right" grammatically but swaps in the WRONG concept; not re-reading both options carefully since they look almost identical.
For full marks: Only select an answer when certain — since wrong answers are penalized, when torn, skip rather than guess.
How to recognize it: A short technical scenario (breach, unresponsive system, regulatory issue) is described, then 4 competing "most consistent" explanations are given.
Reasoning process: Look for what the scenario explicitly RULES OUT ("without exploiting infrastructure vulnerabilities," "without stealing new credentials," "logs show only legitimate calls") — this eliminates options claiming infrastructure/credential compromise, leaving abuse-of-trust/API answers. For attack-type comparisons, decide passive (listen only) vs active (listen + alter). For "system unresponsive after authentication requests," look for BOTH resource exhaustion AND social-engineering elements mentioned — pick the option that captures both, not just one.
Common mistakes: Choosing the most dramatic-sounding option (e.g., "must involve malware injection") instead of the option that matches the EXACT constraints stated in the scenario.
For full marks: Treat these like elimination puzzles — cross out any option contradicted by an explicit detail in the prompt; the surviving option is correct even if it sounds less exciting.
How to recognize it: "Organization adopts cloud computing assuming X, but later faces Y" — asks what assumption was flawed.
Reasoning process: Recall that in cloud computing, data is stored elsewhere in the world, so it's not always clear which law applies or which authority can demand access. The flawed assumption is almost always: "local laws/oversight still fully apply" or "regulatory simplicity was assumed."
Common mistakes: Blaming a technical failure (server crash) instead of the correct legal/jurisdictional assumption.
For full marks: Name the assumption explicitly: "they assumed data location/jurisdiction wouldn't complicate compliance."
Perfect structure:
Keywords that MUST appear: consent, contextual integrity, control over personal information, user autonomy, data mining/profiling, encryption, access control.
Examiner expectations: Concrete technique names (not vague "internet tracking"), a clear technique→countermeasure pairing, and an explicit ethical justification (not just "it's bad").
Perfect structure:
Keywords that MUST appear: shared responsibility, utilitarianism, discrimination, compliance, data breach, jurisdiction.
🧠 Cloud Ethical Issues → "DISCO-SPICe": Discrimination, Intellectual property, Social/affordability, COmpliance, SPIteful activity, customer-interest policies.
🧠 Cookies family, ranked by "stickiness": Regular Cookie (easy delete) → Third-party Cookie (blockable) → Flash Cookie (hard to delete) → Fingerprinting (impossible to detect). Visualize a ladder getting harder to escape as you climb.
🧠 Matching vs Merging: "MATCHing = making a MATCH (a hit) between two separate files." "MERGing = MERGing everything into one big file." Picture two puzzle pieces clicking (matching) vs. melting into one blob (merging).
🧠 Biometrics = "Un-resettable password": Real-life analogy — you can change a stolen credit card number, but you can't change your fingerprint. That permanence IS the exam point.
🧠 Data Mining vs Profiling: Mining = digging up raw ore (patterns). Profiling = shaping that ore into a tool aimed at YOU specifically (a decision).
🧠 Passive vs Active network attack: Passive = a spy with binoculars (watching only). Active = the spy cuts the phone line and impersonates the caller (altering the flow).
🧠 Shared Responsibility: Picture an apartment building — the landlord (provider) secures the building's locks and walls, but YOU (client) still have to lock your own apartment door (password, MFA).
⭐⭐⭐⭐⭐ Matching table: technique/tool ↔ description (RFID, Fingerprinting, Cookies, Biometrics, Data mining, etc.) — this exact format has appeared before and tests rapid recognition.
⭐⭐⭐⭐⭐ True/False "correct the false statement" pairs on Cloud + Social Media (SaaS/EaaS, Insight/Collaboration, Discrimination/Data loss, Nomophobia, Exposure to Competitors) — near-certain repeat format given it appeared twice already in the bank.
⭐⭐⭐⭐ Scenario MCQ on cloud breaches distinguishing infrastructure compromise vs. abuse of trusted APIs/legitimate access — tests deeper reasoning, not memorization.
⭐⭐⭐⭐ Short-answer: "Explain the difference between First-party and Third-party cookies" or "Flash cookies vs regular cookies" — classic comparison-based short answer.
⭐⭐⭐⭐ Listing question: "List and briefly explain the ethical issues of cloud computing" (Discrimination, Compliance, Spiteful Activity, etc.) — matches the course's known preference for "List"-type questions.
⭐⭐⭐ Essay: "Discuss privacy issues in cyberspace and the role of ethics" or "Evaluate cloud computing ethical issues using Utilitarianism" — possible if the exam includes an extended-response section.
⭐⭐⭐ Scenario: assumption-flaw question about cloud adoption and legal jurisdiction — tests conceptual understanding of cross-border data storage.
⭐⭐⭐ MCQ distinguishing passive vs active network attacks (sniffing vs MITM-style alteration) — possible crossover from the security chapter.