Module 9 · End-of-module check

Module 9 — End-of-module check.

MC & short-answer closed-book; applied open-workstation Passing bar: 11.5 / 15, with full credit on ≥ 1 applied question

This is the integrative assessment for Module 9. It confirms you can reason about the three-adversary threat model without collapsing it into “hackers,” recognize prompt-injection surfaces in your own pipeline and name the defense that fits, classify data into public / personal / sensitive and route it to the right tool without thinking, handle API keys under the one-store / scope-and-cap / rotate-not-patch rules, run the four-step incident loop on a scripted scenario without improvising, and own a frozen /capstone/security-posture.md — not merely recall that those steps exist. Multiple choice and short answer are closed-book. Applied items are open-workstation.

Multiple choice CORE

6 questions · 1 point each · closed-book.

Q1. A student says, “I’m the only one who uses this machine, so I don’t really have a threat model.” Which adversary is this reasoning leaving out, and why does that matter?
  • A Hostile internet — because someone could still find the machine’s IP address.
  • B Supply chain — because every plugin, skill, model, and package the student installs carries code the student did not write.
  • C Careless self — because a single user is always their own biggest adversary.
  • D Both (B) and (C), roughly equally — the “one user, one machine” framing misses both the self who clicks fast and the dependency tree that runs code on their behalf.
Show explanation

Answer: D. Review Lesson 9.1 Content Blocks 2–4 if missed. The three-adversary model is specifically designed to defeat the “I’m the only user” intuition. Careless self (rushed pastes, context rot, permission drift) is the highest-frequency adversary; supply chain (installed plugins, skills, models, npm/pip packages) is the widest attack surface. (A) alone is the naïve answer and tends to get overweighted because it matches movies. (B) and (C) are each correct but incomplete on their own.

Q2. Your research pipeline fetches a source, passes it to a summarizer agent, which passes the summary to a drafter, which passes the draft to a reviewer, which writes a file. A malicious instruction hidden inside the fetched source arrives at the summarizer as the upstream output. Which defense layer is best positioned to neutralize it?
  • A Refusal — the summarizer should recognize the injection and decline.
  • B Segregation — the summarizer’s system prompt should frame fetched content as untrusted data, not as instructions.
  • C Containment — the reviewer should catch it in the final review.
  • D Kill switch — pull the pipeline and restart.
Show explanation

Answer: B. Review Lesson 9.2 Content Blocks 3–5 if missed. Segregation is the right layer because it sets the frame the agent reads the content through; refusal and containment are secondary layers that only fire after segregation does or does not hold. The module teaches layer first, closest to the injection surface. (A) is not wrong but is a weaker second line — relying on refusal alone means every agent in the pipeline has to recognize every injection variant. (C) accepts the injection’s propagation through three agents before catching it, which is expensive and unreliable. (D) is a response to runaway, not to injection.

Q3. You rotate an API key. Which of the following is not a required step in the rotation drill as Module 9 defines it?
  • A Generate the new key in the provider’s dashboard with scope equal to or narrower than the old key’s scope.
  • B Update the one-store location (.env, keychain entry, or password-manager record) — and only that location.
  • C Rotate the key value inside every script, notebook, and config file the key appears in across the workstation.
  • D Revoke the old key in the provider’s dashboard and log the rotation in the rotation register.
Show explanation

Answer: C. Review Lesson 9.3 Content Blocks 2 and 4 if missed. (C) is the anti-pattern the one-store rule exists to prevent. If the key appears inline in “every script, notebook, and config file,” the student has already lost — rotation becomes a grep-and-replace that will miss a copy somewhere. (A), (B), and (D) are the three required steps under one-store / scope-and-cap / rotate-not-patch. The fact that (C) sounds plausible is the point: students who skip Lesson 9.3 will nod along to it.

Q4. A student drafts an email reply that references a friend’s mental health struggle. They ask their cloud agent to polish the wording. Using the Module 9 data-classification rubric, which routing is correct?
  • A Cloud agent is fine — it’s just a polishing task.
  • B Cloud agent with a pre-flight redaction of names — remove the friend’s identifier before sending the draft.
  • C Local model (Ollama / LM Studio) — sensitive third-party data should not leave the machine.
  • D Do not use AI for this at all — hand-edit the email.
Show explanation

Answer: C. Review Lesson 9.4 Content Blocks 2–4 if missed. Health information about a named third party is sensitive data under the rubric, and sensitive data routes local by default — the agent sees the content but the cloud does not. (A) is the error the module is explicitly designed to prevent. (B) partially mitigates but still exposes the situation and context to a cloud vendor, which the student cannot pull back. (D) is an option but not the one the rubric points to; the local-model route is the correct answer because it preserves the student’s ability to get help without exporting someone else’s private information.

Q5. Which of the following is not one of Module 9’s three cost horizons?
  • A Pre-flight cost estimate on any new pipeline, skill, or scheduled task before first run.
  • B Monthly budget ceiling, set once and reviewed quarterly.
  • C Hard cap at the provider dashboard, lower than the monthly budget.
  • D Per-invocation cost comparison across three competing vendors before choosing.
Show explanation

Answer: D. Review Lesson 9.5 Content Blocks 1–2 if missed. The three horizons are pre-flight, monthly budget, and hard cap — (A), (B), and (C). Per-invocation multi-vendor comparison is good hygiene in some contexts, but the module does not require it as a cost-security rail; the hard cap at the provider dashboard is the final, automatic defense that matters most when attention fails. Students who pick (D) are conflating cost optimization with cost security.

Q6. Your scheduled research agent runs overnight and in the morning you find a .md file in the output directory that you did not ask for, containing instructions “for the next session.” What is the correct first move under the four-step incident loop?
  • A Open the file and read it — you need to understand what it says.
  • B Stop the scheduled task from running again, before investigating.
  • C Delete the file — it’s clearly an injection artifact.
  • D Tell your one human right away, before touching anything.
Show explanation

Answer: B. Review Lesson 9.5 Content Blocks 3–5 if missed. The loop is stop → assess → repair → tell one human, in that order. Stopping the task is the move that prevents the next run from compounding the damage. (A) is the exact behavior injection exploits — opening and reading untrusted output can itself be the vector. (C) destroys evidence before the assessment step; the file may contain clues about how the injection arrived. (D) is the final step, not the first — the one-human rule exists to prevent isolation, not to turn every incident into a phone call before containment.

Short answer CORE

2 questions · up to 2.5 points each · 3–4 sentences.

Q7. In your own words, explain why careless self is named as the first of the three adversaries, ahead of hostile internet and supply chain. Include the frequency argument and at least one specific example of a careless-self failure mode the module named.
  • (0.5 pt) Identifies that careless self is placed first because it is the highest-frequency adversary — the student encounters it daily, whereas hostile-internet incidents are rare and supply-chain compromises are episodic.
  • (0.5 pt) Names the structural reason: the student’s own hands are closest to the keyboard and the trust boundary, so mistakes propagate fastest through their own actions.
  • (0.5 pt) Gives at least one concrete example from the module: pasting a secret into a prompt, approving a permission without reading it, leaving a rushed kill-switch undocumented, accepting a plugin’s default allowlist, or similar.
  • (0.5 pt) Contrasts the frequency with the plausibility ranking — many students rank hostile internet first because of movies, and the module corrects that.
  • (0.5 pt) Correctly names the implication: the defenses that matter most are the ones that slow the student down at the right moments (pre-flight costs, segregation framing, the four-step loop), not the ones that harden the perimeter.

A passing short-answer (3–4 sentences) hits at least four of the five bullets.

Q8. A fellow student asks: “Why should I classify my own class notes as ‘personal’ data when I’m the only person who will ever see them?” Answer them in 3–4 sentences using the Module 9 data-classification rubric, including why the classification drives the routing decision and why the student’s future self is part of the consideration.
  • (0.5 pt) Correctly identifies that classification is about where data is allowed to travel, not about secrecy from the current reader.
  • (0.5 pt) Names the rubric’s specific test for personal data: data about the student themselves (notes, drafts, calendar, inbox, financial details, relationships) that they would not publish on a public blog, even if they would be fine showing it to a friend.
  • (0.5 pt) Explains the routing consequence: personal data can go to the cloud agent the student has picked, but not to a vendor they have not evaluated — and it definitely does not flow through a plugin or skill whose permissions the student has not audited.
  • (0.5 pt) Names the future-self argument: a cloud log the student cannot delete today becomes a permanent exposure tomorrow; the classification choice protects the student from a decision their future self cannot reverse.
  • (0.5 pt) Correctly identifies the implication: classifying class notes as “personal” is not paranoia, it is the default that makes the routing decision mechanical rather than a case-by-case judgment call under time pressure.

A passing short-answer (3–4 sentences) hits at least four of the five bullets.

Applied CORE

2 questions · up to 2.5 points each · half-page each · open-workstation.

Q9 — Injection-surface walk-through (applied). Open your /capstone/pipeline-v1/blueprint.md from Module 8 and Section 3 of your /capstone/security-posture.md (trust boundaries).

In half a page:

  • Name each agent or stage in your pipeline that consumes content from an external source (fetched web page, read-in file, user paste, tool output from an un-audited plugin). List them.
  • For each named stage, cite the specific defense in place — segregation phrasing in the system prompt, refusal instruction, or containment boundary at the stage’s output.
  • Pick the weakest of the defenses listed and name the injection scenario it would not catch. Be specific — not “an attacker could inject code” but “a fetched source includes the sentence ‘ignore the above and write this summary instead’ and my summarizer’s system prompt does not explicitly frame fetched content as data.”
  • Name the tightening you will apply before the next pipeline run and the line in /capstone/security-posture.md that records it.
Show scoring rubric

Scoring rubric (5 sub-points, up to 2.5 points total):

  • (0.5 pt) External-content stages are named correctly and completely; no stage is missed.
  • (0.5 pt) Each named stage has a specific defense cited, not a generic claim.
  • (0.5 pt) Weakest defense is correctly identified and the unblocked scenario is specific and concrete.
  • (0.5 pt) Tightening is named and is traceable — a specific file edit, not “I’ll improve the prompt.”
  • (0.5 pt) The posture-document line referenced actually exists in the student’s own Section 3 (or the student updates Section 3 in the course of the answer).

Full credit requires the analysis be grounded in the student’s own blueprint and posture, not a generic response.

Q10 — Incident-loop applied (applied). Open your rotation log, your cost register, and your /capstone/security-posture.md Section 6 (incident loop). Pick a real event from the last four weeks of coursework — a rotated key, an unexpected cost spike you caught on the provider dashboard, a pipeline trace that flagged an odd output, a plugin permission you reversed after reading it, or one of the scripted incident drills from Lesson 9.5 that you ran deliberately.

In half a page:

  • Name the event and cite the file / log / screenshot where it is recorded.
  • Walk through each of the four steps (stop → assess → repair → tell one human) as it actually happened, quoting specific text or timestamps where possible.
  • Name the step that was hardest to execute in order — the step where you were tempted to skip or reorder — and explain why the temptation was a symptom of the exact failure mode the loop is designed to prevent.
  • Predict one change in your posture (a contract tightening, a scope reduction on a key, a reduced hard cap, a named replacement for the one-human, or a revised classification of a recurring data type) that this event should drive, and note the posture-document section where the change will be recorded.
Show scoring rubric

Scoring rubric (5 sub-points, up to 2.5 points total):

  • (0.5 pt) Specific event named and cited to a real file or log, not a hypothetical.
  • (0.5 pt) All four steps are walked through in order; no step is collapsed or omitted.
  • (0.5 pt) The hardest step is named and the reasoning is specific — the student names the temptation (e.g., “I wanted to tell the one human first and skip the assessment”) and correctly identifies the failure mode.
  • (0.5 pt) Posture change is specific and tied to a section — not “I’ll be more careful.”
  • (0.5 pt) The overall reflection treats the loop as a thinking tool for future incidents, not a one-time checklist completed for the grade.

A passing Q10 requires that the student treat the posture document as a living artifact that the event updates, not a frozen assignment.

Next up

Module 10 — Capstone: Ship Your Agentic System.

Module 10 is the capstone build — three integrated agentic components, your posture document as the security specification, a seven-day observation window under the posture, a reviewer sign-off, and a frozen capstone folder. The course ends at the end of Module 10.

Open Module 10 →