4 of 13
Attack lab
Place the check
Each scenario has two parts. The setup is what this task is allowed to do. The attack is text or a change an attacker adds. You choose the control that stops the effect. A filter on the wording is usually the wrong answer, because the attacker can rephrase. The stop has to sit on the action.
Scenario 01 records this step. The other seven are the same decision, for practice. Use the rule from the first lesson: untrusted text cannot grant a read or a send. The architecture lesson names the component that enforces that rule.