MskProdComputing
Back to the topic

The mark scheme starts on a new page, so you can print pages one and two for a student and keep the last page yourself. Everything prints in black on white whichever theme you are using.

AQA GCSE CS · 3.6

Cyber Security

Section A: 10 multiple choice questions, 10 marks. Section B: 4 written questions, 15 marks. Total 25 marks.

Name

Class

Date

Mark  / 25

Section A

Circle the letter of the correct answer. One mark each.

  1. 1A user receives an email that looks like it is from their bank, asking them to confirm their login details. What is this?1
    1. APharming
    2. BShouldering
    3. CPhishing
    4. DBlagging
  2. 2Someone telephones an employee pretending to be from the IT department and asks for their password. What is this?1
    1. AA trojan
    2. BPhishing
    3. CPharming
    4. DBlagging
  3. 3What distinguishes a worm from a virus?1
    1. AA worm only affects mobile phones
    2. BA worm spreads across a network by itself without user action
    3. CA worm cannot spread between computers
    4. DA worm encrypts files and demands payment
  4. 4What does ransomware do?1
    1. ARedirects a user to a fake website
    2. BEncrypts the victim's files and demands payment for the key
    3. CPretends to be legitimate software
    4. DRecords keystrokes and sends them to an attacker
  5. 5Why does encryption help even if data is stolen?1
    1. AIt alerts the owner that data has been taken
    2. BIt deletes the data automatically
    3. CThe stolen data cannot be read without the key
    4. DIt prevents the data being copied
  6. 6What is the purpose of user access levels?1
    1. ATo limit what each user can see and do, so a compromised account exposes less
    2. BTo encrypt files automatically
    3. CTo speed up logging in
    4. DTo detect malware on a network
  7. 7What makes penetration testing legal when the same actions would otherwise be a crime?1
    1. AIt does not access any real data
    2. BIt is carried out with the owner's authorisation
    3. CIt only tests known weaknesses
    4. DIt is done by an employee
  8. 8Why is unpatched software a serious weakness?1
    1. AAttacks commonly exploit weaknesses that were fixed in updates the victim never installed
    2. BUnpatched software cannot use a firewall
    3. COlder software runs more slowly
    4. DIt uses more storage space
  9. 9What is the main purpose of a CAPTCHA?1
    1. ATo scan an uploaded file for malware
    2. BTo check an email address is genuine
    3. CTo encrypt a password before it is sent
    4. DTo distinguish a human user from an automated script
  10. 10Why is a firewall not sufficient protection on its own?1
    1. AIt cannot inspect outgoing traffic
    2. BIt slows the network to an unusable speed
    3. CIt cannot stop threats that do not arrive over the network, such as malware on a USB stick
    4. DIt only works on wireless networks

Section B

Answer in the space provided. The number of marks tells you how many separate points to make.

  1. 1StateState what is meant by social engineering.2
  2. 2DescribeDescribe two forms of social engineering.4
  3. 3ExplainExplain why keeping software up to date is an important cyber security measure.3
  4. 4RecommendA small business stores customer records on laptops that staff take home. Recommend three security measures the business should take, justifying each.6

Mark scheme

Section A

1C2D3B4B5C6A7B8A9D10C

Section B

1 State what is meant by social engineering. 2

One mark for each of the following, to a maximum of 2.

  • Manipulating or tricking people rather than attacking technology
  • In order to obtain information or access

Model answer. Social engineering means manipulating people into giving away confidential information or access, rather than attacking the technology directly. It works because it bypasses technical protections entirely.

2 Describe two forms of social engineering. 4

One mark for each of the following, to a maximum of 4.

  • Phishing, sending a message that appears to come from a legitimate organisation
  • The recipient is tricked into revealing details or clicking a malicious link
  • Blagging, inventing a scenario to persuade someone to hand over information
  • Shouldering, watching someone enter a password or PIN

Model answer. Phishing is sending a message, usually an email or text, that appears to come from a legitimate organisation such as a bank or a school. The message creates a reason to act quickly and directs the recipient to a fake site or asks them to reply with their details, so that the attacker obtains their credentials. Blagging is different in that it is targeted and interactive: the attacker invents a plausible scenario, for example telephoning an employee while pretending to be from the IT department and claiming to need their password to fix an urgent fault, and relies on the victim wanting to be helpful and not wanting to challenge someone who sounds authoritative.

3 Explain why keeping software up to date is an important cyber security measure. 3

One mark for each of the following, to a maximum of 3.

  • Updates fix known weaknesses in the software
  • Those weaknesses become public knowledge once a fix is released
  • So unpatched systems are easier targets, and most successful attacks exploit weaknesses that were already fixed

Model answer. Software updates exist largely to close security weaknesses that have been discovered since the software was released. Once an update is published, the existence and often the details of the weakness it fixes become public, so attackers know precisely what to look for on systems that have not applied it. That makes an unpatched system a considerably easier target than it was before the fix existed. The great majority of successful attacks do not use previously unknown flaws at all: they exploit weaknesses for which a fix had been available for months, which is why applying updates promptly, or setting them to install automatically, is one of the most effective measures available.

4 A small business stores customer records on laptops that staff take home. Recommend three security measures the business should take, justifying each. 6

One mark for each of the following, to a maximum of 6.

  • Encrypt the data on the laptops
  • So that if a laptop is lost or stolen the records cannot be read
  • Use strong passwords or biometric login on each laptop
  • So that an unauthorised person cannot simply switch the laptop on and use it
  • Use user access levels so each member of staff sees only what their role needs
  • Keep regular backups, or keep software updated, and justify it

Model answer. The first measure is to encrypt the data held on each laptop. A laptop taken home can be lost or stolen, and physical possession would otherwise give an attacker the entire customer database. Encryption does not prevent the theft, but it makes the stolen copy unreadable without the key, which turns a serious data breach into the loss of a piece of hardware. The second is strong authentication on each machine, either a long password meeting complexity rules or a biometric login. That stops somebody who picks the laptop up from simply switching it on and reading whatever is open, and it should be combined with a limit on failed attempts so the password cannot be guessed repeatedly. The third is user access levels, so that each member of staff has access only to the records their role actually requires. That limits the damage a single compromised account can do, and it also protects against honest mistakes. Alongside those, the business should keep regular backups held separately and ensure operating system and application updates install automatically, since backups are the only reliable defence against ransomware and updates close the weaknesses most attacks rely on.