User access restriction exam questions

10 Pearson BTEC Digital Information Technology Component 3 exam-style questions on User access restriction (B2 Prevention and management of threats to data), 27 marks in all. Answer them on paper or print them, then open the mark schemes and example answers to see how each is marked.

Name
Class
Suggested time	35 minutes

1State / Give two2 marks

Draycott Archery Club is a club where members practise archery. Staff use the club's computer system to store members' details and payment records.

Give two levels of permitted access the club could set for its staff.

[2 marks]

Mark scheme

Award one mark for each correct level of permitted access, up to a maximum of two marks from:

Read-only/view only
Read/write/read and edit
Full control/full access
Administrator/admin rights
Standard/restricted access
No access/access denied
Access to selected folders/files only

Do not accept passwords, biometrics, locks or two-factor authentication as these are other ways to restrict access, not levels of permitted access

Accept any other appropriate response.

Example answers and how they were marked

Full marks2/2

Read-only access for the office staff and full control for the club manager.

Why: Read-only (1) and full control (1) are both named levels of permitted access.

Some marks1/2

Read/write access for the office staff and a password for each member of staff.

Why: Read/write (1); a password is another way to restrict access, not a level of permitted access, so no second mark.

No marks0/2

A fingerprint scanner on the office door and a lockable cupboard for the computer.

Why: Both are physical access restrictions rather than levels of permitted access, so neither is credited.

2State / Give two2 marks

Laleham Marina is a marina that rents moorings to boat owners. Staff use a computer system to store customer and payment details. Each member of staff has their own username and password.

Give two ways staff could keep their passwords secure.

[2 marks]

Mark scheme

Award one mark for each correct way, up to a maximum of two marks from:

Keep it secret/do not share it with anyone
Do not write it down/do not leave it on a note
Change it regularly/at set intervals
Use a different password for each account/system
Make sure nobody can see them typing it/use masked characters
Tell their manager/IT support straight away if they think someone else knows it
Log out of the system/do not save it on a shared computer

Accept any other appropriate response.

Example answers and how they were marked

Full marks2/2

Staff should keep their password secret and change it every few months.

Why: Keeping it secret (1) and changing it regularly (1) are two separate ways on the mark scheme.

Some marks1/2

Staff should keep their password secret and use the same password for all the systems so it is easy to remember.

Why: Keeping it secret (1); reusing one password everywhere is the opposite of a listed way, so no second mark.

No marks0/2

Staff should write their password on a note stuck to the monitor so they do not forget it.

Why: Writing the password down is the opposite of the mark scheme, so nothing is credited.

3Explain one2 marks

Ellerby Riding School is a horse-riding centre. Its staff use passwords to log in to the booking system.

Explain one reason staff should not share their passwords with each other.

[2 marks]

Mark scheme

Award one mark for the correct reason and one mark for a justification for that reason, up to a maximum of two marks.

Another member of staff could log in using their password/account (1) so their own bookings could be changed or cancelled without them knowing (1)
The password could be passed on to someone outside the school (1) which would let an unauthorised person see customers' contact and payment details (1)
A member of staff who has left may still know the shared password (1) so they could still log in to the booking system when they no longer work there (1)
A shared password is more likely to be written down or seen by someone else (1) which puts the booking records at risk of being changed or deleted (1)
The school cannot tell which member of staff made a change (1) so it is unclear who should be held responsible (1)

Do not accept: 'passwords should be private' on its own

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Example answers and how they were marked

Full marks2/2

If a member of staff shares their password, another person could log in using their account so the school would not know who made a change to a booking.

Why: Point (1): another person could log in using the account; justification (1): the school would not know who made the change.

Some marks1/2

Another member of staff could use the password to log in to the booking system.

Why: Names a reason (1) but gives no justification for why this is a problem.

No marks0/2

Sharing a password makes it stronger because more staff can remember it.

Why: Gives an incorrect reason; sharing a password does not make it stronger and no creditworthy point is made.

4Explain one2 marks

Eastmere Outdoor Centre is an outdoor activity centre. It stores customer booking and payment data. The centre gives each member of staff a different level of access to the booking system.

Explain one benefit of giving staff different levels of access.

[2 marks]

Mark scheme

Award one mark for the correct benefit and one mark for a justification for that benefit, up to a maximum of two marks.

Staff can only open the parts of the system they need for their job (1) so they cannot view or change customer payment details/records outside their role (1)
Junior staff can be blocked from financial records (1) which reduces the chance of fraud or mistakes with payments (1)
Some staff can be given read-only access (1) so they can check bookings without being able to change or delete them (1)
Managers can be given full access (1) so they can correct errors that other staff cannot fix (1)
If one staff account is hacked (1) the attacker can only reach the areas that staff member can use/because the rest of the system is still restricted (1)

Allow: 'so the data is protected/kept safe' as a justification where it is clearly linked to the benefit given

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Example answers and how they were marked

Full marks2/2

Some staff can be given read-only access so they can check bookings but cannot change or delete them by mistake.

Why: Benefit (1): read-only access for some staff; justification (1): they cannot change or delete bookings.

Some marks1/2

Junior staff can be blocked from seeing the financial records.

Why: Gives a valid benefit (1) but does not say why blocking junior staff from financial records helps the centre, so no justification mark.

No marks0/2

Giving every member of staff full access is a benefit because then anyone can help a customer.

Why: Describes giving everyone full access, the opposite of different levels of access, and gives no creditworthy benefit.

5Explain one2 marks

Whitbourne Planetarium is a visitor attraction. It uses a digital control system for its shows. The planetarium wants to restrict staff access to the control system.

Explain one way the planetarium could use biometrics to restrict access.

[2 marks]

Mark scheme

Award one mark for the correct way and one mark for a justification for that way, up to a maximum of two marks.

Fingerprint scan (1) as the system only allows access if it matches the print stored for that member of staff (1)
Facial recognition (1) so the system only unlocks if the face matches the stored image for their account (1)
Iris/retina scan (1) which compares the pattern in the eye with the stored record before allowing access (1)
Voice recognition (1) so access is only given if the voice matches the stored voiceprint (1)
Hand geometry (1) which checks the shape of the hand against the stored profile for that member of staff (1)

Do not accept: 'biometrics' on its own; a benefit of biometrics (e.g. 'it is more secure'/unique to the user) with no way given

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Example answers and how they were marked

Full marks2/2

Staff could scan their fingerprint and the system will only let them in if it matches the fingerprint stored for their account.

Why: Point (1): fingerprint scan; justification (1): access is allowed only when it matches the stored fingerprint.

Some marks1/2

The planetarium could use a fingerprint scanner for staff.

Why: Names a biometric way (1) but does not say how it restricts access.

No marks0/2

Biometrics are unique to each member of staff, so the system is more secure than a password.

Why: Gives a benefit of biometrics and repeats the term in the question, but names no biometric way and does not say how access is restricted, so no mark under the do-not-accept line.

6Describe3 marks

Elmsworth Bakery is a company that bakes bread and cakes and delivers them to local shops. Staff log in to the company's ordering system from home. The company wants to add two-factor authentication to the login process.

Describe how two-factor authentication could be used to restrict access to the ordering system.

[3 marks]

Mark scheme

A description of how two-factor authentication restricts access to a system. To include three from

The staff member logs in with something they know, such as a password/PIN (1)
They must also provide a second, different factor, such as a code sent to their mobile phone/email (something they have) (1)
Or a fingerprint/face scan (something they are) (1)
Both factors must be correct (1) before access to the ordering system is allowed (1)
Even if someone knows the password, the second factor is still needed (1)

Do not accept: entering the same type of authentication twice (eg a password and then another password)

Accept any other appropriate wording/phrasing

Example answers and how they were marked

Full marks3/3

The member of staff types in their password, which is something they know, then a one-time code is sent to their work mobile phone, which is something they have. The ordering system only lets them in if both are entered correctly.

Why: Password as something they know (1), a code sent to their phone as a second, different factor (1), and access allowed only when both are correct (1).

Some marks2/3

The member of staff has to give two different pieces of information, for example their password and a fingerprint.

Why: Password as something they know (1) and a finger scan as a second, different factor (1). It does not say both must be correct before access is allowed, so the third mark is not earned.

No marks0/3

Staff have to type their password in twice, which is called two-factor authentication, so it is much harder for anyone to guess.

Why: The same type of authentication (a password) is used twice, which is not two-factor authentication, so no creditworthy point is made.

7Describe3 marks

Millgate Museum is a museum that displays exhibits about local history. The museum keeps its visitor records and archive images on a server in its office.

Describe how physical locks can help protect the museum's systems and data.

[3 marks]

Mark scheme

A description of how physical locks protect the museum's systems and data. To include three from

A lock on the door of the room where the server/systems are kept
Only staff who have the key/key card can get into the room
Lockable cabinets/cable locks/device locks to secure laptops and tablets
The equipment cannot be removed or stolen
Electronic key card locks that only open for the cards that have been programmed
Locks act as a deterrent/put off someone who is thinking of breaking in

Allow mix and match if it makes sense

Do not accept: software measures such as passwords

Accept any other appropriate response.

Example answers and how they were marked

Full marks3/3

The server is kept in a room with a lock on the door. Only staff who have the key can get into the room. Having the lock also puts off anyone who is thinking of breaking in.

Why: A lock on the door of the server room, only staff with the key getting in, and the deterrent effect: three separate creditworthy points.

Some marks2/3

A lock on the door of the office where the server is kept means that only staff with a key can get in.

Why: Two creditworthy points: a lock on the door of the room with the server, and only staff with the key getting in. No third point is given.

No marks0/3

The museum should set a password on the server so hackers cannot open the archive images.

Why: A password is a software measure, not a physical lock, so it gains nothing; the mark scheme says not to accept software measures such as passwords.

8Describe3 marks

Winterbourne Riding School is a riding school that teaches people to ride horses. Staff use the school's booking system to arrange lessons for customers.

Describe how passwords can be used to restrict access to the booking system.

[3 marks]

Mark scheme

A description of how passwords restrict access to the booking system. To include three from

Each member of staff is given their own username and password (1) which the booking system checks before it allows access (1) so only staff who know the password can log in/use the booking system (1)
Staff should use a strong password, with a mixture of letters, numbers and symbols/a minimum length (1) so it is difficult for other people to guess/crack (1)
Staff should change their passwords regularly (1) and not share them with anyone else (1) so nobody else can use their account to access the booking system (1)

Do not accept: passwords stopping viruses/malware

Accept any other appropriate wording/phrasing

Example answers and how they were marked

Full marks3/3

Each member of staff is given their own username and password. The booking system checks the password before it lets them in, so only staff who know the password can use it.

Why: Individual username and password (1), the system checking the password before allowing access (1), and limiting use to staff who know it (1).

Some marks1/3

The riding school should make staff choose strong passwords with a mixture of letters, numbers and symbols.

Why: Gives the first step of the strong-password chain (1) but does not say how a password restricts access to the booking system.

No marks0/3

Passwords stop viruses from getting into the booking system and deleting the lesson details.

Why: This is about malware, not restricting access with a password, so no creditworthy point is made.

9Explain two4 marks

Ravensgill Ski Centre is a ski slope that also hires out equipment. The centre stores customer booking and payment details on its computer system. The manager is considering using biometrics to improve security.

Explain two ways the centre could use biometrics to restrict access to its systems.

[4 marks]

Mark scheme

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

Using a fingerprint/finger scanner (1) so only staff whose fingerprint is stored on the system can log in (1)
Using facial recognition/a face scan (1) so the system only lets a member of staff log in if it recognises their face (1)
Using an iris/retina (eye) scan (1) so the system confirms who the member of staff is before it will let them log in (1)
Using voice recognition/a voice scan (1) so a member of staff is identified by their voice before the system lets them log in (1)
Using hand geometry/a hand scanner (1) so the system only allows staff whose hand is stored on it to log in (1)

Do not accept drawbacks or benefits of biometrics, as these do not say how access is restricted

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Example answers and how they were marked

Full marks4/4

Staff could use a fingerprint scanner so only staff whose fingerprints are stored on the system can log in. The centre could also use facial recognition so a member of staff is only allowed to log in if the system recognises their face.

Why: Two different ways identified (fingerprint scanner, facial recognition), each with a justification of how it restricts access (only stored staff, only a recognised face).

Some marks3/4

The centre could use a fingerprint scanner so only staff whose fingerprints are stored can log in. It could also use an iris scan.

Why: First way identified (1) and justified (1); the iris scan is a second correct way (1) but has no justification, so the fourth mark is not awarded.

No marks0/4

The scanners are expensive to set up because the centre would need to buy special equipment.

Why: This gives a drawback of biometrics, not a way of using biometrics to restrict access, so it is not creditworthy.

10Explain two4 marks

Rosemarket Botanical Gardens is a visitor attraction. Its staff use the gardens' computer system to record ticket sales and customer details. The manager wants staff to use two-factor authentication when they log in.

Explain two ways the gardens could use two-factor authentication to restrict access to its systems.

[4 marks]

Mark scheme

Award one mark for each correct way and one mark for a justification of each way, up to a maximum of four marks.

A password and a (one-time/temporary) code sent to the staff member's mobile phone (1) so a hacker who knows the password still cannot log in without the code/the phone (1)
A password and a code from an authenticator app (1) so a hacker would need the staff member's device as well as their password (1)
A password and a fingerprint scan (1) as a hacker would need the staff member's fingerprint as well as their password (1)
A key card/key fob and a PIN (1) as the member of staff must have the card and know the PIN to get in (1)
A password and the answer to a security question (1) so a hacker would need to know the staff member's personal information as well as the password (1)
A password and a code sent to the staff member's email address (1) so a hacker would also need access to their email account to log in (1)

Do not accept: two passwords, as this is not two-factor authentication; a code sent with no method/destination stated on its own.

Allow a username and password as the first factor.

Allow mix and match if it makes sense

Accept any other appropriate wording/phrasing

Example answers and how they were marked

Full marks4/4

A member of staff could enter their password and then a code is sent to their mobile phone so someone who has stolen the password still cannot log in without the phone. The gardens could also make staff scan their fingerprint after they have entered their password because a hacker cannot copy the member of staff's fingerprint.

Why: Two different ways identified (password plus code to mobile phone, password plus fingerprint) and each justified by explaining why a hacker still cannot get in.

Some marks3/4

Staff could use their password and a fingerprint scan because only their fingerprint will be recognised. The gardens could also give staff a key fob and a PIN.

Why: First way identified (1) and justified (1); the key fob and PIN is a second correct way (1) but no justification is given, so the fourth mark is not awarded.

No marks0/4

Staff would use two passwords so that a hacker would have to guess both of them.

Why: Two passwords are both something the user knows, so this is not two-factor authentication; no creditworthy point is made.

Revise User access restriction first

Keep practising User access restriction

More exam questions on B2 Prevention and management of threats to data