Malware Exam Questions

• C Locks files and demands payment (1)
• The only correct answer is C. The correct answer is locks files and demands payment. Accept encrypts files and asks for a ransom / locks files until a payment is made.
• A is not correct because copying itself into other files is what a virus does
• B is not correct because hiding inside a useful program is what a Trojan does
• D is not correct because recording every key press made is what a keylogger does

• A It cannot detect newer malware (1)
• The only correct answer is A. The correct answer is it cannot detect newer malware.
• B is not correct because compatibility with the operating system is not a technical vulnerability
• C is not correct because unpatched software is a separate technical vulnerability, not a fault in the anti-malware
• D is not correct because a firewall is a separate network protection tool and does not scan files for malware

• A Manipulating people into revealing information (1)
• The only correct answer is A. The correct answer is manipulating people into revealing information; accept equivalent wording such as tricking people into giving data or bypassing security.
• B is not correct because comparing files with known malware is signature-based scanning by anti-malware
• C is not correct because locking files until a payment is made is what ransomware does
• D is not correct because attaching malicious code to other programs is what a virus does

• C Backup and recovery (1)
• The only correct answer is C. The correct answer is backup and recovery.
• A is not correct because an acceptable use policy sets rules for how systems should be used
• B is not correct because anti-malware detects and prevents malware but does not restore files
• D is not correct because encryption makes data unreadable and does not restore files

Award one mark for any of the following:

• Quarantine the file (1)
• Isolate the file (1)
• Delete/remove the file (1)
• Repair/clean the file (1)

Do not accept scan/check the file

Do not accept block/prevent/stop the file from running

Do not accept remove the virus from the system

Award one mark for any of the following up to a maximum of two marks:

• Software/a program (1)
• Designed/intended to cause harm/damage (to a computer system or its data) (1)
• Designed/intended to gain unauthorised access to a system or its data (1)

Award a maximum of one mark for the purpose: either harm/damage or unauthorised access, not both.

Allow 'harmful program/software' for both marks (software and harm/damage).

Allow 'malicious' as equivalent to intended to cause harm/damage, so 'malicious software' earns both marks.

Do not accept 'bad software' or a restatement of malware, as no purpose is given.

Do not accept a named type of malware alone (e.g. virus, worm, Trojan); this is an example of malware, not a definition.

Do not accept 'hacking' or 'a threat' alone; neither states a harmful purpose of software.

Do not accept 'a program that spreads' on its own; spreading is not the same as causing harm or gaining unauthorised access.

Award one mark for any of the following up to a maximum of two marks:

• Unpatched/not updated software/operating system (missing security updates/patches) (1)
• Out-of-date anti-malware/anti-virus (virus signatures/definitions not updated) (1)

Do not accept social engineering or phishing.

Award up to two marks for a linked description such as:

• Encrypts the files (1) so the user cannot open/read the data (1)
• Locks the files/data (1) so it can only be unlocked using a decryption key/code held by the attacker (1)
• Encrypts the files (1) so the data can only be recovered from a backup or by paying the ransom (1)

Allow 'it encrypts the files' on its own as the first point (1). The second mark needs a development of what this does to the data.

Do not award 'locks the computer'/'stops you using it' on its own, as this does not say what happens to the data.

Do not award 'it deletes the files' on its own, as this does not describe how the data is held to ransom.

Do not accept descriptions of other types of malware, e.g. a Trojan or a keylogger.

Award up to two marks for a linked description such as:

• The Trojan is hidden inside/disguised as a program/file the user wants/downloads (1) so the user installs/runs it believing it is legitimate/safe (1)
• It creates a backdoor (1) which the hacker/attacker uses to access/control the computer/device remotely (1)
• It downloads/installs further malware (1) without the user knowing (1)

A disguise point on its own, e.g. 'it pretends to be a useful program', earns one mark (the first point); the second mark needs a linked development of how this is used to gain access.

Do not award a mark for saying only that the user installs/downloads/runs it, with no point about it being disguised as something the user wants.

Do not accept descriptions of other types of malware, e.g. a worm copying itself and spreading without user action, a virus attaching itself to files, a keylogger recording keystrokes.

Do not accept responses about spyware/adware or generic statements such as 'it damages the computer', as these do not describe how the Trojan is used to gain access.

Allow 'hacker/attacker' and 'computer/device' as alternatives throughout.

Award up to two marks for a linked description such as:

• Unpatched software still contains a known vulnerability/flaw/security hole (1) because the fix/update for it has not been installed (1)
• A hacker exploits the known vulnerability (1) to gain unauthorised access to the system/data (1)
• A hacker attacks the known vulnerability (1) to install malware/take control of the computer (1)

Accept 'bug' for vulnerability/flaw.

Do not accept answers about guessing passwords, phishing emails or social engineering, as these do not exploit unpatched software.

Do not award 'the software is old/out of date' on its own, without reference to the vulnerability it still contains.

Award up to two marks for a linked description such as:

• Out-of-date anti-malware does not have the latest virus definitions/signatures/detection rules (1) so new malware is not recognised/detected (1)
• Malware released after the last update does not match the old detection rules/signatures (1) so it is not blocked/quarantined and is allowed to run (1)
• The hacker sends malware that the old version cannot identify (1) to get it onto the system without it being stopped (1)

Accept virus definitions/detection rules/patterns/database for signatures.

Do not award a mark for stating that the anti-malware is old or out of date without saying that the latest virus definitions/detection rules are missing.

Do not accept 'it has not been updated'/'it does not have the latest updates' on its own: the missing virus definitions/detection rules must be stated for the first mark, and the malware not being detected for the second mark.

Do not accept answers about a firewall being switched off or no anti-malware being installed, as these are not out-of-date anti-malware.

Award up to two marks for a linked explanation such as:

• Ransomware encrypts the user's files (1) so the user cannot open/read them without the decryption key (1)
• Ransomware locks the files/data (1) so the user cannot open/use them until a ransom is paid (1)
• Ransomware changes the files into an unreadable form (1) so the user needs the attacker's key to restore access to them (1)
• Ransomware stops the files from opening (1) because their contents have been scrambled/encrypted by the malware (1)

For both marks, the expansion must follow/associate with the statement.

The point must be about the user's files/data being locked, encrypted or made inaccessible; locking the whole computer on its own is not enough.

Do not accept 'it asks for money/a ransom' on its own without saying the files/data are locked/encrypted/inaccessible.

Do not accept 'it deletes the files' as the reason access is stopped.

Do not accept restatement of the question as the point, e.g. 'the user cannot access their files', without saying why.

Do not accept 'the computer is infected' or 'it is a virus' as the point or the reason.

Award up to two marks for a linked explanation such as:

• The Trojan is disguised/hidden inside a useful/legitimate program/game/file (1) so the user installs/runs it and its hidden code gives the hacker access/control (1)
• The Trojan contains hidden malicious code (1) which opens a backdoor (into the computer) for the hacker (1)
• The Trojan runs (in the background) without the user knowing (1) so the hacker can then take control of the computer/take the user's data (1)
• (Once installed) the Trojan listens for/accepts commands from the hacker (1) so the hacker can operate the computer remotely (1)

For both marks, the expansion must follow/associate with the statement.

Allow 'backdoor'/'remote access'/'remote access tool' for the way in that the Trojan gives the hacker.

Ignore wording that names the Trojan as the hacker (e.g. 'the Trojan controls the computer'/'the Trojan takes control'); the credit for the hacker gaining access/control must show how this happens.

Do not accept 'it copies/replicates itself' as a way a Trojan gives a hacker access; this describes a virus/worm.

Do not accept 'it steals data' or 'it damages/deletes files' on its own without a link to how this gives the hacker access/control.

Do not award a mark for a vague statement such as 'the hacker can get in' without saying how the Trojan allows this.

Award up to two marks for a linked explanation such as:

• The anti-malware does not have the latest signatures/definitions (1) so it cannot recognise/detect new malware (1)
• The signature database/definitions are out of date (1) so malware written/changed since the last update is not detected (1)
• The software only checks files against older/known signatures (1) so files containing new malware are not flagged/quarantined (1)
• New malware has not been added to the signature list (1) so it can run/install on the computer without being stopped (1)

For both marks, the expansion must follow/associate with the statement.

Accept signatures/definitions (virus or malware definitions) and database/list for signatures.

The first mark can be awarded for saying the signatures/definitions are out of date/not updated on its own; the second mark needs a linked effect on detection such as not recognising new malware.

Do not award the second mark for repeating that the anti-malware is out of date without saying what this means for detection.

Do not accept 'the computer is old' or 'the anti-malware is slow' without linking to missing/out-of-date signatures and detection.

Do not accept 'there is no anti-malware installed' because the question says the anti-malware is out of date.

Award up to two marks for a linked explanation such as:

• The malware code in the file cannot run/execute (1) so it cannot damage/delete/corrupt files on the computer (1)
• The malware cannot spread to other files/computers (1) because the infected file is isolated from the rest of the system (1)
• Other programs and users cannot open/run the infected file (1) so the malware cannot be triggered by accident (1)
• The file is kept rather than deleted (1) so it can be checked and restored later if it is not really infected (1)

For both marks, the expansion must follow/associate with the statement.

A benefit stated on its own, with no linked reason, can earn (1) only.

Do not award a mark for a description of what quarantine is, such as 'the file is put in a quarantine folder' or 'the file is kept in quarantine', as this gives no benefit and no reason.

Do not accept 'it deletes/removes the infected file/malware' because quarantine keeps the file; deleting is a different action.

Do not accept 'it stops all malware' or 'the file is safe'/'the computer is safe' without saying what is being protected from the malware.

Do not accept 'the computer runs faster' because quarantine is not a performance tool.

Award one mark for any of the following up to a maximum of three marks:

• Virus (1)
• Worm (1)
• Trojan/Trojan horse (1)
• Ransomware (1)
• Key logger/keylogger (1)

Allow any other genuine type of malware, e.g. spyware, adware, rootkit.

Do not accept malware (the term in the question).

Do not accept phishing/hacking/social engineering (these are not malware).

Do not accept firewall/anti-malware/encryption (these are security methods, not malware).

Indicative content

Unpatched software

• The garage's operating system is an old version, so security weaknesses that the developer has since fixed are still present in the system.
• A hacker can find out about one of these known weaknesses and use malware written to exploit it.
• The malware could use the weakness to run its own code on the booking computer without the staff knowing.
• Once it is running, the malware could copy itself to the other computers on the garage's network.
• Installing the updates would close the known weakness, so malware written to exploit it would no longer work.

Out-of-date anti-malware

• Anti-malware that has not been updated for a year will not hold the latest signatures of known malware.
• It will not recognise malware written since the last update, so an infected file is not detected or quarantined.
• New malware may be written to avoid the detection methods that the old software uses.
• With no up-to-date detection, malware can stay on the system and keep running, so any damage it does is not stopped.
• Updating the definitions regularly would let the anti-malware detect and quarantine the newer malware.

The possible effects on the garage

• Malware that gets in through the unpatched software could delete or change customer records, so MOT bookings are lost.
• Ransomware that is not detected by the out-of-date anti-malware could encrypt the booking records, so the garage cannot book MOT tests and loses money until a backup is restored.
• Malware that exploits the unpatched software could spread from the booking computer to other computers on the garage's network.
• With the booking system out of action, the garage cannot carry out MOT tests and may lose customers to other garages.
• The garage may have to use its backup and recovery procedures to get the customer records back.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Additional guidance

Level 3 needs both vulnerabilities explained with the effects linked to the vulnerability that allowed the malware in; an answer that develops only one vulnerability, or adds effects without linking them, is limited to Level 2, and effects stated with no link to a vulnerability or to malware getting onto the system can only support Level 1.

Do not credit social engineering as a technical vulnerability, generic statements such as 'hackers can access data' unless linked to how a vulnerability allows it, or claims that unpatched software is safe / that out-of-date anti-malware is good because it does not slow the computer.

Indicative content

Anti-malware software

• Anti-malware should be installed on every computer, including the staff laptops, and kept up to date so that it can detect the newest ransomware.
• It scans a file and compares it with a database of known malware signatures, and quarantines the file if the code matches, so the malicious code cannot run.
• Because the infected laptop uses the same shared network drive as the lesson plans, quarantining the infected file stops the ransomware spreading to the shared files.
• Behaviour-based detection can spot a program that starts encrypting many files quickly, which is how ransomware behaves, and stop it before the shared drive is encrypted.
• Anti-malware can scan files before they are opened, including email attachments and files on USB sticks, so malware is blocked at the point it enters the school's systems.
• Once a file is quarantined or deleted, the pupils' records cannot be damaged or held to ransom by that file.

Backup and recovery procedures

• The school should take regular backups of pupils' records and lesson plans so that recent work can be recovered.
• Backups should be kept offline or off-site, or in the cloud with controlled access, so that ransomware on the school network cannot encrypt the backup copies as well.
• A recovery procedure should set out how a backup is restored, who does it and how quickly, so the school can carry on working with little disruption.
• The school should test that files can be restored, otherwise it may find the backup is incomplete or corrupted at the moment it is needed.
• If ransomware does encrypt the files, the school can restore the last good copy instead of paying the ransom.
• Encrypting the backup means a stolen copy cannot be read, but the backup must still be stored separately from the network.

Acceptable use policies for staff

• The policy tells staff what they must not do, such as opening unexpected email attachments or installing software they have downloaded, which is how ransomware often gets in.
• Staff should only install approved software, because ransomware is often hidden inside a game or a free program that a user installs.
• The policy should cover USB sticks, for example scanning them or banning unauthorised ones, because malware can be carried in on a stick from home.
• Staff should report a suspicious email or a computer that is behaving strangely straight away, so the infected laptop can be disconnected from the network before the malware spreads.
• An acceptable use policy lowers the chance of malware getting in, but on its own it cannot detect or remove malware that is already installed.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Additional guidance

Level 3 responses must cover both anti-malware and backup and recovery, with reasoning that links each method to the ransomware threat.

Accept backups kept off-site, offline or in the cloud, and encrypted backups. Do not accept a backup kept on the same computer, or a firewall, as protection from malware.