Network Security Risks Exam Questions

• B An ethical hacker (1)
• The only correct answer is B. The correct answer is ethical hacker.
• A is not correct because a black hat hacker breaks into a network without the owner's permission
• C is not correct because a malicious insider misuses the access they already have in order to cause harm
• D is not correct because a virus writer creates malware to infect systems rather than testing a network with permission

• B Reports the weakness to the company so it can be fixed (1)
• The only correct answer is B. The correct answer is reporting the weakness to the company so it can be fixed.
• A is not correct because an ethical hacker informs the company and helps it to fix the weakness rather than fixing it without telling the company
• C is not correct because selling a weakness to another company is criminal, not ethical hacking
• D is not correct because using a weakness to access data is what a black hat hacker does

• C Penetration testing (1)
• The only correct answer is C. The correct answer is penetration testing.
• A is not correct because access control limits what users can access
• B is not correct because a firewall filters network traffic
• D is not correct because physical security protects hardware from theft or damage

• C To keep customers' personal data private (1)
• The only correct answer is C. The correct answer is keeping customers' personal data private.
• A is not correct because shared passwords mean users cannot be identified, which reduces security
• B is not correct because the number of users on a network is not affected by how secure it is
• D is not correct because the amount of storage needed is not affected by network security

Award one mark for any of the following up to a maximum of two marks:

• To prevent unauthorised access to data/the network (1)
• To prevent data from being stolen (1)
• To prevent data from being lost/deleted/corrupted/damaged/altered (1)
• To keep the network/systems running and available to users (1)
• To prevent malware/viruses being installed on the network/systems (1)

Do not accept a method of protection given on its own, e.g. firewalls/passwords/anti-malware; a reason must be given.

Do not accept vague answers such as 'to keep data safe', 'to keep the network secure' or 'to stop hackers' on their own, with no reason given.

Do not award two marks for two versions of the same idea, e.g. 'to stop hackers' and 'to prevent unauthorised access'.

Award one mark for any of the following up to a maximum of two marks:

• To identify possible entry points into the system/network (1)
• To identify the targets of potential attacks (1)
• To test whether existing security controls/protections work (1)
• To report the findings so that weaknesses can be fixed (1)

Accept 'to simulate an attack on the organisation's own network' only when it also states that this is done to find weaknesses, e.g. 'simulate an attack to find weaknesses' (1)

Do not accept 'to simulate an attack' on its own, as it does not say what the testing is for

Do not accept 'to hack the network', as this repeats the method rather than giving an aim

Do not accept 'to steal data' or 'to gain unauthorised access', as these are the aims of an attacker

Award one mark for any of the following up to a maximum of two marks:

• Using hacking techniques to (attempt to) access a computer system/data (1)
• With the permission/authorisation of the owner/organisation (1)
• To find/report security weaknesses/vulnerabilities (1)

Allow 'to test the security of a system' for the third bullet.

Allow 'white hat hacking' as a whole answer only if permission and finding/reporting weaknesses are both stated.

Do not accept 'hacking for good' on its own.

Do not accept gaining unauthorised/illegal access (black-hat hacking), which does not earn the hacking techniques mark.

Award one mark for any of the following up to a maximum of two marks:

• White-box testers are given usernames/passwords/credentials; black-box testers are not given credentials (1)
• White-box testers have knowledge of the network layout/code/system; black-box testers have no inside knowledge (1)
• White-box testing simulates an insider attack; black-box testing simulates an external attack (1)
• White-box testing tests what an employee with access can reach (internal access rights/policies); black-box testing tests what an attacker with no inside knowledge can reach (1)

Allow outside/outsider attacker for external attack.

Award the mark only where a difference is given as a contrast that names both white-box and black-box testing, e.g. 'white-box testers are given credentials, black-box testers are not'.

Do not accept a description of only one testing type, e.g. 'white-box testers know the system' with no comparison.

Do not accept physical location, e.g. inside/outside the building, as the difference.

Award up to two marks for a linked description such as:

• Protects sensitive/personal data (1) from being accessed/stolen by unauthorised users (1)
• Prevents unauthorised access to the network/systems (1) so only permitted users can use the organisation's data (1)
• Reduces the risk of malware/network attacks (1) which could damage systems or files (1)
• Data is not lost (1) so the organisation can continue to operate (1)
• Maintains the organisation's reputation (1) so customers trust it with their data (1)

A valid point on its own earns one mark; the second mark requires a linked development.

Allow 'prevents unauthorised access to the network' as a valid point (1) even if the consequence for the organisation is not stated.

Do not accept responses that only describe a method of protection (e.g. using a firewall) without saying why network security is important.

Do not accept 'keeps the network safe' or 'stops hackers' on its own.

Award up to two marks for a linked description such as:

• Testers try to gain access to the network (1) as an external attacker would (1)
• Testers are not given credentials/usernames/passwords (1) so they must find a way into the network themselves (1)
• Testers test the external security defences (1) to find vulnerabilities that an outside attacker could exploit (1)
• Testers gather information about the network from public/external sources (1) to identify possible entry points (1)

Do not award credit for answers that only repeat that testers have no inside knowledge, or that describe penetration testing in general (e.g. 'trying to find weaknesses'), without saying how the test is carried out.

Do not accept responses that describe white box testing (e.g. testers are given passwords/network diagrams) or ethical hacking in general (e.g. 'hackers try to break in') without the no-inside-knowledge feature.

Accept 'black box' as the name for this type of test; the name alone is not creditworthy.

Award up to two marks for a linked description such as:

• Is given permission/authorisation by the owner (of the system/network) (1) to test/attack the system to find vulnerabilities/weaknesses (1)
• Uses the same techniques as a malicious/criminal hacker (1) but does so with the owner's permission and reports the weaknesses/vulnerabilities found (1)
• Finds vulnerabilities/weaknesses in the system (1) with the permission/authorisation of the owner so that they can be fixed (1)

A statement that the hacker has the permission/authorisation of the owner of the system on its own earns (1).

The second mark needs a development that adds something beyond the permission, i.e. what the hacker does (tests/attacks the system) or why (to find vulnerabilities/weaknesses, or to report/fix them). Do not award a second mark for repeating the permission.

Allow 'the organisation' / 'the company' / 'the network owner' as the owner.

Do not accept responses that only say the hacker is allowed/permitted to hack, with no reference to permission/authorisation from the owner and no development.

Do not accept responses that describe malicious/illegal hacking (e.g. gaining unauthorised access to steal data) or black hat hacking.

Do not accept a generic description of penetration testing with no reference to permission/authorisation (e.g. testing a system to find its weaknesses).

Do not accept the term 'ethical hacking' repeated with no description, or a description of white box/black box penetration testing on its own.

Award up to two marks for a linked description such as:

• Vulnerabilities/weaknesses in the network are found (1) before attackers are able to exploit them (1)
• The existing security measures are tested (1) to check that they are effective (1)
• A report of the findings is produced (1) so the organisation knows which weaknesses to fix first (1)
• The testing shows where the network can be accessed/possible entry points (1) so these can be protected (1)

A benefit stated on its own, with no development, can be awarded one mark.

Accept benefits that describe the testing process where they lead to an outcome, e.g. 'it attacks the network to find holes that can then be fixed'.

Do not accept answers that only describe how penetration testing is carried out, with no benefit.

Do not accept 'it stops hackers' / 'it finds hackers' / 'it makes the network secure' unless a linked development is given.

Do not accept benefits of other security measures, such as a firewall or anti-malware software, that are not benefits of penetration testing.

Award up to two marks for a linked explanation such as:

• Patient records are kept private/confidential (1) because only authorised staff are allowed to access them (1)
• Patient records stay accurate/complete (1) because unauthorised users are prevented from changing/deleting them (1)
• Hackers are kept out of the network (1) because a firewall/access control blocks unauthorised access to the patient records (1)
• Patient records are available when staff need them (1) because the network is protected from attacks that could stop it working (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept 'to keep data safe', 'to stop hackers' or 'it stops viruses' on its own, without saying what is protected or how.

Accept 'patient data/records/details' as the same point.

Do not award credit for an answer that repeats the question, e.g. 'network security is important so the network is secure'.

Award up to two marks for a linked explanation such as:

• Customer details/data are kept safe/secure (1) because weaknesses are found and fixed before attackers can exploit them (1)
• The company finds out how an attacker could get into the network (1) so it can close/block those entry points (1)
• The company can prioritise which weaknesses to fix (1) because the test produces a report of the findings (1)
• The company finds out whether its existing security methods work (1) because the testers try to get past them (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept 'to make the network secure' or 'it finds vulnerabilities' on its own without a linked action/benefit, e.g. that the weaknesses are then fixed.

Do not accept 'it stops hackers' on its own.

Award up to two marks for a linked explanation such as:

• The tester has the bank's permission to access the system (1) so the testing is not an unauthorised/illegal act (1)
• The bank agrees the scope/limits of the test (1) so important systems are not damaged/put at risk (1)
• The bank knows when the test is happening (1) so it does not mistake it for a real cyber attack (1)

For both marks, the expansion must follow/associate with the statement.

A statement on its own (e.g. 'the bank knows when testing happens') earns the first mark only; the second mark requires the linked reason.

Allow 'so it is legal' / 'so it is not a crime' where the answer makes clear that the access is authorised/permitted by the bank.

Allow 'without permission it would be a crime/illegal' as the linked reason for an authorisation point.

Do not accept 'so the hacker does not get caught' as this is not the purpose of permission.

Do not accept 'hacking is illegal' on its own without linking it to the need for the bank's permission.

Award up to two marks for a linked explanation such as:

• Testers have no inside knowledge of the network (1) so they attack it in the same way as an external hacker (1)
• Testers try to gain access without login details (1) so a weakness they find is one an outsider could also exploit (1)
• Testers deliberately try to break in (1) so weaknesses are found and fixed before a malicious hacker exploits them (1)
• Testers do not know the network layout (1) so they test for weaknesses that are visible to an outsider (1)
• Testers act as ethical hackers with no inside knowledge (1) so they find weaknesses in the same way as an external attacker (1)

For both marks, the expansion must follow/associate with the statement.

A credited point without a linked reason earns 1 mark only.

Allow 'no prior knowledge of the system' or 'no login details' as equivalent to having no inside knowledge.

Allow the testers to be described as ethical hackers, provided the answer says they have no inside knowledge / act as an outsider.

Do not accept 'they hack the network' without saying they have no inside knowledge or act as an outsider.

Do not accept 'they are given passwords' as this describes white box testing.

Do not award credit for white box testing.

Indicative content

The data the practice holds

• Patients' dental records and personal details must stay confidential, so an intruder reading them would take away patients' privacy.
• The practice also holds addresses, appointment times and payment details, which an attacker could use to commit fraud.
• Records must be accurate and available during an appointment, so malware that changed a record could lead a dentist to give the wrong treatment.
• Treatment notes and X-rays have to be kept intact as a record of care, so tampering would leave the practice unable to show what treatment was given.

Possible consequences of a security breach

• Ransomware could encrypt the practice's files, so appointments are cancelled and patients wait in pain while the network is restored.
• If records were stolen, the practice could be investigated and fined under data protection legislation, as well as paying to repair its systems.
• Patients who lost trust after a breach might register with another surgery, so the practice would lose income.
• Staff could be locked out of the appointment system and have to book patients on paper, which slows the service down.

Why staff behaviour matters

• The emails asking staff to reset their passwords may be phishing, so staff must not enter their login details on the page the email links to.
• If one member of staff gives away a password, an attacker can log in as that employee and read every patient record that employee can see, so passwords must never be shared.
• Staff must lock their screen when they leave reception, otherwise a visitor could read the records left on display.
• Staff should report the emails and any unexpected pop-ups straight away, so the practice can block the sender and check the network for other signs of an attack.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 requires an explained consequence of a breach and an explained reason why staff behaviour matters, both linked to the dental practice.

Do not award credit for naming a protection method, such as a firewall or antivirus, without explaining why security matters to the practice.

Indicative content

What ethical hacking involves

• An ethical hacker is given permission by the retailer to attempt to break into its network and systems.
• They use the same techniques as malicious hackers, such as trying weak passwords or looking for open ports, but within an agreed scope.
• They report the vulnerabilities they find to the retailer so they can be fixed.
• They may work to a contract that sets out which systems can be tested and when, to avoid disrupting the shop.

How it differs from malicious hacking

• Malicious hackers act without permission and may steal data or cause damage, whereas ethical hackers are authorised and report findings.
• Ethical hackers aim to improve security, not to make money from stolen customer accounts.
• Malicious hacking is a crime; ethical hacking is carried out with the owner's consent and within the law.
• Ethical hackers keep findings confidential and do not disclose them to others.

Benefits and risks for the retailer

• Ethical hacking can find weaknesses before criminals do, so the retailer can fix them and protect customer accounts.
• It can test whether access controls and firewalls work as intended in a realistic attack.
• A risk is that testing could accidentally disrupt the retailer's network or online shop, causing lost sales.
• The retailer must trust the ethical hacker not to misuse any customer data they see during testing.
• Ethical hacking can be expensive and only useful if the retailer acts on the report.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 must cover what ethical hacking involves, how it differs from malicious hacking, and at least one benefit and one risk.

Do not accept claims that ethical hackers do not need permission or are stealing data; that describes malicious hacking.