Preventing Network Security Risks Exam Questions

• C Filtering rules (1)
• The only correct answer is C. The correct answer is filtering rules.
• A is not correct because anti-malware detects and removes malicious software
• B is not correct because encryption scrambles data so it cannot be read without the key
• D is not correct because physical security protects equipment from physical access

• D User access levels (1)
• The only correct answer is D. The correct answer is User access levels.
• A is not correct because a firewall checks network traffic against filtering rules to decide what data may enter or leave the network; it does not set which files a user is allowed to open
• B is not correct because penetration testing is an authorised attack on a network to find vulnerabilities; it does not set which files a user is allowed to open
• C is not correct because security lighting is physical security that deters intruders; it does not set which files a user is allowed to open

• D Locked door (1)
• The only correct answer is D. The correct answer is locked door (accept 'door with lock').
• A is not correct because anti-malware detects and removes malicious software; it is a software control, not physical security
• B is not correct because CCTV monitors and records activity but does not prevent someone entering
• C is not correct because encryption scrambles data so it cannot be read without a key; it is not physical security

• B Biometric authentication (1)
• The only correct answer is B. The correct answer is biometric authentication.
• A is not correct because access levels control which files or folders a user can access
• C is not correct because a password policy sets rules for creating strong passwords
• D is not correct because a username and password verify a user but do not use a fingerprint

Award one mark for any of the following up to a maximum of two marks:

• Usernames and passwords/user accounts/PINs (1)
• Biometric authentication e.g. fingerprint/facial recognition/retinal scan (1)
• User access levels/access rights/permissions (1)
• Security tokens/security cards used to authenticate a user (1)
• Two-factor authentication e.g. password plus a code sent to a phone (1)

Allow passwords on their own as a method.

Do not award two marks for passwords and usernames and passwords together; these are the same method.

Allow a security token/card because it authenticates the user; do not accept a card used only for physical access such as a door entry card.

Allow two-factor authentication as a method in its own right.

Do not accept physical security methods such as locks, CCTV or security guards.

Do not accept a firewall or anti-malware, as these are not access control.

Award one mark for each of the following up to a maximum of two marks:

• A hardware or software device/program (1)
• That monitors/checks/filters network traffic/packets (1)
• That allows or blocks traffic/data using a set of rules (1)

Allow incoming and outgoing traffic / data entering or leaving a network.

Do not accept stops hackers or stops viruses on its own.

Do not accept answers that say it removes viruses or is anti-malware software.

Award one mark for any of the following up to a maximum of two marks:

• Penetration testing/pen test (1)
• An authorised/simulated attack on the network to find weaknesses (1)
• Ethical hacking/using an ethical hacker to test the network (1)
• A person authorised by the organisation tries to gain access to the network and reports the weaknesses found (1)

Do not award two marks for the same method described twice.

Do not accept hacking on its own.

Do not accept firewalls, anti-malware or passwords.

Do not accept vulnerability scanning on its own.

Award up to two marks for a linked description such as:

• The firewall checks/examines incoming packets/traffic (1) to see where they are from/are going (1)
• It compares packets/traffic against a set of rules/filters (1) to decide whether to allow/block/drop them (1)
• It can block/drop packets from a particular IP address (1) so traffic from a known malicious source cannot enter the network (1)
• It can block/drop access to certain ports (1) so services that are not needed cannot be used from outside (1)

Accept responses that describe the firewall restricting access by IP address or port, even though this limits access to the network.

Do not accept a bare statement that the firewall blocks/filters unwanted traffic, with no description of how it decides what to block.

Do not accept 'stops hackers/viruses' without saying how traffic is checked or blocked.

Do not accept responses about physical security or access control, such as usernames/passwords or access levels.

Award up to two marks for a linked description such as:

• Each user is given an access level/permissions (1) so that staff can only open the records they need for their role (1)
• Some staff are given read-only access (1) so that they cannot change/delete the records (1)
• Full/administrator access is given to only a few trusted staff (1) so that only they can change permissions/edit all of the records (1)
• Users are put into user groups (1) so that a whole group can be stopped from opening records it does not need (1)

Award the first mark for naming a specific mechanism, e.g. each user is given an access level, some staff have read-only access, only a few staff have administrator access (1).

Do not award a mark for a general statement that access levels are set/used to protect the records, or that the records are kept safe, with no named mechanism (0).

Allow read-only/view only, write access/edit rights.

Do not accept 'so unauthorised people cannot access them' as the development unless it says which users or which actions are restricted.

Do not accept responses about firewalls, encryption or physical security.

Do not accept 'access levels stop viruses/malware'.

Do not award a second mark for repeating the same restriction in different words.

Award up to two marks for a linked description such as:

• The door stays locked until the correct PIN/code is entered (1) so people without the code cannot get into the server room (1)
• The PIN/code is given only to authorised staff (1) so other people cannot reach the servers (1)
• The code can be changed when staff leave (1) so former staff cannot get physical access to the servers (1)
• Too many wrong codes make the keypad lock/stop accepting codes (1) so the code cannot be guessed by someone trying (1)

Do not accept responses that say the keypad stops hackers from logging on to the network without describing physical access.

Do not accept 'stops theft' or 'stops damage' unless it is linked to preventing unauthorised access to the room/servers.

Do not accept 'it keeps the room safe' without saying how access is controlled.

Do not accept responses about firewalls or anti-malware.

Do not accept passwords used to log on to the network.

Award up to two marks for a linked description such as:

• (Customer details are) scrambled/turned into ciphertext (using a key) before they are sent over the internet (1) so they cannot be understood/read if intercepted (1)
• A key is needed to decrypt the data (1) so an interceptor cannot read the customer details without it (1)
• The key is kept secret/is only shared with the receiver (1) so an attacker cannot decrypt the intercepted data (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept 'encryption stops the data being stolen' (encryption protects data from being read if intercepted; it does not stop data being stolen).

Do not accept 'encryption stops hackers/viruses' on its own; the response must say the data cannot be read without the key.

Do not accept responses about firewalls or access control.

Award up to two marks for a linked explanation such as:

• Employees can only access/open the files/data they need for their job (1) so sensitive/important files cannot be viewed/changed by other employees (1)
• Employees are given different access levels/permissions (1) because some staff need to edit files that others should only be able to read (1)
• Employees cannot change/delete files that are outside their role (1) because their account does not have write permission for those files (1)

For both marks, the expansion must follow/associate with the statement.

Allow 'employees cannot open files that are not needed for their job' as the first point (1).

Do not accept 'it keeps data safe/secure' on its own without saying what access is limited or how.

Do not accept answers that only describe usernames/passwords/authentication, e.g. 'it stops hackers guessing passwords', as these do not explain access levels.

Do not award a second mark where the reason only restates the point, e.g. 'files cannot be changed (1) so they stay the same (1)'; the reason must say who is prevented or why it matters.

Ignore 'the network is protected' unless it is linked to restricting what employees can access.

Award up to two marks for a linked explanation such as:

• Only staff with the key can open the cabinet (1) so unauthorised people cannot touch/steal the servers (1)
• Someone cannot disconnect/remove a server (1) because unauthorised people cannot open the cabinet (1)
• The servers are protected from damage (1) because the cabinet is locked so people cannot reach them (1)

For both marks, the expansion must follow/associate with the statement.

Accept 'keeps the servers safe from damage' as the point (1); a linked reason about the locked cabinet is needed for the second mark.

Do not accept answers about software protection such as anti-malware or firewalls; these are not physical security.

Do not accept 'it stops hackers' without saying how the locked cabinet prevents physical access.

Do not accept 'it keeps the servers safe' on its own unless it names what they are safe from (damage/theft/tampering) as the point.

Do not accept an answer that only repeats the question, e.g. 'the servers are secure because they are in a locked cabinet'.

Award up to two marks for a linked explanation such as:

• The IP address/source address may be known to send malicious/harmful traffic or malware (1) so blocking it stops the attacks/malware reaching devices on the network (1)
• The address may belong to an untrusted/blacklisted computer (1) because it has been identified as the source of previous attacks/malicious activity (1)
• The address may be trying to access a port/service it should not use (1) so blocking it prevents unauthorised access to that service (1)

For both marks, the expansion must follow/associate with the statement.

A statement on its own, e.g. that the address is untrusted/blacklisted, earns the point (1) but the linked reason (e.g. it has been identified as the source of attacks) is needed for the second mark.

Do not accept 'to stop hackers' or 'to protect/keep the network safe' on its own, as this repeats the question; the answer must say why that IP address is blocked or what is prevented.

Do not accept answers that say the firewall hides the network unless they explain how blocking packets from that address protects the network.

Award up to two marks for a linked explanation such as:

• If the data is intercepted, it cannot be read/understood (1) because it is scrambled and the attacker does not have the key (1)
• Only the intended receiver can decrypt the data (1) because they have the secret/shared decryption key (1)
• Data cannot be read if it is stolen/lost (1) because it can only be decrypted with the key (1)

For both marks, the expansion must follow/associate with the statement.

A point on its own earns one mark; the second mark is only awarded for a reason linked to that point.

Do not accept 'because it is encrypted' as the reason, as this repeats the point.

Do not accept 'it stops the data being intercepted' because encryption does not prevent interception.

Do not accept 'it stops hackers' on its own without saying why the data cannot be read or used.

Do not accept vague answers such as 'it is more secure' or 'it keeps data safe' without saying how the data is protected, e.g. that it cannot be read without the key.

Award one mark for any of the following up to a maximum of three marks:

• Locks on doors/cabinets (1)
• CCTV/security cameras (1)
• Security guards/security personnel (1)
• ID cards/badges (1)
• Turnstiles/gates (1)
• Fences/walls/barbed wire (1)
• Intruder alarms (1)
• Security lighting (1)
• Security tags on equipment (1)
• Biometric locks/fingerprint door locks (1)
• Keypads on doors (1)

Allow electronic/key card door locks as locks on doors.

Only award one mark where a candidate gives more than one of door locks/biometric locks/keypads, as all of these describe locking a door.

Accept ID cards/badges and biometric locks/fingerprint door locks as physical security methods, as they control who can physically enter.

Do not accept firewalls, passwords, usernames, anti-malware or encryption, as these are not physical methods.

Indicative content

Methods of access control

• Usernames and passwords stop people who do not have an account from logging on to the network.
• A password policy requiring a minimum length, upper and lower case letters, symbols and regular changes makes passwords harder to guess.
• Access rights set on folders and files mean each member of staff can only open the records they need for their job.
• Biometric methods such as a fingerprint or facial recognition verify that the person logging on is who they claim to be.

How access levels protect the records

• Reception staff can see appointment details but not medical histories, so an account that is compromised exposes less sensitive data.
• Only senior staff are given permission to change or delete a record, which protects the accuracy of the patient records.
• Giving a nurse read-only access to a ward's records prevents accidental changes to them.
• If a password is stolen, the damage is limited to what that user was allowed to see and do.
• Logging each user in separately means actions on the network can be traced back to an account.

Limitations of access control

• Passwords can be guessed, phished or shared with colleagues, so someone else can log on with a user's access.
• Staff may write passwords down or leave a logged-on computer unattended.
• Access rights must be set correctly; a mistake can give a user far more access than their job needs.
• Access control does not stop an authorised member of staff deliberately misusing records they are allowed to see.
• A fingerprint reader can reject a legitimate user or be fooled by a copy of a fingerprint.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 responses must cover how access levels protect the records as well as methods and limitations.

Do not accept an acceptable use policy, a firewall or anti-malware software as a method of access control.

Indicative content

Methods of physical security

• Locks on the doors and on each server rack.
• Swipe cards or a biometric scanner on the door into the server room.
• A security guard at reception who signs visitors in and out.
• CCTV cameras covering the entrance and the server room.
• Intruder alarms and movement sensors inside the room.
• Security lighting and a fence around the outside of the building.

How each method protects the servers

• A locked rack means even someone who gets into the room cannot remove a disk or unplug a server.
• A swipe card system only lets authorised staff into the server room, so visitors cannot reach the servers.
• A guard can stop a visitor following a member of staff through the door (tailgating).
• CCTV deters intruders and provides evidence to identify anyone who does break in.
• An alarm alerts the guard or the police if someone enters the room outside working hours.

Limitations of physical security

• Physical security does not stop an attack over the network, such as malware or a hacker using a stolen password.
• A member of staff with a valid card can still damage a server or steal data from it.
• Cards can be lost or copied, and a copied fingerprint can fool some scanners.
• CCTV only records an incident; it does not stop it happening, and someone has to watch the footage.
• Guards, alarms and CCTV cost money to buy and to maintain.
• A person can hold a door open for someone behind them.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 responses must give more than one method, explain how the method protects the servers and give at least one limitation.

Do not accept a firewall, anti-malware software or passwords as methods of physical security.