Edexcel GCSE Computer Science (1CP2) Exam Questions

Award up to two marks for a linked description such as:

• The start and end address/size of the block allocated to each program is recorded (1) so the operating system knows which areas of main memory are in use and which are free (1)
• The record is checked before memory is allocated (1) so memory already in use is not given to another program/is not overwritten (1)
• The record is searched for a free block that is large enough (1) so a newly loaded program is placed in a suitable area of main memory (1)
• The record is updated when a program ends/closes (1) so the memory it was using is marked as free for other programs (1)

Allow the record to be called a memory map/memory table/allocation table.

A response that only says the operating system keeps a record/list of the memory each program is using, without saying what the record contains, earns 0 marks.

A response that states what the record contains, e.g. the addresses/the start and end address of each block, earns 1 mark even if it does not say how the record is used.

Do not accept responses about saving programs/files to secondary storage or about moving programs to virtual memory, as these are not uses of this record.

Award up to two marks for a linked description such as:

• Each user/file is given permissions/access rights (1) so other users cannot read/write/open/change that user's files (1)
• A user may be given read-only/read access to a file (1) so they cannot edit/delete/change it (1)
• Each file is given permissions/access rights for different users (1) so the operating system allows/refuses access depending on which user is logged in (1)
• The operating system checks a user's permissions/access rights when a file is opened (1) so a user with read-only/read access cannot save/delete changes (1)

Do not accept responses about asking for a password/username, as this checks who the user is, not what they are allowed to do.

Do not accept 'files are protected/safe' or 'access rights protect files' without saying how access is limited (e.g. read-only access, permissions for different users).

Award up to two marks for a linked explanation such as:

• The operating system decides which process will use the CPU next (1) so the processor is shared between processes/processes take turns (1)
• The operating system allocates CPU time to each process/gives each process a small amount of time on the CPU (1) so multitasking can take place/several programs can appear to run at once (1)
• The operating system manages the state of each process, e.g. ready/running/blocked (1) so a process waiting for input/blocked does not stop other processes running (1)
• The operating system can terminate/end a process that has stopped responding (1) so it does not affect other processes/the computer keeps working (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept the idea that the CPU runs two or more processes at exactly the same time; multitasking shares CPU time.

Do not accept 'the OS shares the CPU' on its own without saying how/why, e.g. giving each process a turn/CPU time.

Do not accept 'it stops programs crashing' without a link to process management, e.g. ending a process that has stopped responding.

Do not accept 'it manages processes' without saying what the operating system does.

Indicative content

How malware could affect the charity's computers

• A virus could damage or delete the charity's files, such as its records of donations.
• Spyware could record keystrokes and send staff passwords or personal data to a hacker.
• A Trojan horse could hide malicious code inside a useful-looking program that a volunteer downloads, so it is installed without the user knowing.
• Malware could spread from one laptop to another through files shared on the charity's network, so more laptops become infected and more files are lost.

How anti-malware software finds and deals with malware

• It scans files and compares their code with a database of known malware patterns (signatures) to identify a match.
• It can apply rules (heuristics) to decide whether a program is behaving suspiciously.
• A suspicious file can be run in a sandbox to see whether its behaviour is malicious.
• When malware is found, the file is quarantined so that it cannot run, and it can be deleted.
• Downloads and email attachments can be scanned before a member of staff opens them.

What else the charity must do for the anti-malware software to be effective

• The database of malware definitions must be kept up to date, or new malware will not be recognised.
• Staff and volunteers should be trained not to open unexpected attachments or download from unreliable sites.
• Backups are still needed, because anti-malware cannot repair files that malware has already damaged.
• Scheduled scans must be allowed to run on all 15 laptops, so that malware is found even if no one opens the file.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 responses must cover both how malware could affect the computers and how anti-malware software finds or deals with it; a brief deal-with point and an unexplained update point, with no identification method and no effect on the charity's files, are Level 1.

Do not accept anti-malware software described as a firewall, or 'scans files'/'finds viruses' on its own as a method of identifying malware.