Edexcel GCSE Computer Science (1CP2) Exam Questions

• C Locks files and demands payment (1)
• The only correct answer is C. The correct answer is locks files and demands payment. Accept encrypts files and asks for a ransom / locks files until a payment is made.
• A is not correct because copying itself into other files is what a virus does
• B is not correct because hiding inside a useful program is what a Trojan does
• D is not correct because recording every key press made is what a keylogger does

• B Asking people for confidential information (1)
• The only correct answer is B. The correct answer is asking people for confidential information.
• A is not correct because exploiting unpatched software is hackers using vulnerabilities in software, not social engineering
• C is not correct because recording key presses using malware is a key logger, a type of malware
• D is not correct because installing ransomware is malware that encrypts files and demands payment

Award one mark for any of the following:

• Quarantine the file (1)
• Isolate the file (1)
• Delete/remove the file (1)
• Repair/clean the file (1)

Do not accept scan/check the file

Do not accept block/prevent/stop the file from running

Do not accept remove the virus from the system

Award one mark for any of the following up to a maximum of two marks:

• Unpatched/not updated software/operating system (missing security updates/patches) (1)
• Out-of-date anti-malware/anti-virus (virus signatures/definitions not updated) (1)

Do not accept social engineering or phishing.

Award one mark for any of the following up to a maximum of two marks:

• Looking/leaning/watching over someone's shoulder (to see their screen/keypad) (1)
• Using a CCTV camera to view a screen/keypad (1)
• Filming/photographing a screen/keypad with a mobile phone/camera (1)
• Using binoculars to view a screen/keypad (1)
• Standing close to someone at an ATM/cash machine to see their PIN (1)

Do not accept phishing.

Do not accept guessing a password.

Award up to two marks for a linked description such as:

• Tricks a legitimate user/employee into revealing their login details/credentials (1) so the attacker can use the account to access the system/data (1)
• Exploits human trust/error (1) so technical security measures such as firewalls/passwords can be bypassed (1)
• Convinces a user that a message/website is genuine/is from a trusted organisation (1) so the user gives away confidential information/data (1)
• Gets a user to follow a link/open an attachment (1) so malware is installed on the system (1)

Allow 'deceives/manipulates/persuades a user' as the human-factor mechanism.

For the second mark, the development must give a consequence beyond the trick itself, such as access to the system/data or bypassed security.

Do not award generic statements such as 'it steals data', 'it causes harm' or 'it hacks the system' that do not name the human-factor mechanism.

Do not accept answers that only name a social engineering method, such as phishing, without saying how it threatens the system.

Do not accept answers about malware or technical attacks, such as a virus deleting files.

Award up to two marks for a linked explanation such as:

• The anti-malware does not have the latest signatures/definitions (1) so it cannot recognise/detect new malware (1)
• The signature database/definitions are out of date (1) so malware written/changed since the last update is not detected (1)
• The software only checks files against older/known signatures (1) so files containing new malware are not flagged/quarantined (1)
• New malware has not been added to the signature list (1) so it can run/install on the computer without being stopped (1)

For both marks, the expansion must follow/associate with the statement.

Accept signatures/definitions (virus or malware definitions) and database/list for signatures.

The first mark can be awarded for saying the signatures/definitions are out of date/not updated on its own; the second mark needs a linked effect on detection such as not recognising new malware.

Do not award the second mark for repeating that the anti-malware is out of date without saying what this means for detection.

Do not accept 'the computer is old' or 'the anti-malware is slow' without linking to missing/out-of-date signatures and detection.

Do not accept 'there is no anti-malware installed' because the question says the anti-malware is out of date.

Award up to two marks for a linked explanation such as:

• The malware code in the file cannot run/execute (1) so it cannot damage/delete/corrupt files on the computer (1)
• The malware cannot spread to other files/computers (1) because the infected file is isolated from the rest of the system (1)
• Other programs and users cannot open/run the infected file (1) so the malware cannot be triggered by accident (1)
• The file is kept rather than deleted (1) so it can be checked and restored later if it is not really infected (1)

For both marks, the expansion must follow/associate with the statement.

A benefit stated on its own, with no linked reason, can earn (1) only.

Do not award a mark for a description of what quarantine is, such as 'the file is put in a quarantine folder' or 'the file is kept in quarantine', as this gives no benefit and no reason.

Do not accept 'it deletes/removes the infected file/malware' because quarantine keeps the file; deleting is a different action.

Do not accept 'it stops all malware' or 'the file is safe'/'the computer is safe' without saying what is being protected from the malware.

Do not accept 'the computer runs faster' because quarantine is not a performance tool.

Award up to two marks for a linked explanation such as:

• The email appears to come from a genuine/trusted organisation (1) so the user believes the request is real (1)
• The email contains a link to a fake website (1) where the user types their username/password, which the attacker then captures (1)
• The email asks the user to confirm/update their login details (1) so the user sends/supplies them to the attacker (1)
• The email warns of a problem with the account/creates a sense of urgency (1) so the user acts without checking and enters their details (1)

For both marks, the expansion must follow/associate with the statement.

A point without a linked reason earns one mark only.

Accept a forged/spoofed sender address as part of the first point only, provided it is linked to the user trusting the email and giving their details.

Do not accept 'the user is tricked' or 'the email looks real' on its own, without saying what the user then does with their details.

Do not accept 'the email has a virus' as the explanation, as this describes malware rather than phishing.

Do not accept answers where the attacker guesses/cracks/brute forces the password, as phishing involves the user giving the details themselves.

Award up to two marks for a linked explanation such as:

• It requires less technical skill/knowledge (1) because the attacker tricks/asks the user rather than writing code/finding a flaw (1)
• It can be cheaper/quicker (1) because no specialist software/tools are needed (1)
• It is more likely to succeed (1) because users are trusting and give the information willingly (1)
• There may be no known technical vulnerability to exploit (1) so tricking a user is the easier route in (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept 'it is easier' on its own without saying why it is easier, such as no technical skill being needed.

Do not award marks for answers that describe finding or using an unpatched software vulnerability, as this is not social engineering.