Edexcel GCSE Computer Science (1CP2) Exam Questions

• B An ethical hacker (1)
• The only correct answer is B. The correct answer is ethical hacker.
• A is not correct because a black hat hacker breaks into a network without the owner's permission
• C is not correct because a malicious insider misuses the access they already have in order to cause harm
• D is not correct because a virus writer creates malware to infect systems rather than testing a network with permission

• C Penetration testing (1)
• The only correct answer is C. The correct answer is penetration testing.
• A is not correct because access control limits what users can access
• B is not correct because a firewall filters network traffic
• D is not correct because physical security protects hardware from theft or damage

• C To keep customers' personal data private (1)
• The only correct answer is C. The correct answer is keeping customers' personal data private.
• A is not correct because shared passwords mean users cannot be identified, which reduces security
• B is not correct because the number of users on a network is not affected by how secure it is
• D is not correct because the amount of storage needed is not affected by network security

• C Filtering rules (1)
• The only correct answer is C. The correct answer is filtering rules.
• A is not correct because anti-malware detects and removes malicious software
• B is not correct because encryption scrambles data so it cannot be read without the key
• D is not correct because physical security protects equipment from physical access

Award one mark for any of the following up to a maximum of two marks:

• To identify possible entry points into the system/network (1)
• To identify the targets of potential attacks (1)
• To test whether existing security controls/protections work (1)
• To report the findings so that weaknesses can be fixed (1)

Accept 'to simulate an attack on the organisation's own network' only when it also states that this is done to find weaknesses, e.g. 'simulate an attack to find weaknesses' (1)

Do not accept 'to simulate an attack' on its own, as it does not say what the testing is for

Do not accept 'to hack the network', as this repeats the method rather than giving an aim

Do not accept 'to steal data' or 'to gain unauthorised access', as these are the aims of an attacker

Award up to two marks for a linked description such as:

• (Customer details are) scrambled/turned into ciphertext (using a key) before they are sent over the internet (1) so they cannot be understood/read if intercepted (1)
• A key is needed to decrypt the data (1) so an interceptor cannot read the customer details without it (1)
• The key is kept secret/is only shared with the receiver (1) so an attacker cannot decrypt the intercepted data (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept 'encryption stops the data being stolen' (encryption protects data from being read if intercepted; it does not stop data being stolen).

Do not accept 'encryption stops hackers/viruses' on its own; the response must say the data cannot be read without the key.

Do not accept responses about firewalls or access control.

Award up to two marks for a linked explanation such as:

• Patient records are kept private/confidential (1) because only authorised staff are allowed to access them (1)
• Patient records stay accurate/complete (1) because unauthorised users are prevented from changing/deleting them (1)
• Hackers are kept out of the network (1) because a firewall/access control blocks unauthorised access to the patient records (1)
• Patient records are available when staff need them (1) because the network is protected from attacks that could stop it working (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept 'to keep data safe', 'to stop hackers' or 'it stops viruses' on its own, without saying what is protected or how.

Accept 'patient data/records/details' as the same point.

Do not award credit for an answer that repeats the question, e.g. 'network security is important so the network is secure'.

Award up to two marks for a linked explanation such as:

• Only staff with the key can open the cabinet (1) so unauthorised people cannot touch/steal the servers (1)
• Someone cannot disconnect/remove a server (1) because unauthorised people cannot open the cabinet (1)
• The servers are protected from damage (1) because the cabinet is locked so people cannot reach them (1)

For both marks, the expansion must follow/associate with the statement.

Accept 'keeps the servers safe from damage' as the point (1); a linked reason about the locked cabinet is needed for the second mark.

Do not accept answers about software protection such as anti-malware or firewalls; these are not physical security.

Do not accept 'it stops hackers' without saying how the locked cabinet prevents physical access.

Do not accept 'it keeps the servers safe' on its own unless it names what they are safe from (damage/theft/tampering) as the point.

Do not accept an answer that only repeats the question, e.g. 'the servers are secure because they are in a locked cabinet'.

Indicative content

What ethical hacking involves

• An ethical hacker is given permission by the retailer to attempt to break into its network and systems.
• They use the same techniques as malicious hackers, such as trying weak passwords or looking for open ports, but within an agreed scope.
• They report the vulnerabilities they find to the retailer so they can be fixed.
• They may work to a contract that sets out which systems can be tested and when, to avoid disrupting the shop.

How it differs from malicious hacking

• Malicious hackers act without permission and may steal data or cause damage, whereas ethical hackers are authorised and report findings.
• Ethical hackers aim to improve security, not to make money from stolen customer accounts.
• Malicious hacking is a crime; ethical hacking is carried out with the owner's consent and within the law.
• Ethical hackers keep findings confidential and do not disclose them to others.

Benefits and risks for the retailer

• Ethical hacking can find weaknesses before criminals do, so the retailer can fix them and protect customer accounts.
• It can test whether access controls and firewalls work as intended in a realistic attack.
• A risk is that testing could accidentally disrupt the retailer's network or online shop, causing lost sales.
• The retailer must trust the ethical hacker not to misuse any customer data they see during testing.
• Ethical hacking can be expensive and only useful if the retailer acts on the report.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 must cover what ethical hacking involves, how it differs from malicious hacking, and at least one benefit and one risk.

Do not accept claims that ethical hackers do not need permission or are stealing data; that describes malicious hacking.

Indicative content

Methods of physical security

• Locks on the doors and on each server rack.
• Swipe cards or a biometric scanner on the door into the server room.
• A security guard at reception who signs visitors in and out.
• CCTV cameras covering the entrance and the server room.
• Intruder alarms and movement sensors inside the room.
• Security lighting and a fence around the outside of the building.

How each method protects the servers

• A locked rack means even someone who gets into the room cannot remove a disk or unplug a server.
• A swipe card system only lets authorised staff into the server room, so visitors cannot reach the servers.
• A guard can stop a visitor following a member of staff through the door (tailgating).
• CCTV deters intruders and provides evidence to identify anyone who does break in.
• An alarm alerts the guard or the police if someone enters the room outside working hours.

Limitations of physical security

• Physical security does not stop an attack over the network, such as malware or a hacker using a stolen password.
• A member of staff with a valid card can still damage a server or steal data from it.
• Cards can be lost or copied, and a copied fingerprint can fool some scanners.
• CCTV only records an incident; it does not stop it happening, and someone has to watch the footage.
• Guards, alarms and CCTV cost money to buy and to maintain.
• A person can hold a door open for someone behind them.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 responses must give more than one method, explain how the method protects the servers and give at least one limitation.

Do not accept a firewall, anti-malware software or passwords as methods of physical security.