Edexcel GCSE Computer Science (1CP2) exam questions

Build a practice paper from 693 exam-style questions, each with its mark scheme and example answers. Print it, or answer it on paper and then open the mark schemes. Or browse the questions by topic.

Practice paper

10 questions · 21 marks

Pick again

1Multiple choice1 markMalware Swap Remove

An attacker phones a member of staff, pretends to be from IT support and asks for their password.

Identify what is meant by social engineering.

[1 mark]

AManipulating people into revealing information
BComparing files with known malware
CLocking files until a payment is made
DAttaching malicious code to other programs

Mark scheme

A Manipulating people into revealing information (1)
The only correct answer is A. The correct answer is manipulating people into revealing information; accept equivalent wording such as tricking people into giving data or bypassing security.
B is not correct because comparing files with known malware is signature-based scanning by anti-malware
C is not correct because locking files until a payment is made is what ransomware does
D is not correct because attaching malicious code to other programs is what a virus does

Example answers and how they were marked

Full marks1/1

A Manipulating people into revealing information

Why: Correct option (1): social engineering manipulates people rather than technical systems.

No marks0/1

B Comparing files with known malware

Why: Near-miss: describes signature-based scanning used by anti-malware, not social engineering.

No marks0/1

C Locking files until a payment is made

Why: Describes ransomware, not social engineering.

2Multiple choice1 markSocial Engineering Swap Remove

Identify what is meant by social engineering.

[1 mark]

AExploiting vulnerabilities in unpatched software
BAsking people for confidential information
CRecording key presses using malware
DInstalling ransomware to encrypt files

Mark scheme

B Asking people for confidential information (1)
The only correct answer is B. The correct answer is asking people for confidential information.
A is not correct because exploiting unpatched software is hackers using vulnerabilities in software, not social engineering
C is not correct because recording key presses using malware is a key logger, a type of malware
D is not correct because installing ransomware is malware that encrypts files and demands payment

Example answers and how they were marked

Full marks1/1

B Asking people for confidential information

Why: Correct option (1).

No marks0/1

C Recording key presses using malware

Why: A key logger is malware, not social engineering; candidates often confuse any cyberattack with social engineering, so no mark.

No marks0/1

A Exploiting vulnerabilities in unpatched software

Why: Exploiting unpatched software is a technical vulnerability, not social engineering; candidates may think any method of hacking is social engineering, so no mark.

3Short recall1 markMalware Swap Remove

Anti-malware software helps to protect a computer system.

State what anti-malware software does with a file when it finds that the file is infected.

[1 mark]

Mark scheme

Award one mark for any of the following:

Quarantine the file (1)
Isolate the file (1)
Delete/remove the file (1)
Repair/clean the file (1)

Do not accept scan/check the file

Do not accept block/prevent/stop the file from running

Do not accept remove the virus from the system

Example answers and how they were marked

Full marks1/1

Quarantine the file.

Why: Quarantine the file (1).

No marks0/1

Scan the file to see if it is infected.

Why: Scanning is not the action taken after infection is found; the scheme says do not accept scan/check the file.

No marks0/1

Stop the file from running.

Why: Stopping/blocking the file from running is not creditworthy; the scheme says do not accept block/prevent/stop the file from running.

4Short recall2 marksSocial Engineering Swap Remove

Cyberattacks can target people as well as computer systems.

Define the term social engineering.

[2 marks]

Mark scheme

Award one mark for any of the following up to a maximum of two marks:

Obtaining/gaining confidential/personal information (1)
By asking/tricking/deceiving/manipulating people/users (1)
Exploiting human trust/weakness (1)
Pretending/impersonating a person or organisation to get information (1)

Allow 'people' or 'users' as equivalent.

Allow 'using people to get information' where it shows that information is obtained from a person.

Do not accept answers that only name a method of social engineering, e.g. phishing, shoulder surfing.

Do not accept hacking a computer, installing malware or other technical attacks.

Example answers and how they were marked

Full marks2/2

Tricking people into giving confidential information by asking them for it.

Why: Obtaining confidential information (1) and tricking/asking people (1).

Some marks1/2

Obtaining personal information.

Why: Obtaining personal information (1); no creditworthy point about tricking or asking people.

No marks0/2

Installing malware on a computer to steal data.

Why: Malware is a technical attack, not social engineering; no creditworthy point.

5Short recall2 marksSocial Engineering Swap Remove

Hackers can use shoulder surfing to gain confidential information.

State two ways a hacker could carry out shoulder surfing.

[2 marks]

Mark scheme

Award one mark for any of the following up to a maximum of two marks:

Looking/leaning/watching over someone's shoulder (to see their screen/keypad) (1)
Using a CCTV camera to view a screen/keypad (1)
Filming/photographing a screen/keypad with a mobile phone/camera (1)
Using binoculars to view a screen/keypad (1)
Standing close to someone at an ATM/cash machine to see their PIN (1)

Do not accept phishing.

Do not accept guessing a password.

Example answers and how they were marked

Full marks2/2

Looking over their shoulder and filming them with a mobile phone.

Why: Looking over someone's shoulder (1) and filming a screen/keypad with a mobile phone (1).

Some marks1/2

Using binoculars to see their screen.

Why: Using binoculars to view a screen (1); only one way given.

No marks0/2

Sending them a phishing email to get their password.

Why: Phishing is not shoulder surfing; no creditworthy point.

6Short recall2 marksSocial Engineering Swap Remove

Phishing is a common cyberattack.

Define the term phishing.

[2 marks]

Mark scheme

Award one mark for any of the following up to a maximum of two marks:

Sending messages (emails/texts/phone calls) to users (1)
Pretending to be from a trusted organisation/person, e.g. a bank (1)
To trick the recipient into giving personal/confidential information (1)
Directing the user to a fake website (1)

Do not accept 'a virus/software that steals data'.

Example answers and how they were marked

Full marks2/2

Sending an email that pretends to be from a bank to trick the recipient into giving their password.

Why: Pretending to be from a trusted organisation (1) and tricking the recipient into giving personal information (1).

Some marks1/2

Sending emails to lots of people.

Why: Sending messages to users (1); no creditworthy point about deception or personal information.

No marks0/2

A program that records the keys pressed on a keyboard.

Why: This describes a key logger, not phishing; no creditworthy point.

7Describe2 marksSocial Engineering Swap Remove

Phishing is a social engineering technique.

Describe how phishing can be used to obtain a user's personal information.

[2 marks]

Mark scheme

Award up to two marks for a linked description such as:

Sends an email/text message pretending to be from a trusted organisation/bank (1) asking the user to confirm/provide personal details/login details (1)
Includes a link to a fake website (1) where the user enters their login details/personal information (1)
Sends a message claiming there is a problem with the user's account (1) so the user replies with their personal information (1)

Allow 'email/text message/SMS' for 'email/text message'.

Allow 'bank/company/organisation' for 'trusted organisation'.

Allow 'username and password/login details/personal details' for 'personal details/login details'.

Do not award a mark for 'sends an email' on its own, with no deception or request for information.

Do not award a second mark for 'sends a fake email' that does not say how the personal information is obtained.

Do not award descriptions that only involve malware (e.g. a keylogger or Trojan) or a malicious website, with no deceptive message to the user.

Do not accept descriptions of other social engineering methods, such as shoulder surfing.

Example answers and how they were marked

Full marks2/2

The attacker sends an email that appears to come from the user's bank. It asks the user to click a link and enter their login details on a fake website.

Why: Email pretending to be from a trusted organisation (1) asking the user to provide personal details (1).

Some marks1/2

The attacker sends an email that appears to come from a bank.

Why: Email pretending to be from a trusted organisation (1); no linked point about how personal information is obtained (0).

No marks0/2

The attacker uses a camera to record the user typing their password.

Why: Describes shoulder surfing, not phishing; no creditworthy point.

8Explain2 marksMalware Swap Remove

Ransomware is a type of malware.

Explain one reason why ransomware can stop a user accessing their files.

[2 marks]

Mark scheme

Award up to two marks for a linked explanation such as:

Ransomware encrypts the user's files (1) so the user cannot open/read them without the decryption key (1)
Ransomware locks the files/data (1) so the user cannot open/use them until a ransom is paid (1)
Ransomware changes the files into an unreadable form (1) so the user needs the attacker's key to restore access to them (1)
Ransomware stops the files from opening (1) because their contents have been scrambled/encrypted by the malware (1)

For both marks, the expansion must follow/associate with the statement.

The point must be about the user's files/data being locked, encrypted or made inaccessible; locking the whole computer on its own is not enough.

Do not accept 'it asks for money/a ransom' on its own without saying the files/data are locked/encrypted/inaccessible.

Do not accept 'it deletes the files' as the reason access is stopped.

Do not accept restatement of the question as the point, e.g. 'the user cannot access their files', without saying why.

Do not accept 'the computer is infected' or 'it is a virus' as the point or the reason.

Example answers and how they were marked

Full marks2/2

Ransomware encrypts the user's files so they cannot be opened without the decryption key.

Why: Encryption of files point (1) with the linked consequence that they cannot be opened without the key (1).

Some marks1/2

Ransomware encrypts the user's files.

Why: Files are encrypted point (1); no linked reason saying why this stops the user accessing them.

No marks0/2

It is a virus that infects the computer and asks the user for money.

Why: 'Virus/infects the computer' is a near-miss and asking for money alone is not accepted; nothing says how the files are locked, encrypted or made inaccessible.

9Explain2 marksSocial Engineering Swap Remove

A user receives an email asking them to log in to their online bank account.

Explain how the email can be used to steal the user's login details.

[2 marks]

Mark scheme

Award up to two marks for a linked explanation such as:

The email appears to come from a genuine/trusted organisation (1) so the user believes the request is real (1)
The email contains a link to a fake website (1) where the user types their username/password, which the attacker then captures (1)
The email asks the user to confirm/update their login details (1) so the user sends/supplies them to the attacker (1)
The email warns of a problem with the account/creates a sense of urgency (1) so the user acts without checking and enters their details (1)

For both marks, the expansion must follow/associate with the statement.

A point without a linked reason earns one mark only.

Accept a forged/spoofed sender address as part of the first point only, provided it is linked to the user trusting the email and giving their details.

Do not accept 'the user is tricked' or 'the email looks real' on its own, without saying what the user then does with their details.

Do not accept 'the email has a virus' as the explanation, as this describes malware rather than phishing.

Do not accept answers where the attacker guesses/cracks/brute forces the password, as phishing involves the user giving the details themselves.

Example answers and how they were marked

Full marks2/2

The email contains a link to a fake website that looks like the bank's site so the user types their password into it and the attacker captures it

Why: Linked point (1) that there is a link to a fake website and reason (1) that the user types in the password, which the attacker then captures.

Some marks1/2

The email pretends to come from the user's bank.

Why: Point (1) that a trusted organisation is imitated, but no linked reason that the user therefore believes it and gives their details, so only the first mark is earned.

No marks0/2

The hacker installs a key logger on the user's computer to record their password.

Why: Describes malware, not phishing, so no creditworthy point is given.

10Discuss6 marksSocial Engineering Swap Remove

A hospital stores patient records on its network. Staff use email and a shared reception computer. An attacker has sent an email that appears to come from the IT team and asks staff to reset their password using a link.

Discuss how social engineering attacks threaten the hospital's digital systems.

Your answer should consider:

methods an attacker could use
why hospital staff might be vulnerable
the impact on the hospital if an attack succeeds.

[6 marks]

Mark scheme

Indicative content

Methods an attacker could use

A phishing email, like the fake IT team message, can lead staff to a fake login page where their username and password are captured.
Spear phishing could target one named member of staff, such as the receptionist, using details taken from the hospital's website.
Shoulder surfing at the shared reception computer lets an attacker watch a password being typed, or use a camera to record it.
Blagging or pretexting can be used to phone reception and pretend to be a manager or an engineer in order to obtain information.
Baiting can involve leaving a USB drive in the staff room for someone to plug in, or offering a free download that installs malware.
Scareware can show a pop-up claiming the computer has a virus and invite staff to follow a link or pay for a fake fix.

Why hospital staff might be vulnerable

Staff are busy and may follow the link without checking the sender address of the email.
The message appears to come from the IT team, so staff trust it as an official request and do not question it.
Staff may not have had recent training, so they do not recognise a fake login page.
The shared reception computer is in a public area, so other people can see the screen or watch the keyboard.
Staff want to help a caller who says there is an urgent problem, so they give information without checking who the caller is.

The impact on the hospital if an attack succeeds

The attacker could use the stolen login to open patient records and steal sensitive data.
The attacker could change or delete records, so treatment decisions are based on wrong information.
The hospital may disconnect its systems to contain the attack, delaying appointments and treatment.
The hospital could face a penalty under data protection legislation and lose the trust of its patients.
The attacker could install malware to keep access to the network for later attacks.

Levels

Level 0 (0 marks): No rewardable content.
Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)
Level 3 responses must cover methods, why staff might be vulnerable and the impact, applying each to the hospital; an answer that only names methods, or names them without applying them to the hospital, is limited to Level 1.
Do not accept malware infection (for example a virus arriving in an email attachment) on its own as a social engineering method, but do accept malware being installed as a result of a social engineering attack as an impact.

Example answers and how they were marked

Full marks6/6

An attacker could send a phishing email that appears to come from the hospital's IT team, as in the scenario, with a link to a fake login page that looks genuine. Staff on reception are busy and may follow the link without checking the sender address, so they type in their username and password, which the attacker then captures. The attacker could use that login to open patient records and steal, change or delete them, so a doctor could act on wrong information, and the hospital could be penalised under data protection legislation and lose the trust of its patients. Because the reception computer is shared and in a public area, an attacker could also use shoulder surfing to watch a password being typed, or phone reception and pretend to be an engineer to blag a password. Staff who have not had recent training would not spot either trick, so the attacks would succeed unless the hospital trains staff to check identity before giving out information.

Why: Level 3: a developed phishing method applied to the fake IT email and shared computer, linked to why staff are vulnerable (busy, no sender check) and then to impact (records stolen, changed or deleted; wrong treatment; penalty; reputation), with a second and third method (shoulder surfing, blagging) also applied and a sustained line of reasoning to a conclusion.

Some marks2/6

Attackers use phishing emails and shoulder surfing. Staff might trust a caller who says they are from IT. This could give the attacker access to patient records.

Why: Level 1: two methods are named and credited, with one basic reason staff are vulnerable (trusting someone who says they are from IT) and one basic impact (access to patient records), but each is a brief independent point with no development and little application to the hospital, so it does not reach Level 2.

No marks0/6

Social engineering is when a virus is downloaded from an email. The hospital should update its antivirus to stop it.

Why: Confuses social engineering with malware infection and gives a technical measure instead. It names no social engineering method, gives no reason for staff vulnerability and no impact of a social engineering attack, so there is no rewardable content.

Edexcel GCSE Computer Science (1CP2) Exam Questions

Build a paper

Practice paper

Questions by topic

2.1 Binary

2.2 Data representation

2.3 Data storage and compression

3.1 Hardware

3.2 Software

3.3 Programming languages

4.1 Networks

4.2 Network security

5.1 Environmental

5.2 Ethical and legal

5.3 Cybersecurity

More ways to revise Edexcel GCSE Computer Science (1CP2)