Edexcel GCSE Computer Science (1CP2) Exam Questions

• B An ethical hacker (1)
• The only correct answer is B. The correct answer is ethical hacker.
• A is not correct because a black hat hacker breaks into a network without the owner's permission
• C is not correct because a malicious insider misuses the access they already have in order to cause harm
• D is not correct because a virus writer creates malware to infect systems rather than testing a network with permission

• C Penetration testing (1)
• The only correct answer is C. The correct answer is penetration testing.
• A is not correct because access control limits what users can access
• B is not correct because a firewall filters network traffic
• D is not correct because physical security protects hardware from theft or damage

• D Locked door (1)
• The only correct answer is D. The correct answer is locked door (accept 'door with lock').
• A is not correct because anti-malware detects and removes malicious software; it is a software control, not physical security
• B is not correct because CCTV monitors and records activity but does not prevent someone entering
• C is not correct because encryption scrambles data so it cannot be read without a key; it is not physical security

• B Biometric authentication (1)
• The only correct answer is B. The correct answer is biometric authentication.
• A is not correct because access levels control which files or folders a user can access
• C is not correct because a password policy sets rules for creating strong passwords
• D is not correct because a username and password verify a user but do not use a fingerprint

Award one mark for any of the following up to a maximum of two marks:

• To identify possible entry points into the system/network (1)
• To identify the targets of potential attacks (1)
• To test whether existing security controls/protections work (1)
• To report the findings so that weaknesses can be fixed (1)

Accept 'to simulate an attack on the organisation's own network' only when it also states that this is done to find weaknesses, e.g. 'simulate an attack to find weaknesses' (1)

Do not accept 'to simulate an attack' on its own, as it does not say what the testing is for

Do not accept 'to hack the network', as this repeats the method rather than giving an aim

Do not accept 'to steal data' or 'to gain unauthorised access', as these are the aims of an attacker

Award one mark for any of the following up to a maximum of two marks:

• Usernames and passwords/user accounts/PINs (1)
• Biometric authentication e.g. fingerprint/facial recognition/retinal scan (1)
• User access levels/access rights/permissions (1)
• Security tokens/security cards used to authenticate a user (1)
• Two-factor authentication e.g. password plus a code sent to a phone (1)

Allow passwords on their own as a method.

Do not award two marks for passwords and usernames and passwords together; these are the same method.

Allow a security token/card because it authenticates the user; do not accept a card used only for physical access such as a door entry card.

Allow two-factor authentication as a method in its own right.

Do not accept physical security methods such as locks, CCTV or security guards.

Do not accept a firewall or anti-malware, as these are not access control.

Award one mark for any of the following up to a maximum of two marks:

• A hardware or software device/program (1)
• That monitors/checks/filters network traffic/packets (1)
• That allows or blocks traffic/data using a set of rules (1)

Allow incoming and outgoing traffic / data entering or leaving a network.

Do not accept stops hackers or stops viruses on its own.

Do not accept answers that say it removes viruses or is anti-malware software.

Award up to two marks for a linked explanation such as:

• The tester has the bank's permission to access the system (1) so the testing is not an unauthorised/illegal act (1)
• The bank agrees the scope/limits of the test (1) so important systems are not damaged/put at risk (1)
• The bank knows when the test is happening (1) so it does not mistake it for a real cyber attack (1)

For both marks, the expansion must follow/associate with the statement.

A statement on its own (e.g. 'the bank knows when testing happens') earns the first mark only; the second mark requires the linked reason.

Allow 'so it is legal' / 'so it is not a crime' where the answer makes clear that the access is authorised/permitted by the bank.

Allow 'without permission it would be a crime/illegal' as the linked reason for an authorisation point.

Do not accept 'so the hacker does not get caught' as this is not the purpose of permission.

Do not accept 'hacking is illegal' on its own without linking it to the need for the bank's permission.

Award one mark for any of the following up to a maximum of three marks:

• Locks on doors/cabinets (1)
• CCTV/security cameras (1)
• Security guards/security personnel (1)
• ID cards/badges (1)
• Turnstiles/gates (1)
• Fences/walls/barbed wire (1)
• Intruder alarms (1)
• Security lighting (1)
• Security tags on equipment (1)
• Biometric locks/fingerprint door locks (1)
• Keypads on doors (1)

Allow electronic/key card door locks as locks on doors.

Only award one mark where a candidate gives more than one of door locks/biometric locks/keypads, as all of these describe locking a door.

Accept ID cards/badges and biometric locks/fingerprint door locks as physical security methods, as they control who can physically enter.

Do not accept firewalls, passwords, usernames, anti-malware or encryption, as these are not physical methods.

Indicative content

Methods of physical security

• Locks on the doors and on each server rack.
• Swipe cards or a biometric scanner on the door into the server room.
• A security guard at reception who signs visitors in and out.
• CCTV cameras covering the entrance and the server room.
• Intruder alarms and movement sensors inside the room.
• Security lighting and a fence around the outside of the building.

How each method protects the servers

• A locked rack means even someone who gets into the room cannot remove a disk or unplug a server.
• A swipe card system only lets authorised staff into the server room, so visitors cannot reach the servers.
• A guard can stop a visitor following a member of staff through the door (tailgating).
• CCTV deters intruders and provides evidence to identify anyone who does break in.
• An alarm alerts the guard or the police if someone enters the room outside working hours.

Limitations of physical security

• Physical security does not stop an attack over the network, such as malware or a hacker using a stolen password.
• A member of staff with a valid card can still damage a server or steal data from it.
• Cards can be lost or copied, and a copied fingerprint can fool some scanners.
• CCTV only records an incident; it does not stop it happening, and someone has to watch the footage.
• Guards, alarms and CCTV cost money to buy and to maintain.
• A person can hold a door open for someone behind them.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 responses must give more than one method, explain how the method protects the servers and give at least one limitation.

Do not accept a firewall, anti-malware software or passwords as methods of physical security.