Edexcel GCSE Computer Science (1CP2) Exam Questions

• B Reports the weakness to the company so it can be fixed (1)
• The only correct answer is B. The correct answer is reporting the weakness to the company so it can be fixed.
• A is not correct because an ethical hacker informs the company and helps it to fix the weakness rather than fixing it without telling the company
• C is not correct because selling a weakness to another company is criminal, not ethical hacking
• D is not correct because using a weakness to access data is what a black hat hacker does

• B Biometric authentication (1)
• The only correct answer is B. The correct answer is biometric authentication.
• A is not correct because access levels control which files or folders a user can access
• C is not correct because a password policy sets rules for creating strong passwords
• D is not correct because a username and password verify a user but do not use a fingerprint

Award one mark for any of the following up to a maximum of two marks:

• Using hacking techniques to (attempt to) access a computer system/data (1)
• With the permission/authorisation of the owner/organisation (1)
• To find/report security weaknesses/vulnerabilities (1)

Allow 'to test the security of a system' for the third bullet.

Allow 'white hat hacking' as a whole answer only if permission and finding/reporting weaknesses are both stated.

Do not accept 'hacking for good' on its own.

Do not accept gaining unauthorised/illegal access (black-hat hacking), which does not earn the hacking techniques mark.

Award one mark for any of the following up to a maximum of two marks:

• Penetration testing/pen test (1)
• An authorised/simulated attack on the network to find weaknesses (1)
• Ethical hacking/using an ethical hacker to test the network (1)
• A person authorised by the organisation tries to gain access to the network and reports the weaknesses found (1)

Do not award two marks for the same method described twice.

Do not accept hacking on its own.

Do not accept firewalls, anti-malware or passwords.

Do not accept vulnerability scanning on its own.

Award up to two marks for a linked description such as:

• The firewall checks/examines incoming packets/traffic (1) to see where they are from/are going (1)
• It compares packets/traffic against a set of rules/filters (1) to decide whether to allow/block/drop them (1)
• It can block/drop packets from a particular IP address (1) so traffic from a known malicious source cannot enter the network (1)
• It can block/drop access to certain ports (1) so services that are not needed cannot be used from outside (1)

Accept responses that describe the firewall restricting access by IP address or port, even though this limits access to the network.

Do not accept a bare statement that the firewall blocks/filters unwanted traffic, with no description of how it decides what to block.

Do not accept 'stops hackers/viruses' without saying how traffic is checked or blocked.

Do not accept responses about physical security or access control, such as usernames/passwords or access levels.

Award up to two marks for a linked description such as:

• Each user is given an access level/permissions (1) so that staff can only open the records they need for their role (1)
• Some staff are given read-only access (1) so that they cannot change/delete the records (1)
• Full/administrator access is given to only a few trusted staff (1) so that only they can change permissions/edit all of the records (1)
• Users are put into user groups (1) so that a whole group can be stopped from opening records it does not need (1)

Award the first mark for naming a specific mechanism, e.g. each user is given an access level, some staff have read-only access, only a few staff have administrator access (1).

Do not award a mark for a general statement that access levels are set/used to protect the records, or that the records are kept safe, with no named mechanism (0).

Allow read-only/view only, write access/edit rights.

Do not accept 'so unauthorised people cannot access them' as the development unless it says which users or which actions are restricted.

Do not accept responses about firewalls, encryption or physical security.

Do not accept 'access levels stop viruses/malware'.

Do not award a second mark for repeating the same restriction in different words.

Award up to two marks for a linked explanation such as:

• Patient records are kept private/confidential (1) because only authorised staff are allowed to access them (1)
• Patient records stay accurate/complete (1) because unauthorised users are prevented from changing/deleting them (1)
• Hackers are kept out of the network (1) because a firewall/access control blocks unauthorised access to the patient records (1)
• Patient records are available when staff need them (1) because the network is protected from attacks that could stop it working (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept 'to keep data safe', 'to stop hackers' or 'it stops viruses' on its own, without saying what is protected or how.

Accept 'patient data/records/details' as the same point.

Do not award credit for an answer that repeats the question, e.g. 'network security is important so the network is secure'.

Award up to two marks for a linked explanation such as:

• The tester has the bank's permission to access the system (1) so the testing is not an unauthorised/illegal act (1)
• The bank agrees the scope/limits of the test (1) so important systems are not damaged/put at risk (1)
• The bank knows when the test is happening (1) so it does not mistake it for a real cyber attack (1)

For both marks, the expansion must follow/associate with the statement.

A statement on its own (e.g. 'the bank knows when testing happens') earns the first mark only; the second mark requires the linked reason.

Allow 'so it is legal' / 'so it is not a crime' where the answer makes clear that the access is authorised/permitted by the bank.

Allow 'without permission it would be a crime/illegal' as the linked reason for an authorisation point.

Do not accept 'so the hacker does not get caught' as this is not the purpose of permission.

Do not accept 'hacking is illegal' on its own without linking it to the need for the bank's permission.

Award up to two marks for a linked explanation such as:

• If the data is intercepted, it cannot be read/understood (1) because it is scrambled and the attacker does not have the key (1)
• Only the intended receiver can decrypt the data (1) because they have the secret/shared decryption key (1)
• Data cannot be read if it is stolen/lost (1) because it can only be decrypted with the key (1)

For both marks, the expansion must follow/associate with the statement.

A point on its own earns one mark; the second mark is only awarded for a reason linked to that point.

Do not accept 'because it is encrypted' as the reason, as this repeats the point.

Do not accept 'it stops the data being intercepted' because encryption does not prevent interception.

Do not accept 'it stops hackers' on its own without saying why the data cannot be read or used.

Do not accept vague answers such as 'it is more secure' or 'it keeps data safe' without saying how the data is protected, e.g. that it cannot be read without the key.

Indicative content

Methods of physical security

• Locks on the doors and on each server rack.
• Swipe cards or a biometric scanner on the door into the server room.
• A security guard at reception who signs visitors in and out.
• CCTV cameras covering the entrance and the server room.
• Intruder alarms and movement sensors inside the room.
• Security lighting and a fence around the outside of the building.

How each method protects the servers

• A locked rack means even someone who gets into the room cannot remove a disk or unplug a server.
• A swipe card system only lets authorised staff into the server room, so visitors cannot reach the servers.
• A guard can stop a visitor following a member of staff through the door (tailgating).
• CCTV deters intruders and provides evidence to identify anyone who does break in.
• An alarm alerts the guard or the police if someone enters the room outside working hours.

Limitations of physical security

• Physical security does not stop an attack over the network, such as malware or a hacker using a stolen password.
• A member of staff with a valid card can still damage a server or steal data from it.
• Cards can be lost or copied, and a copied fingerprint can fool some scanners.
• CCTV only records an incident; it does not stop it happening, and someone has to watch the footage.
• Guards, alarms and CCTV cost money to buy and to maintain.
• A person can hold a door open for someone behind them.

Levels

• Level 0 (0 marks): No rewardable content.
• Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
• Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
• Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 responses must give more than one method, explain how the method protects the servers and give at least one limitation.

Do not accept a firewall, anti-malware software or passwords as methods of physical security.