Edexcel GCSE Computer Science (1CP2) exam questions

Build a practice paper from 604 exam-style questions, each with its mark scheme and example answers. Print it, or answer it on paper and then open the mark schemes. Or browse the questions by topic.

Practice paper

10 questions · 26 marks

Pick again

1Multiple choice1 markPreventing Network Security Risks Swap Remove

Identify the method of access control that sets which files a user on a network is allowed to open.

[1 mark]

AFirewall
BPenetration testing
CSecurity lighting
DUser access levels

Mark scheme

D User access levels (1)
The only correct answer is D. The correct answer is User access levels.
A is not correct because a firewall checks network traffic against filtering rules to decide what data may enter or leave the network; it does not set which files a user is allowed to open
B is not correct because penetration testing is an authorised attack on a network to find vulnerabilities; it does not set which files a user is allowed to open
C is not correct because security lighting is physical security that deters intruders; it does not set which files a user is allowed to open

Example answers and how they were marked

Full marks1/1

D User access levels

Why: Correct option (1): user access levels set which files, folders and disks a user is allowed to open.

No marks0/1

C Security lighting

Why: Not credited: security lighting is a method of physical security that deters intruders, but it does not set which files a user is allowed to open.

No marks0/1

A Firewall

Why: Not credited: a typical misconception that a firewall controls what users can access; a firewall checks network traffic, not which files a user is allowed to open.

2Multiple choice1 markPreventing Network Security Risks Swap Remove

Identify the access control method that uses a fingerprint to verify a user.

[1 mark]

AAccess levels
BBiometric authentication
CPassword policy
DUsername and password

Mark scheme

B Biometric authentication (1)
The only correct answer is B. The correct answer is biometric authentication.
A is not correct because access levels control which files or folders a user can access
C is not correct because a password policy sets rules for creating strong passwords
D is not correct because a username and password verify a user but do not use a fingerprint

Example answers and how they were marked

Full marks1/1

B Biometric authentication

Why: Correct option: biometric authentication uses a physical characteristic such as a fingerprint to verify identity (1).

No marks0/1

D Username and password

Why: D is not correct because a username and password verify a user but do not use a fingerprint; this near-miss scores 0.

No marks0/1

C Password policy

Why: C is not correct because a password policy sets rules for creating strong passwords and does not use a fingerprint; scores 0.

3Short recall2 marksPreventing Network Security Risks Swap Remove

Networks can be protected using firewalls.

Define the term firewall.

[2 marks]

Mark scheme

Award one mark for each of the following up to a maximum of two marks:

A hardware or software device/program (1)
That monitors/checks/filters network traffic/packets (1)
That allows or blocks traffic/data using a set of rules (1)

Allow incoming and outgoing traffic / data entering or leaving a network.

Do not accept stops hackers or stops viruses on its own.

Do not accept answers that say it removes viruses or is anti-malware software.

Example answers and how they were marked

Full marks2/2

A firewall is hardware or software that monitors network traffic and uses rules to block packets.

Why: Hardware or software (1) and monitors/filters network traffic (1).

Some marks1/2

A firewall is a program that stops hackers from accessing a network.

Why: Program/software (1); stopping hackers alone is not a creditworthy definition of a firewall (0).

No marks0/2

A firewall is an anti-malware tool that removes viruses from a computer.

Why: It describes anti-malware, not a firewall that monitors/filters network traffic, so no marks.

4Describe2 marksNetwork Security Risks Swap Remove

An organisation stores sensitive data on its network.

Describe why network security is important for the organisation.

[2 marks]

Mark scheme

Award up to two marks for a linked description such as:

Protects sensitive/personal data (1) from being accessed/stolen by unauthorised users (1)
Prevents unauthorised access to the network/systems (1) so only permitted users can use the organisation's data (1)
Reduces the risk of malware/network attacks (1) which could damage systems or files (1)
Data is not lost (1) so the organisation can continue to operate (1)
Maintains the organisation's reputation (1) so customers trust it with their data (1)

A valid point on its own earns one mark; the second mark requires a linked development.

Allow 'prevents unauthorised access to the network' as a valid point (1) even if the consequence for the organisation is not stated.

Do not accept responses that only describe a method of protection (e.g. using a firewall) without saying why network security is important.

Do not accept 'keeps the network safe' or 'stops hackers' on its own.

Example answers and how they were marked

Full marks2/2

It protects the sensitive data (1) from being accessed by unauthorised users (1).

Why: Valid point (1) and linked development (1).

Some marks1/2

It prevents unauthorised access to the network.

Why: Valid point (1), but no linked development consequence for the organisation, so the second mark is not awarded.

No marks0/2

It stops hackers.

Why: Too vague and repeats the question; 'stops hackers' on its own is not accepted, so no mark is awarded.

5Describe2 marksPreventing Network Security Risks Swap Remove

A college stores student records on its network.

Describe how access levels help to protect the student records.

[2 marks]

Mark scheme

Award up to two marks for a linked description such as:

Each user is given an access level/permissions (1) so that staff can only open the records they need for their role (1)
Some staff are given read-only access (1) so that they cannot change/delete the records (1)
Full/administrator access is given to only a few trusted staff (1) so that only they can change permissions/edit all of the records (1)
Users are put into user groups (1) so that a whole group can be stopped from opening records it does not need (1)

Award the first mark for naming a specific mechanism, e.g. each user is given an access level, some staff have read-only access, only a few staff have administrator access (1).

Do not award a mark for a general statement that access levels are set/used to protect the records, or that the records are kept safe, with no named mechanism (0).

Allow read-only/view only, write access/edit rights.

Do not accept 'so unauthorised people cannot access them' as the development unless it says which users or which actions are restricted.

Do not accept responses about firewalls, encryption or physical security.

Do not accept 'access levels stop viruses/malware'.

Do not award a second mark for repeating the same restriction in different words.

Example answers and how they were marked

Full marks2/2

Some staff are given read-only access to the student records, so they can look at the records but cannot change or delete them.

Why: Named mechanism: some staff have read-only access (1), linked to the restriction that they cannot change or delete the records (1).

Some marks1/2

Each member of staff has an access level, so unauthorised people cannot get into the records.

Why: Named mechanism: each user is given an access level (1). The development 'unauthorised people cannot get into the records' does not say which users or actions are restricted, so it earns no second mark.

No marks0/2

Access levels stop malware from deleting the student records.

Why: Misconception: access levels control what users can do, not malware, so nothing creditworthy is given.

6Describe2 marksPreventing Network Security Risks Swap Remove

A company sends customer details between two offices over the internet.

Describe how encryption helps to protect the customer details if the data is intercepted.

[2 marks]

Mark scheme

Award up to two marks for a linked description such as:

(Customer details are) scrambled/turned into ciphertext (using a key) before they are sent over the internet (1) so they cannot be understood/read if intercepted (1)
A key is needed to decrypt the data (1) so an interceptor cannot read the customer details without it (1)
The key is kept secret/is only shared with the receiver (1) so an attacker cannot decrypt the intercepted data (1)

For both marks, the expansion must follow/associate with the statement.

Do not accept 'encryption stops the data being stolen' (encryption protects data from being read if intercepted; it does not stop data being stolen).

Do not accept 'encryption stops hackers/viruses' on its own; the response must say the data cannot be read without the key.

Do not accept responses about firewalls or access control.

Example answers and how they were marked

Full marks2/2

The customer details are turned into ciphertext using a key before they are sent over the internet. If the data is intercepted, it cannot be read without the key.

Why: States that customer details are turned into ciphertext using a key before being sent (1) and develops it to say intercepted data cannot be read without the key (1).

Some marks1/2

Encryption scrambles the customer details before they are sent over the internet.

Why: Gives the point that the customer details are scrambled before being sent (1) but does not develop that they cannot be read if intercepted.

No marks0/2

Encryption stops the details being stolen from the network.

Why: Misconception: encryption protects data from being read if intercepted; it does not stop data being stolen. The mark scheme explicitly does not accept this.

7Explain2 marksNetwork Security Risks Swap Remove

A security team carries out black box penetration testing on a company's network.

Explain how black box penetration testing can identify vulnerabilities in the company's network.

[2 marks]

Mark scheme

Award up to two marks for a linked explanation such as:

Testers have no inside knowledge of the network (1) so they attack it in the same way as an external hacker (1)
Testers try to gain access without login details (1) so a weakness they find is one an outsider could also exploit (1)
Testers deliberately try to break in (1) so weaknesses are found and fixed before a malicious hacker exploits them (1)
Testers do not know the network layout (1) so they test for weaknesses that are visible to an outsider (1)
Testers act as ethical hackers with no inside knowledge (1) so they find weaknesses in the same way as an external attacker (1)

For both marks, the expansion must follow/associate with the statement.

A credited point without a linked reason earns 1 mark only.

Allow 'no prior knowledge of the system' or 'no login details' as equivalent to having no inside knowledge.

Allow the testers to be described as ethical hackers, provided the answer says they have no inside knowledge / act as an outsider.

Do not accept 'they hack the network' without saying they have no inside knowledge or act as an outsider.

Do not accept 'they are given passwords' as this describes white box testing.

Do not award credit for white box testing.

Example answers and how they were marked

Full marks2/2

The testers have no inside knowledge, so they try to break in like an external hacker.

Why: Point (1) and linked reason (1).

Some marks1/2

The testers have no passwords or network information.

Why: Valid point (1) but no linked reason, so 1 mark.

No marks0/2

The testers are given the usernames and passwords so they can find weaknesses.

Why: Misconception: this describes white box testing, not black box testing.

8Explain2 marksPreventing Network Security Risks Swap Remove

A school keeps its network servers in a locked cabinet.

Explain one reason why the locked cabinet helps keep the school network secure.

[2 marks]

Mark scheme

Award up to two marks for a linked explanation such as:

Only staff with the key can open the cabinet (1) so unauthorised people cannot touch/steal the servers (1)
Someone cannot disconnect/remove a server (1) because unauthorised people cannot open the cabinet (1)
The servers are protected from damage (1) because the cabinet is locked so people cannot reach them (1)

For both marks, the expansion must follow/associate with the statement.

Accept 'keeps the servers safe from damage' as the point (1); a linked reason about the locked cabinet is needed for the second mark.

Do not accept answers about software protection such as anti-malware or firewalls; these are not physical security.

Do not accept 'it stops hackers' without saying how the locked cabinet prevents physical access.

Do not accept 'it keeps the servers safe' on its own unless it names what they are safe from (damage/theft/tampering) as the point.

Do not accept an answer that only repeats the question, e.g. 'the servers are secure because they are in a locked cabinet'.

Example answers and how they were marked

Full marks2/2

Only staff with the key can open the cabinet (1) so unauthorised people cannot touch or steal the servers (1)

Why: Linked point (1) and reason (1).

Some marks1/2

It keeps the servers safe from damage.

Why: Point only (1); no linked reason about the locked cabinet is given.

No marks0/2

It stops viruses from reaching the servers.

Why: No credit: a locked cabinet is physical security, not anti-malware protection.

9Discuss6 marksNetwork Security Risks Swap Remove

A dental practice stores patient records on its network. Staff have received emails asking them to reset their passwords. The practice wants to explain to staff why network security matters.

Discuss the importance of network security for the dental practice.

Your answer should include:

the data the practice holds
the possible consequences of a security breach
why staff behaviour matters, following the emails the staff have received

[6 marks]

Mark scheme

Indicative content

The data the practice holds

Patients' dental records and personal details must stay confidential, so an intruder reading them would take away patients' privacy.
The practice also holds addresses, appointment times and payment details, which an attacker could use to commit fraud.
Records must be accurate and available during an appointment, so malware that changed a record could lead a dentist to give the wrong treatment.
Treatment notes and X-rays have to be kept intact as a record of care, so tampering would leave the practice unable to show what treatment was given.

Possible consequences of a security breach

Ransomware could encrypt the practice's files, so appointments are cancelled and patients wait in pain while the network is restored.
If records were stolen, the practice could be investigated and fined under data protection legislation, as well as paying to repair its systems.
Patients who lost trust after a breach might register with another surgery, so the practice would lose income.
Staff could be locked out of the appointment system and have to book patients on paper, which slows the service down.

Why staff behaviour matters

The emails asking staff to reset their passwords may be phishing, so staff must not enter their login details on the page the email links to.
If one member of staff gives away a password, an attacker can log in as that employee and read every patient record that employee can see, so passwords must never be shared.
Staff must lock their screen when they leave reception, otherwise a visitor could read the records left on display.
Staff should report the emails and any unexpected pop-ups straight away, so the practice can block the sender and check the network for other signs of an attack.

Levels

Level 0 (0 marks): No rewardable content.
Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 requires an explained consequence of a breach and an explained reason why staff behaviour matters, both linked to the dental practice.

Do not award credit for naming a protection method, such as a firewall or antivirus, without explaining why security matters to the practice.

Example answers and how they were marked

Full marks6/6

The practice stores dental records, addresses and payment details for every patient, so a breach would expose private information that patients expect the surgery to keep confidential. If a record were changed or deleted, a dentist could give the wrong treatment, so the data must also be accurate. The emails the staff have received asking them to reset their passwords look like a phishing attempt. If a receptionist typed their login into the page the email links to, the attacker could sign in as that employee and copy the records that employee can see. Patients who heard about this would lose trust and might move to another surgery, and the practice could be investigated and fined under data protection legislation as well as paying to repair the network. A ransomware attack would encrypt the appointment system, so appointments would be cancelled until backups were restored. This is why staff must check such emails, never share passwords and lock their screens, because one careless click could put every patient's record at risk.

Why: Level 3: sustained, coherent reasoning applied to the practice. Data held is explained (confidentiality, accuracy), consequences are developed (loss of trust, a fine, ransomware cancelling appointments) and staff behaviour is explained through the phishing emails, password sharing and screen locking.

Some marks2/6

Network security is important to keep data safe. The practice has patient data, so it should be protected. If hackers get in they could steal the data or install malware on the computers. Staff should use passwords so that nobody else can log in.

Why: Level 1: basic, independent points with little linkage and only a general mention of 'patient data'; no consequence is developed and the staff point is not linked to the emails the practice received.

Some marks1/6

Network security is important because it stops viruses getting onto the computers. The practice should install a firewall and antivirus software so that nobody can hack it.

Why: Level 1: one basic, generic point that names protection methods but never says why security matters to the dental practice, its records or its staff, which the guidance says earns no further credit.

10Discuss6 marksPreventing Network Security Risks Swap Remove

A hospital trust runs a network that stores patient records. Doctors, nurses and reception staff all use the network, but they do not all need to see the same records.

Discuss the use of access control to protect the network and the patient records.

Your answer should consider:

methods of access control
how access levels protect the records
the limitations of access control.

[6 marks]

Mark scheme

Indicative content

Methods of access control

Usernames and passwords stop people who do not have an account from logging on to the network.
A password policy requiring a minimum length, upper and lower case letters, symbols and regular changes makes passwords harder to guess.
Access rights set on folders and files mean each member of staff can only open the records they need for their job.
Biometric methods such as a fingerprint or facial recognition verify that the person logging on is who they claim to be.

How access levels protect the records

Reception staff can see appointment details but not medical histories, so an account that is compromised exposes less sensitive data.
Only senior staff are given permission to change or delete a record, which protects the accuracy of the patient records.
Giving a nurse read-only access to a ward's records prevents accidental changes to them.
If a password is stolen, the damage is limited to what that user was allowed to see and do.
Logging each user in separately means actions on the network can be traced back to an account.

Limitations of access control

Passwords can be guessed, phished or shared with colleagues, so someone else can log on with a user's access.
Staff may write passwords down or leave a logged-on computer unattended.
Access rights must be set correctly; a mistake can give a user far more access than their job needs.
Access control does not stop an authorised member of staff deliberately misusing records they are allowed to see.
A fingerprint reader can reject a legitimate user or be fooled by a copy of a fingerprint.

Levels

Level 0 (0 marks): No rewardable content.
Level 1 (1–2 marks): Basic, independent points are made, showing elements of understanding of key concepts/principles of computer science. (AO1) The discussion will contain basic information with little linkage between points made or application to the context. (AO2)
Level 2 (3–4 marks): Demonstrates adequate understanding of key concepts/principles of computer science. (AO1) The discussion shows some linkages and lines of reasoning with some structure and application to the context. (AO2)
Level 3 (5–6 marks): Demonstrates comprehensive understanding of key concepts/principles of computer science to support the discussion being presented. (AO1) The discussion is well developed, with sustained lines of reasoning that are coherent and logically structured, and which clearly apply to the context. (AO2)

Level 3 responses must cover how access levels protect the records as well as methods and limitations.

Do not accept an acceptable use policy, a firewall or anti-malware software as a method of access control.

Example answers and how they were marked

Full marks6/6

Every member of staff logs on with a username and password, so only people with an account can use the network. A password policy makes staff choose a long password with upper and lower case letters and symbols, and change it regularly, which makes the password harder to guess. The trust also sets access rights on folders, so a receptionist can open the appointment system but not a patient's medical history, and only senior staff can change or delete a record, which keeps the records accurate. Fingerprint scanners could be used on the ward computers so a member of staff cannot log on as someone else. The weakness is that passwords can be shared or phished, so someone else could log on as a nurse. If access rights are set wrongly, a user could see far more than their job needs, and access control cannot stop a doctor deliberately misusing a record they are allowed to see.

Why: Covers several methods, applies access levels to reception, nursing and senior staff to show how records are protected, and gives limitations including sharing and incorrect rights, with coherent reasoning tied to the hospital (Level 3).

Some marks3/6

The hospital uses usernames and passwords to stop people logging on. It can also use access levels so staff can only see the records they need, such as reception staff not seeing medical histories. This keeps the patient records safe from people who should not see them.

Why: Methods and one applied benefit are given with some linkage, but limitations are missing, so the answer stays at Level 2.

Some marks2/6

Access control means staff have to log in with a password. The hospital should have an acceptable use policy so staff know the rules. This stops hackers getting into the network.

Why: One basic point about passwords is made (Level 1). The acceptable use policy is not a method of access control, so it earns nothing and shows the confusion between a policy and a technical control.

Edexcel GCSE Computer Science (1CP2) Exam Questions

Build a paper

Practice paper

Questions by topic

2.1 Binary

2.2 Data representation

2.3 Data storage and compression

3.1 Hardware

3.2 Software

3.3 Programming languages

4.1 Networks

4.2 Network security

5.1 Environmental

5.2 Ethical and legal

More ways to revise Edexcel GCSE Computer Science (1CP2)