Edexcel GCSE Computer Science (1CP2) Exam Questions

• C Locks files and demands payment (1)
• The only correct answer is C. The correct answer is locks files and demands payment. Accept encrypts files and asks for a ransom / locks files until a payment is made.
• A is not correct because copying itself into other files is what a virus does
• B is not correct because hiding inside a useful program is what a Trojan does
• D is not correct because recording every key press made is what a keylogger does

• A It cannot detect newer malware (1)
• The only correct answer is A. The correct answer is it cannot detect newer malware.
• B is not correct because compatibility with the operating system is not a technical vulnerability
• C is not correct because unpatched software is a separate technical vulnerability, not a fault in the anti-malware
• D is not correct because a firewall is a separate network protection tool and does not scan files for malware

• A Baiting (1)
• The only correct answer is A. The correct answer is baiting.
• B is not correct because blagging (pretexting) obtains information by deceiving someone
• C is not correct because shoulder surfing is watching someone enter their information
• D is not correct because scareware frightens a user with a fake warning

Award one mark for any of the following up to a maximum of two marks:

• Software/a program (1)
• Designed/intended to cause harm/damage (to a computer system or its data) (1)
• Designed/intended to gain unauthorised access to a system or its data (1)

Award a maximum of one mark for the purpose: either harm/damage or unauthorised access, not both.

Allow 'harmful program/software' for both marks (software and harm/damage).

Allow 'malicious' as equivalent to intended to cause harm/damage, so 'malicious software' earns both marks.

Do not accept 'bad software' or a restatement of malware, as no purpose is given.

Do not accept a named type of malware alone (e.g. virus, worm, Trojan); this is an example of malware, not a definition.

Do not accept 'hacking' or 'a threat' alone; neither states a harmful purpose of software.

Do not accept 'a program that spreads' on its own; spreading is not the same as causing harm or gaining unauthorised access.

Award one mark for any of the following up to a maximum of two marks:

• Looking/leaning/watching over someone's shoulder (to see their screen/keypad) (1)
• Using a CCTV camera to view a screen/keypad (1)
• Filming/photographing a screen/keypad with a mobile phone/camera (1)
• Using binoculars to view a screen/keypad (1)
• Standing close to someone at an ATM/cash machine to see their PIN (1)

Do not accept phishing.

Do not accept guessing a password.

Award up to two marks for a linked description such as:

• Encrypts the files (1) so the user cannot open/read the data (1)
• Locks the files/data (1) so it can only be unlocked using a decryption key/code held by the attacker (1)
• Encrypts the files (1) so the data can only be recovered from a backup or by paying the ransom (1)

Allow 'it encrypts the files' on its own as the first point (1). The second mark needs a development of what this does to the data.

Do not award 'locks the computer'/'stops you using it' on its own, as this does not say what happens to the data.

Do not award 'it deletes the files' on its own, as this does not describe how the data is held to ransom.

Do not accept descriptions of other types of malware, e.g. a Trojan or a keylogger.

Award up to two marks for a linked description such as:

• Obtaining/gaining confidential/personal information (such as passwords/usernames/bank details) (1) by manipulating/tricking a person into providing it (1)
• Pretending to be a trusted person/organisation (1) to persuade a user to reveal information (1)
• Exploiting human trust (1) to persuade a person to reveal information/give access to a system (1)
• Using psychological/confidence tricks (1) to get a person to break normal security procedures (1)

Allow impersonation (pretending to be a trusted person/organisation) as the linked development of the first bullet, e.g. tricking a user by pretending to be from their bank (1) to obtain their login details (1).

Do not accept naming a social engineering technique (phishing/shoulder surfing/blagging) without describing how a person is manipulated/tricked.

Do not accept responses that describe a technical attack, such as installing malware or guessing passwords, without tricking a person.

Do not accept 'it is an attack on people/users' with no method of obtaining the information.

Award up to two marks for a linked description such as:

• Sends an email/text message pretending to be from a trusted organisation/bank (1) asking the user to confirm/provide personal details/login details (1)
• Includes a link to a fake website (1) where the user enters their login details/personal information (1)
• Sends a message claiming there is a problem with the user's account (1) so the user replies with their personal information (1)

Allow 'email/text message/SMS' for 'email/text message'.

Allow 'bank/company/organisation' for 'trusted organisation'.

Allow 'username and password/login details/personal details' for 'personal details/login details'.

Do not award a mark for 'sends an email' on its own, with no deception or request for information.

Do not award a second mark for 'sends a fake email' that does not say how the personal information is obtained.

Do not award descriptions that only involve malware (e.g. a keylogger or Trojan) or a malicious website, with no deceptive message to the user.

Do not accept descriptions of other social engineering methods, such as shoulder surfing.

Award up to two marks for a linked description such as:

• Tricks a legitimate user/employee into revealing their login details/credentials (1) so the attacker can use the account to access the system/data (1)
• Exploits human trust/error (1) so technical security measures such as firewalls/passwords can be bypassed (1)
• Convinces a user that a message/website is genuine/is from a trusted organisation (1) so the user gives away confidential information/data (1)
• Gets a user to follow a link/open an attachment (1) so malware is installed on the system (1)

Allow 'deceives/manipulates/persuades a user' as the human-factor mechanism.

For the second mark, the development must give a consequence beyond the trick itself, such as access to the system/data or bypassed security.

Do not award generic statements such as 'it steals data', 'it causes harm' or 'it hacks the system' that do not name the human-factor mechanism.

Do not accept answers that only name a social engineering method, such as phishing, without saying how it threatens the system.

Do not accept answers about malware or technical attacks, such as a virus deleting files.

Award up to two marks for a linked explanation such as:

• The attacker targets people/users rather than the technology (1) because users can be tricked/persuaded into giving confidential information/access (1)
• The attacker does not need to bypass/circumvent the technical security (1) because a user can be tricked into giving them the password/details/access (1)
• The attacker can pretend to be a trusted person/organisation (1) so the user believes the request is genuine and gives information/access (1)
• The attacker can contact many employees at once (1) so is more likely to find someone who believes the message and gives information/access (1)

A point on its own can earn one mark; the second mark requires a linked reason.

For both marks, the expansion must follow/associate with the statement.

Do not accept 'people are the weakest link' on its own without saying why/how users can be exploited.

Do not accept answers that only restate that social engineering targets people without a reason.

Do not accept 'users make mistakes' without saying how an attacker exploits this to get information/access.

Do not accept naming a social engineering method, such as phishing or pretexting, without a linked reason why it succeeds.

Do not award marks for answers about technical vulnerabilities such as an out-of-date firewall, out-of-date anti-malware or unpatched software, as these are not social engineering.

Do not award the same reason twice, e.g. 'the user is tricked' can only support one point.