Exchanging Data: Databases, Networks and Web Technologies - Worksheets, Questions and Revision

13 original exam-style questions - 5 pages of questions with a full mark scheme - free printable PDF.

Download PDF Jump to mark scheme (page 6)Read the revision guide

Next in this strand

Revision Library

revisionlibrary.co.uk

A-Level · Component 01: Computer Systems - Exchanging Data

A1.3 Exchanging Data: Databases, Networks and Web Technologies

OCR H446 · Calculators not allowed · about 115 minutes

Total Marks

Name: _______________________________ Date: ____ / ____ / ______

Answer ALL questions. Show all your working.

A digitised photograph and a scanned black-and-white text document both need to be compressed for storage on a school's shared drive.

(a)Define lossy compression and lossless compression.(2)

(b)A single row of pixels from a bitmap image has the following greyscale values, read left to right:
3, 3, 3, 3, 3, 7, 7, 2, 2, 2, 2, 2, 2, 9
Apply run-length encoding (RLE) to this row of data. Give your answer as a list of (count, value) pairs.(3)

(c)State one type of file for which lossy compression would be a suitable choice and justify your answer.(2)

(Total for Question 1 is 7 marks)

A programmer is implementing a hash table of size 10 (indices 0 to 9) using the hash function h(k) = k MOD 10, with collisions resolved by linear probing (checking the next index upward, wrapping to 0 if necessary).

(a)Explain the purpose of a hash function when storing data in a hash table.(2)

(b)The keys 23, 7, 17 and 13 are inserted, in that order, into the empty hash table. Show the index at which each key is placed, and give the final contents of the whole table (indices 0 to 9).(4)

(c)State one drawback of using modulo division as a hash function.(1)

(Total for Question 2 is 7 marks)

A retailer's website uses HTTPS to protect data sent between a customer's browser and the web server.

(a)Distinguish between symmetric encryption and asymmetric encryption.(3)

(b)Explain why HTTPS uses asymmetric encryption only to establish a shared secret key at the start of the connection, and then switches to symmetric encryption for the rest of the session.(3)

(c)A simple Caesar cipher shifts every letter of the plaintext forward by 3 places in the alphabet (wrapping Z back to C). Encrypt the plaintext NETWORK using this cipher.(2)

(d)State one weakness of the Caesar cipher as a method of encryption.(1)

(Total for Question 3 is 9 marks)

A sixth form college stores exam entry data in a single unnormalised table. An extract is shown below, where each student record contains a repeating group of module entries:

StudentID	StudentName	TutorGroup	{ModuleCode, ModuleName, Grade}
1001	Amara Okafor	12A	{(COMP101, Computer Systems, A), (COMP102, Programming, B)}
1002	Liam Fraser	12B	{(COMP101, Computer Systems, B)}

(a)State why the table above is not in first normal form (1NF).(2)

(b)Convert the table into 1NF. Show the resulting table, including its primary key.(3)

(c)The 1NF table from part (b) contains partial dependencies. Identify the partial dependencies present and produce a set of tables in second normal form (2NF), stating the key of each table.(4)

(d)Explain the purpose of converting a database to third normal form (3NF), and state whether any further transitive dependency needs to be removed from the tables produced in part (c).(3)

(Total for Question 4 is 12 marks)

A college database contains the following relational tables:
Student(StudentID, Name, TutorGroup)
Module(ModuleCode, ModuleName)
Enrolment(StudentID, ModuleCode, Grade)
StudentID is the primary key of Student, ModuleCode is the primary key of Module, and (StudentID, ModuleCode) is the composite primary key of Enrolment, with StudentID and ModuleCode as foreign keys.

(a)Write an SQL query to list the Name of every student enrolled on the module with ModuleCode 'COMP101' who achieved a Grade of 'A'.(3)

(b)Write an SQL query to display each TutorGroup along with the number of students in that tutor group.(3)

(c)Write an SQL statement to add a new column called DateOfBirth, of type DATE, to the Student table.(2)

(Total for Question 5 is 8 marks)

A bank's database processes transactions using the ACID properties.

(a)State what each of the four letters in ACID stands for, giving a brief description of each property.(4)

(b)Priya Sharma and her partner share a joint bank account with a balance of 500 pounds. Both attempt to withdraw 300 pounds at almost the same time from different cash machines. Explain, using this example, how the Isolation property prevents an incorrect final balance being recorded.(3)

(c)Explain why record locking is used in transaction processing systems.(2)

(Total for Question 6 is 9 marks)

A school in Bristol is extending its network to a new sports hall approximately 200 metres from the main building.

(a)Compare a star topology with a mesh topology, giving one advantage and one disadvantage of each.(4)

(b)State one factor, other than cost, that the school should consider when choosing a transmission medium for the 200 metre link to the sports hall, and justify why it is relevant in this scenario.(2)

(c)Explain one advantage of using fibre optic cable, rather than copper cable, for this 200 metre link.(2)

(Total for Question 7 is 8 marks)

A student's laptop uses the TCP/IP protocol stack to request a web page from a server.

(a)Name the four layers of the TCP/IP model, in order from the layer closest to the application to the layer closest to the physical transmission medium.(4)

(b)Explain the role of the Transport layer when the laptop requests the web page.(3)

(c)Explain what happens if one segment of the web page data is lost in transit, with reference to TCP.(3)

(Total for Question 8 is 10 marks)

A device on a home network has IPv4 address 192.168.1.14 and MAC address 00-1A-2B-3C-4D-5E. The device sends a request to a web server on the internet.

(a)Convert the IPv4 address 192.168.1.14 to its full binary representation, showing each octet.(4)

(b)Explain the difference between how the MAC address and the IP address are used to deliver the device's data across the internet to the web server.(4)

(c)Explain the function of a router in forwarding this data toward the web server.(3)

(Total for Question 9 is 11 marks)

A college admissions website used by Grange Sixth Form College includes a form asking applicants to enter their predicted grade points, and checks that the value entered is between 1 and 100 before the form is submitted.

(a)Distinguish between client-side scripting and server-side scripting, giving one example language typically used for each.(4)

(b)Explain one advantage of performing the grade point validation (checking the value is between 1 and 100) client-side rather than server-side.(3)

(c)The website also checks an applicant's login password against the college's database. Explain why this check must be carried out server-side rather than client-side.(2)

(Total for Question 10 is 9 marks)

Search engines allow users to find relevant web pages within a fraction of a second.

(a)Explain how a search engine uses a crawler and an index to respond quickly to a search query.(4)

(b)Explain how the PageRank algorithm uses backlinks to help rank web pages, illustrating your answer with an example.(4)

(Total for Question 11 is 8 marks)

Discuss the range of technologies and techniques an online retailer should employ to keep customers' payment data secure, both while it is being transmitted and while it is being stored, evaluating how effective each is.

(Total for Question 12 is 8 marks)

Data sent between an office in Manchester and a branch office in Glasgow is broken into packets, which can arrive out of order because they may take different routes across the network.

(a)State one field found in a packet header that allows the receiving device to reassemble the data in the correct order.(1)

(b)An array packets[0 TO n-1] holds packet records that have arrived out of order, where each record has a field seqNum. Write an algorithm, using the OCR Exam Reference Language, that sorts the packets array into ascending order of seqNum using an insertion sort.(6)

(c)Three packets arrive with seqNum values 3, 1, 2 (in that array order). Complete a trace table for the algorithm from part (b) as it sorts this array, showing the value of i, current, j and the full array contents after each outer loop iteration.(4)

(Total for Question 13 is 11 marks)

Mark scheme · A1.3 Exchanging Data: Databases, Networks and Web Technologies

Question 1

(a) B1 Lossy compression permanently removes some data/detail from the original file so it cannot be fully restored (oe)
(a) B1 Lossless compression reduces file size so that the original file can be reconstructed exactly/with no loss of data (oe)
(a) Answer: Lossy: removes data permanently, original cannot be recreated exactly. Lossless: file size reduced but the original can be reconstructed exactly.
(b) M1 Correctly identifies the four runs of repeated values in order (5x3, 2x7, 6x2, 1x9)
(b) A1 Correct count recorded for at least three of the four runs
(b) A1 Fully correct encoded output cao: (5,3),(2,7),(6,2),(1,9), oe equivalent notation such as 5,3,2,7,6,2,1,9
(b) Answer: (5,3),(2,7),(6,2),(1,9)
(c) B1 Suitable file type identified, e.g. a photograph (JPEG) or a music/audio file (MP3)
(c) B1 Valid justification, e.g. the human eye/ear cannot perceive the fine detail that is removed, so the large reduction in file size is worth the small, unnoticeable loss in quality (oe)
(c) Answer: A photograph (JPEG) is suitable because the human eye cannot detect the fine colour/detail removed, so file size can be reduced greatly with negligible perceived quality loss.

Question 2

(a) M1 States that the hash function converts a key into an index/address (oe)
(a) A1 Explains this allows data to be stored and retrieved directly/in near constant time, without searching every record (oe)
(a) Answer: A hash function converts a key into a table index, allowing data to be stored at and retrieved from that index directly rather than being searched for.
(b) M1 23 -> index 3 and 7 -> index 7 both placed with no collision
(b) M1 17 correctly identified as colliding at index 7 and probed to index 8
(b) M1 13 correctly identified as colliding at index 3 and probed to index 4
(b) A1 Fully correct final table cao: index 3 = 23, index 4 = 13, index 7 = 7, index 8 = 17, all other indices empty
(b) Answer: Index 0: empty, 1: empty, 2: empty, 3: 23, 4: 13, 5: empty, 6: empty, 7: 7, 8: 17, 9: empty
(c) B1 Keys that share a common factor with the table size (or are multiples of it) cluster/collide at the same or nearby indices, especially if the table size is not prime (oe)
(c) Answer: Keys sharing a common factor with the table size can cluster at the same indices, causing more collisions than a well-chosen table size/hash function.

Question 3

(a) B1 Symmetric encryption uses the same single key to encrypt and decrypt the data (oe)
(a) B1 Asymmetric encryption uses a mathematically linked key pair (a public key and a private key); data encrypted with one key can only be decrypted with the other (oe)
(a) B1 Comparative point, e.g. symmetric is faster but requires the key to be shared securely in advance, whereas asymmetric avoids that key-distribution problem but is slower (oe)
(a) Answer: Symmetric: one shared key for both encryption and decryption, fast but must be distributed securely. Asymmetric: a public/private key pair, slower, but removes the need to share a secret key in advance.
(b) M1 States that asymmetric encryption is computationally expensive/slow, particularly for large amounts of data (oe)
(b) A1 States that symmetric encryption is much faster and better suited to encrypting the bulk of the session's data (oe)
(b) A1 Explains that asymmetric encryption is instead used briefly to securely exchange the symmetric session key, solving the key-distribution problem without the ongoing performance cost (oe)
(b) Answer: Asymmetric encryption is slow for large volumes of data, so it is used only to safely exchange a symmetric session key; the fast symmetric algorithm then encrypts the rest of the session, combining the security of asymmetric key exchange with the speed of symmetric encryption.
(c) M1 Shows a shift of 3 applied consistently to each letter
(c) A1 Fully correct ciphertext cao: QHWZRUN
(c) Answer: QHWZRUN
(d) B1 Only 25 possible shifts/keys exist, so it can be broken quickly by brute force, or it is vulnerable to frequency analysis (oe)
(d) Answer: There are only 25 possible shift values, so the cipher can be broken almost instantly by trying every shift (brute force) or by frequency analysis.

Question 4

(a) B1 States that the table contains a repeating group / multi-valued attribute (oe)
(a) B1 Identifies the specific repeating group in context, i.e. a student can have more than one set of ModuleCode/ModuleName/Grade values in one record
(a) Answer: It is not in 1NF because each student record can contain a repeating group of module data (more than one ModuleCode/ModuleName/Grade set per StudentID).
(b) M1 Removes the repeating group so that each student-module combination becomes a separate row
(b) A1 Correct attributes shown for every row: StudentID, StudentName, TutorGroup, ModuleCode, ModuleName, Grade
(b) A1 Correctly identifies the composite primary key as (StudentID, ModuleCode)
(b) Answer:
StudentID StudentName TutorGroup ModuleCode ModuleName Grade
1001 Amara Okafor 12A COMP101 Computer Systems A
1001 Amara Okafor 12A COMP102 Programming B
1002 Liam Fraser 12B COMP101 Computer Systems B
Primary key: (StudentID, ModuleCode)
(c) M1 Identifies that StudentName and TutorGroup depend only on StudentID (part of the composite key), not on the whole key
(c) M1 Identifies that ModuleName depends only on ModuleCode (part of the composite key), not on the whole key
(c) A1 Correctly splits into Student(StudentID, StudentName, TutorGroup) and Module(ModuleCode, ModuleName) with appropriate primary keys
(c) A1 Correctly retains Enrolment(StudentID, ModuleCode, Grade) with a composite primary key (StudentID, ModuleCode) and both attributes as foreign keys referencing Student and Module
(c) Answer: Student(StudentID [PK], StudentName, TutorGroup); Module(ModuleCode [PK], ModuleName); Enrolment(StudentID [PK, FK], ModuleCode [PK, FK], Grade)
(d) M1 Defines a transitive dependency as a non-key attribute depending on another non-key attribute, rather than directly on the primary key (oe)
(d) A1 Explains that removing transitive dependencies reduces data redundancy and prevents update/insertion/deletion anomalies (oe)
(d) A1 Correctly judges, with justification, that no further transitive dependency exists in the part (c) tables, since every non-key attribute (StudentName, TutorGroup, ModuleName, Grade) depends directly on its table's primary key
(d) Answer: 3NF removes transitive dependencies to reduce redundancy and avoid anomalies. In this case the part (c) tables are already in 3NF, as no non-key attribute depends on another non-key attribute.

StudentID	StudentName	TutorGroup	ModuleCode	ModuleName	Grade
1001	Amara Okafor	12A	COMP101	Computer Systems	A
1001	Amara Okafor	12A	COMP102	Programming	B
1002	Liam Fraser	12B	COMP101	Computer Systems	B

Question 5

(a) M1 Correct SELECT and FROM clauses referencing Student and Enrolment (or an equivalent JOIN)
(a) M1 Correct join condition linking Student.StudentID = Enrolment.StudentID
(a) A1 Correct WHERE clause filtering ModuleCode = 'COMP101' AND Grade = 'A', cao
(a) Answer: SELECT Name FROM Student, Enrolment WHERE Student.StudentID = Enrolment.StudentID AND Enrolment.ModuleCode = 'COMP101' AND Enrolment.Grade = 'A';
(b) M1 Correct SELECT of TutorGroup and a COUNT aggregate function on StudentID (or *)
(b) A1 Correct GROUP BY TutorGroup clause
(b) A1 Fully correct, syntactically valid statement cao
(b) Answer: SELECT TutorGroup, COUNT(StudentID) FROM Student GROUP BY TutorGroup;
(c) M1 Correct ALTER TABLE Student keyword and table name
(c) A1 Correct ADD COLUMN syntax with column name and DATE data type, cao
(c) Answer: ALTER TABLE Student ADD DateOfBirth DATE;

Question 6

(a) B1 Atomicity: a transaction is treated as a single indivisible unit that either completes fully or is rolled back entirely (oe)
(a) B1 Consistency: a transaction takes the database from one valid state to another, obeying all defined rules/constraints (oe)
(a) B1 Isolation: concurrently executing transactions do not interfere with one another, behaving as if run sequentially (oe)
(a) B1 Durability: once a transaction is committed, its changes are permanent, even if the system subsequently fails (oe)
(a) Answer: Atomicity - all or nothing. Consistency - database moves between valid states. Isolation - concurrent transactions do not interfere. Durability - committed changes survive failure.
(b) M1 Identifies the problem: without isolation, both transactions could read the original balance (500) before either writes back, so one withdrawal's update could be lost/overwritten (a lost update)
(b) A1 Explains that Isolation ensures the transactions are processed as if one happens completely before the other (serially), e.g. via locking the record during the first transaction
(b) A1 Explains that the second transaction then reads the updated balance (200) left by the first, correctly declining/processing based on the true remaining balance, so both withdrawals are reflected correctly
(b) Answer: Without isolation both machines could read the 500 balance and each write back 200, losing one withdrawal. Isolation locks the record so the second transaction must wait and reads the already-updated balance (200), giving a correct final result.
(c) B1 Prevents two transactions from modifying the same record at the same time, avoiding data inconsistency/lost updates (oe)
(c) B1 States that the lock is released once the transaction has committed or been rolled back, allowing other transactions to proceed (oe)
(c) Answer: Record locking stops two transactions updating the same record simultaneously, preventing lost updates; the lock is released once the transaction commits or rolls back so others can then access the record.

Question 7

(a) B1 Star advantage, e.g. if one cable/device fails, only that device is affected and the rest of the network keeps working (oe)
(a) B1 Star disadvantage, e.g. if the central switch/hub fails, the whole network goes down (oe)
(a) B1 Mesh advantage, e.g. highly resilient, as multiple redundant paths exist between devices, so failure of one link does not isolate a device (oe)
(a) B1 Mesh disadvantage, e.g. requires far more cabling/connections and is expensive and complex to install as the number of devices grows (oe)
(a) Answer: Star: single cable failure only affects one device (advantage) but central device failure brings down the whole network (disadvantage). Mesh: highly resilient with redundant paths (advantage) but needs much more cabling and is costly to install (disadvantage).
(b) B1 Valid factor identified, e.g. distance/signal attenuation, bandwidth needed, or susceptibility to electromagnetic interference
(b) B1 Justification applied to the 200 metre scenario, e.g. copper cable suffers significant signal attenuation over such a distance and may need repeaters/may not maintain a reliable signal (oe)
(b) Answer: Distance/attenuation: over 200 metres, a copper cable's signal weakens significantly, which could require repeaters or cause an unreliable connection.
(c) B1 Correct advantage identified, e.g. much lower signal attenuation, higher bandwidth, or immunity to electromagnetic interference
(c) B1 Explained in the context of the scenario, e.g. the signal will travel the 200 metres with little loss, so no repeater is needed between the buildings (oe)
(c) Answer: Fibre optic suffers far less attenuation than copper, so the signal can travel the full 200 metres reliably without needing a repeater partway along the link.

Question 8

(a) B1 Application layer named first, cao
(a) B1 Transport layer named second, cao
(a) B1 Internet layer named third, cao
(a) B1 Link/Network Access layer named fourth, cao
(a) Answer: Application, Transport, Internet, Link (Network Access)
(b) M1 States that TCP (at this layer) breaks the data into segments for transmission (oe)
(b) A1 States that port numbers are added to identify the correct application/process on the source and destination devices (oe)
(b) A1 Explains that the layer provides reliable delivery, using acknowledgements to confirm receipt and control the flow of data (oe)
(b) Answer: The Transport layer (using TCP) splits data into segments, adds port numbers to identify the correct application, and manages reliable delivery through acknowledgements and flow control.
(c) M1 States that TCP numbers each segment (sequence numbers) so missing segments can be detected (oe)
(c) A1 States that the receiver does not send an acknowledgement (ACK) for the missing segment
(c) A1 Explains that after a timeout with no ACK received, the sender retransmits the lost segment, ensuring reliable delivery (oe)
(c) Answer: Each segment has a sequence number; the receiver does not acknowledge the missing one, so after a timeout the sender retransmits it, ensuring all data eventually arrives correctly.

Question 9

(a) B1 192 correctly converted to 11000000, cao
(a) B1 168 correctly converted to 10101000, cao
(a) B1 1 correctly converted to 00000001, cao
(a) B1 14 correctly converted to 00001110, cao
(a) Answer: 11000000.10101000.00000001.00001110
(b) B1 States that the MAC address is a fixed/physical address built into the network interface (NIC) and does not change (oe)
(b) B1 States that the MAC address is used to deliver data to the correct device on the same local network/link (data link layer) (oe)
(b) B1 States that the IP address is a logical address that can be reassigned (e.g. by a router/DHCP) and identifies the network as well as the device (oe)
(b) B1 States that the IP address is used to route the data across different networks toward its destination (network layer), with the MAC address changing at each hop while the IP address stays the same (oe)
(b) Answer: The MAC address is a fixed, hardware address used only for delivery within the local network. The IP address is a logical, changeable address used by routers to direct the data across different networks all the way to the destination.
(c) M1 States that the router examines the destination IP address of each packet (oe)
(c) A1 States that it uses a routing table to determine the best next hop toward the destination network (oe)
(c) A1 Explains that this allows the router to connect and forward data between different networks (e.g. from the home LAN onto the wider internet/WAN) (oe)
(c) Answer: The router reads the destination IP address of each packet, consults its routing table to find the best next hop, and forwards the packet on toward the destination network, connecting the home LAN to the wider internet.

Question 10

(a) B1 Client-side scripting: code is executed in the user's browser/on the user's device (oe)
(a) B1 Correct example client-side language, e.g. JavaScript
(a) B1 Server-side scripting: code is executed on the web server before the page/response is sent to the client (oe)
(a) B1 Correct example server-side language, e.g. PHP, Python, or ASP.NET
(a) Answer: Client-side: runs in the browser (e.g. JavaScript). Server-side: runs on the web server before the page is sent (e.g. PHP).
(b) M1 States that the data does not need to be sent to the server and a response waited for before the error is shown (oe)
(b) A1 Explains this reduces the load on the server and the amount of data sent over the network, since invalid entries are never transmitted (oe)
(b) A1 Explains this gives the applicant immediate/faster feedback, improving the user experience (oe)
(b) Answer: Client-side validation checks the value in the browser immediately, so invalid entries are never sent to the server, reducing server load and network traffic and giving the applicant instant feedback.
(c) B1 Client-side code can be viewed and modified by the user (e.g. via browser developer tools), so it cannot be trusted to enforce a security check (oe)
(c) B1 The database holding the passwords is only accessible from the server, so the comparison must be performed there (oe)
(c) Answer: Client-side code is visible and editable by the user, so it cannot be trusted to enforce security, and only the server has access to the password database, so the check must happen there.

Question 11

(a) B1 Describes a crawler as a program that automatically follows hyperlinks between pages to discover content across the web (oe)
(a) B1 Describes the index as a data structure storing keywords/terms mapped to the pages they appear in (oe)
(a) B1 States that the index is built up in advance from the pages the crawler visits
(a) B1 Explains that this allows the search engine to search the prebuilt index rather than the entire live web at query time, giving a fast response (oe)
(a) Answer: A crawler automatically follows links to discover web pages, and the content found is used to build an index mapping keywords to pages. When a query is made, the search engine searches this prebuilt index rather than the live web, giving a near-instant response.
(b) B1 States that PageRank counts the number of backlinks (links from other pages) pointing to a page (oe)
(b) B1 States that a link from a page with a higher rank/quality contributes more to the score than a link from a low-ranked page, so quality matters as well as quantity (oe)
(b) B1 States that pages with a higher resulting score are ranked/displayed higher in the search results (oe)
(b) B1 Valid illustrative example, e.g. a recipe page linked to from a well-established site such as BBC Good Food would rank higher than an identical recipe page linked to only from one small personal blog (oe)
(b) Answer: PageRank scores a page by counting backlinks, weighting links from higher-ranked pages more heavily than links from low-ranked pages, and pages with a higher score are shown higher in results; for example, a recipe page linked from BBC Good Food would outrank an identical page linked only from a small personal blog.

Question 12

Level 3 (6-8): A detailed and coherent discussion covering a range of relevant technologies for both data in transit and data at rest (e.g. TLS/HTTPS, hashing and salting of stored data, tokenisation, firewalls, two-factor authentication). The candidate evaluates the effectiveness and/or limitations of the measures discussed, recognising that a combination of techniques (defence in depth) is needed. Technical terminology is used accurately and the answer is well structured throughout.
Level 2 (3-5): A reasonable discussion of some relevant technologies covering transit and/or storage, with some evaluation of effectiveness, but the range or depth is limited, coverage is one-sided (e.g. transit only), or there are minor inaccuracies. Some relevant technical terminology is used.
Level 1 (1-2): Limited, mostly descriptive or list-like points are made, with little or no evaluation of effectiveness. The answer may contain inaccuracies and lacks coherent structure.
Level 0 (0): No creditable response, or the response does not address the question.
Indicative content:
- TLS (HTTPS) encrypts data sent between the customer's browser and the server, preventing eavesdropping/interception in transit.
- Asymmetric encryption is used during the TLS handshake to securely exchange a symmetric session key, which then encrypts the bulk of the transmitted data.
- Passwords should be stored using a hash function (ideally with a salt) rather than in plaintext, so that even if the database is stolen, the original passwords are not directly readable.
- A salt prevents attackers from using precomputed rainbow tables to reverse common hashed passwords.
- Card/payment data at rest should be encrypted, and full card numbers are often replaced with tokens (tokenisation) so the retailer never stores the real, usable card number.
- Firewalls and intrusion detection systems help prevent unauthorised access to the servers/database that hold customer data.
- Two-factor authentication adds an extra barrier against an attacker who has obtained a password.
- Evaluation: TLS protects data only in transit, not once it is stored, so it must be combined with storage-level protection; hashing without a salt is vulnerable to rainbow table attacks; no single technique is sufficient on its own, so a combination (defence in depth) gives the strongest overall protection; measures such as PCI DSS compliance and regular security audits help ensure these technologies are implemented and maintained correctly.

Question 13

(a) B1 Sequence number (accept packet/fragment number)
(a) Answer: Sequence number
(b) M1 Any correct logic, ignore minor syntax: outer loop correctly iterates through the array starting from the second element (index 1) to the last element
(b) M1 Current element is stored in a variable before it is potentially overwritten
(b) M1 Inner loop/comparison correctly compares seqNum of the stored element against seqNum of preceding elements
(b) M1 Preceding elements with a greater seqNum are correctly shifted one place to the right
(b) M1 The stored current element is correctly inserted at the resulting empty position
(b) A1 Complete, logically correct algorithm that sorts the whole array into ascending order of seqNum for any valid input, using correct array index bounds

(b) Answer:

PROCEDURE SortPackets(packets, n)
  FOR i <- 1 TO n - 1
    current <- packets[i]
    j <- i - 1
    WHILE j >= 0 AND packets[j].seqNum > current.seqNum
      packets[j + 1] <- packets[j]
      j <- j - 1
    ENDWHILE
    packets[j + 1] <- current
  NEXT i
ENDPROCEDURE

(c) M1 Correct row for i = 1: current = 1, array shifts to [3, 3, 2] mid-pass then current inserted at index 0, giving array [1, 3, 2]
(c) A1 Correct value of j shown ending at -1 for the i = 1 pass
(c) M1 Correct row for i = 2: current = 2, packets[1] (value 3) shifts right, j ends at 0, current inserted at index 1, giving array [1, 2, 3]
(c) A1 Final array fully correct and in ascending order cao: [1, 2, 3]
(c) Answer: i=1: current=1, j finishes at -1, array becomes [1,3,2]. i=2: current=2, j finishes at 0, array becomes [1,2,3]. Final sorted array: [1,2,3]