Revision Library

revisionlibrary.co.uk

A-Level · AQA

A2.8 Networking and the Internet

AQA 7517 · Calculators not allowed · about 145 minutes

Total Marks

Name: _______________________________ Date: ____ / ____ / ______

Answer ALL questions. Show all your working.

Networking case studies: college networks, file-sharing and online retail security

Original scenarios written for Revision Library.

Questions 1 and 2 follow Ravensmead Sixth Form College's network technician, Owen Fairweather, as he chooses a topology and identifies the hardware needed for a new ICT suite. Questions 3 to 9 cover the core networking theory behind that design: client-server versus peer-to-peer architectures (via a file-sharing startup, SwiftShare), the TCP/IP protocol stack, IPv4 addressing and subnetting, DNS resolution, packet switching versus circuit switching, and the full sequence of events behind a single web request. Questions 10 and 11 look at how an online retailer, GreenLeaf Retail, defends its website and customer data against network security threats, including encryption and digital certificates. Questions 12 and 13 close with wireless networking standards and security, and the ongoing migration from IPv4 to IPv6.

Ravensmead Sixth Form College is installing a new computer network for its ICT suite, which will have 12 workstations connected to one central switch, plus a server. The network technician, Owen Fairweather, is considering three different topologies: star, bus and full mesh.

(a)Define the term 'network topology'.(1)

(b)Describe how data travels across a star topology when one workstation sends data to another.(2)

(c)State one advantage and one disadvantage of using a star topology for the ICT suite.(2)

(d)Explain one way in which a full mesh topology differs from a star topology, and explain why this makes a full mesh more resilient to a single point of failure.(3)

(e)Owen cannot decide between a star topology and a bus topology for the ICT suite. Recommend which topology he should use, justifying your answer with reference to two advantages of a star topology over a bus topology.(3)

(Total for Question 1 is 11 marks)

Owen also needs to choose the hardware for the ICT suite's network and its connection to the Internet.

(a)State the purpose of a MAC address.(1)

(b)A network interface card's MAC address is given in hexadecimal as 3C-A6-2F-01-9B-4E. Determine how many bits this represents, showing your working.(2)

(c)Explain the difference between how a switch and a hub forward an incoming data frame.(3)

(d)Explain why a router, not just a switch, is needed to connect the college's internal network to the Internet.(2)

(Total for Question 2 is 8 marks)

SwiftShare is a new startup planning a file-sharing service that lets users upload and download large files directly to and from each other. Its founder, Meera Iqbal, is deciding whether to build the service using a client-server model or a peer-to-peer (P2P) model.

(a)State one characteristic that distinguishes a client-server network from a peer-to-peer network.(1)

(b)In a peer-to-peer network, explain what is meant by each node acting as both a client and a server.(2)

(c)State two advantages of a peer-to-peer model over a client-server model for sharing large files directly between users.(2)

(d)Discuss whether Meera should use a client-server model or a peer-to-peer model for SwiftShare's file-sharing service. In your answer, you should consider: the reliability and availability of files when the original uploader is offline; the cost and scalability of running the service as it grows; the level of central control needed over content moderation and security.(6)

(Total for Question 3 is 11 marks)

Ravensmead's ICT suite uses the TCP/IP model to structure how data is sent across its network and out to the Internet.

(a)State the four layers of the TCP/IP model, in the correct order, starting with the layer closest to the application software.(2)

(b)Identify one protocol that operates at the Transport layer, and state its function.(2)

(c)Explain what is meant by 'encapsulation' as data passes down through the TCP/IP stack, using the example of sending an email with an attachment.(3)

(d)State the name given to a unit of data at the Transport layer, and the name given to a unit of data at the Link layer.(2)

(Total for Question 4 is 9 marks)

Ravensmead's ICT suite is assigned IP addresses on its local network.

(a)Convert the IPv4 address 172.16.5.200 to its full 32-bit binary representation.(2)

(b)A subnet uses the mask 255.255.255.0. State how many bits are used for the host identifier in this subnet, and hence calculate the number of usable host addresses it provides.(3)

(c)Explain the difference between a public IP address and a private IP address.(2)

(d)A home router uses Network Address Translation (NAT) to allow several devices to share one public IP address. Explain how NAT achieves this.(3)

(Total for Question 5 is 10 marks)

A student at Ravensmead types www.ravensmeadsfc.ac.uk into their browser's address bar.

(a)State the purpose of the Domain Name System (DNS).(1)

(b)Assuming nothing is already cached, describe the sequence of steps involved in resolving this domain name to an IP address, referring to the root server, the top-level domain (TLD) server and the authoritative name server.(4)

(c)Explain why DNS resolvers cache the results of previous lookups, and state one drawback of this caching.(2)

(Total for Question 6 is 7 marks)

A traditional landline telephone call uses circuit switching, whereas a Voice over IP (VoIP) call made through an app uses packet switching.

(a)Describe how circuit switching establishes a connection for a landline telephone call.(2)

(b)Describe how packet switching transmits data for a VoIP call, referring to packetisation, routing and reassembly.(3)

(c)State two advantages of packet switching over circuit switching for general Internet traffic.(2)

(d)Explain one disadvantage of packet switching for a real-time application such as a VoIP call.(2)

(Total for Question 7 is 9 marks)

Ravensmead's network uses a mixture of TCP and UDP for different types of traffic, and relies on standard port numbers to direct traffic to the correct application.

(a)State two differences between TCP and UDP.(2)

(b)State the standard port number normally used by each of the following protocols: (i) HTTP (ii) HTTPS (iii) FTP (control connection) (iv) SMTP.(4)

(c)A live video-streaming service transmits its video data using UDP rather than TCP. Explain why UDP is more suitable than TCP for this application, referring to the trade-off between reliability and speed.(3)

(d)Explain why a web browser uses TCP, rather than UDP, when requesting a webpage.(3)

(Total for Question 8 is 12 marks)

A student enters a URL into their browser's address bar to view a webpage.

(a)State what is meant by a URL (Uniform Resource Locator).(1)

(b)Describe the sequence of events that takes place from a user entering a URL into their browser's address bar to the requested webpage being displayed on screen. Your answer should refer to DNS resolution, establishing a TCP connection, and the HTTP request/response.(6)

(Total for Question 9 is 7 marks)

GreenLeaf Retail runs an online shop. Last month its website was disrupted by a Distributed Denial of Service (DDoS) attack, and a customer, Tariq Osman, reported receiving a suspicious email that appeared to be from GreenLeaf, asking him to click a link and confirm his card details.

(a)Identify the type of attack described in the email received by Tariq, and explain how it works.(2)

(b)Explain how a Distributed Denial of Service (DDoS) attack disrupts the availability of a web server.(3)

(c)State one technical measure GreenLeaf could put in place to reduce the risk of a successful DDoS attack.(1)

(Total for Question 10 is 6 marks)

GreenLeaf Retail wants to make sure customer data is protected whenever a customer connects to its website, following the incidents described in Question 10.

(a)Explain the difference between symmetric encryption and asymmetric encryption.(3)

(b)During a TLS handshake, asymmetric encryption is used to securely exchange a symmetric session key, which is then used for the rest of the session. Explain one advantage of using asymmetric encryption for this initial key exchange, rather than relying on symmetric encryption alone.(2)

(c)Explain the role of a digital certificate in establishing a secure HTTPS connection between a customer's browser and GreenLeaf's web server.(3)

(d)Evaluate the effectiveness of relying on a firewall and encryption alone to protect GreenLeaf's customer data, compared with also training staff to recognise phishing attempts.(6)

(Total for Question 11 is 14 marks)

Ravensmead's ICT suite also provides WiFi access for staff laptops elsewhere in the building.

(a)State two factors, other than distance, that could reduce the range or reliability of a WiFi signal inside the building.(2)

(b)Explain one advantage and one disadvantage of using the 5GHz frequency band, compared with 2.4GHz, for a WiFi network.(2)

(c)Explain why WPA3 provides better security for a wireless network than WEP.(3)

(Total for Question 12 is 7 marks)

IPv4 addresses are 32 bits long, giving around 4.3 billion possible addresses, whereas IPv6 addresses are 128 bits long and written in hexadecimal, e.g. 2001:0db8:0000:0000:0000:ff00:0042:8329.

(a)Write this IPv6 address in its abbreviated (compressed) form, applying the standard rules for omitting leading zeros and consecutive blocks of zeros.(2)

(b)State one reason why IPv6 was introduced despite the widespread existing use of IPv4.(1)

(c)Discuss the technical challenges involved in migrating the wider Internet from IPv4 to IPv6.(6)

(Total for Question 13 is 9 marks)

Mark scheme · A2.8 Networking and the Internet

Question 1

(a) B1 the layout/arrangement of the devices (nodes) and the connections between them in a network (oe)
(a) Answer: A network topology is the layout or arrangement of the devices (nodes) in a network and the connections between them.
(b) B1 every device is connected directly to a central device (a switch or hub), rather than to each other (oe)
(b) B1 data sent from one workstation travels to the central switch first, which then forwards it on to the destination workstation (oe)
(b) Answer: In a star topology, every workstation connects directly to a central switch rather than to each other. When one workstation sends data to another, the data travels first to the central switch, which then forwards it on to the intended destination workstation.
(c) B1 advantage: if one workstation's cable fails, only that workstation is affected; the rest of the network keeps working (oe)
(c) B1 disadvantage: the central switch is a single point of failure; if it fails, the whole network goes down (oe, allow: uses more cabling than a bus)
(c) Answer: Advantage: if one workstation's cable fails, only that workstation loses its connection, and the rest of the ICT suite's network keeps working normally. Disadvantage: the central switch is a single point of failure, so if it fails, every workstation loses its connection at once.
(d) B1 in a full mesh, every device has a direct connection to every other device, rather than all devices connecting only to one central switch (oe)
(d) B1 because there is no single central device that all traffic must pass through, the failure of any one device or connection does not disconnect the rest of the network (oe)
(d) B1 multiple alternative direct paths exist between devices, so data can still reach its destination via a different connection, unlike a star, where losing the central switch disconnects everyone (oe)
(d) Answer: In a full mesh, every device is connected directly to every other device, rather than all devices connecting only to one central switch as in a star. This means there is no single central device that all traffic depends on, so the failure of any one device or cable does not disconnect the rest of the network: data can still reach its destination via one of the other direct connections. In a star, by contrast, if the central switch fails, every workstation loses its connection at once.
(e) B1 star topology recommended
(e) B1 advantage 1: a single cable fault in a star only disconnects the one workstation concerned, whereas a break in a bus's shared backbone cable can bring down the whole network segment (oe)
(e) B1 advantage 2: a star suffers less congestion/fewer collisions as more workstations are added, because each has its own dedicated connection to the switch, whereas a bus shares one single cable between all devices (oe)
(e) Answer: Owen should choose a star topology. First, in a star, a single faulty or damaged cable only disconnects the one workstation it serves, whereas in a bus topology a break anywhere in the shared backbone cable can bring down the whole network. Second, a star suffers less congestion as more workstations are added, because each workstation has its own dedicated connection to the switch, whereas in a bus every device shares the same single cable, increasing the chance of data collisions as traffic grows.

Question 2

(a) B1 to uniquely identify a network interface/device on a network, e.g. for forwarding frames at the link layer (oe)
(a) Answer: A MAC address uniquely identifies a network interface (device) on a network, so that data frames can be forwarded to the correct device.
(b) M1 recognises the address is written as six hexadecimal pairs, and each hexadecimal pair represents one byte (8 bits) (oe)
(b) A1 48 bits cao
(b) Answer: 48 bits.
(c) B1 a hub forwards (broadcasts) every incoming frame out of all of its other ports, regardless of which device it is actually intended for (oe)
(c) B1 a switch reads the destination MAC address in the frame and looks it up in its MAC address table (oe)
(c) B1 the switch then forwards the frame only out of the specific port connected to the intended destination device, rather than to every device (oe)
(c) Answer: A hub simply forwards (broadcasts) every incoming frame out of all of its other ports, regardless of which device the frame is actually intended for. A switch instead reads the destination MAC address in each frame, looks it up in its stored MAC address table, and forwards the frame only out of the one port connected to the intended destination device, rather than to every device.
(d) B1 a switch only forwards data between devices on the same local network, using MAC addresses; it does not route data between different networks using IP addresses (oe)
(d) B1 a router connects and routes traffic between two different networks (the college's internal network and the Internet) using IP addresses, and typically also performs other functions such as NAT, which a switch cannot do (oe)
(d) Answer: A switch only forwards data between devices on the same local network, based on MAC addresses; it has no way of routing data between different networks. A router is needed instead, because it connects two separate networks together (here, the college's internal network and the Internet) and routes traffic between them using IP addresses, typically also handling functions such as Network Address Translation, which a switch cannot do.

Question 3

(a) B1 in a client-server network, one or more dedicated (central) servers provide services/resources to many client devices, whereas in a peer-to-peer network there is no dedicated server and all nodes have broadly equal status (oe)
(a) Answer: In a client-server network, one or more dedicated central servers provide services or resources to many separate client devices, whereas in a peer-to-peer network there is no dedicated server, and all nodes have broadly equal status.
(b) B1 each node can act as a client, requesting/downloading a file or resource from another node (oe)
(b) B1 at the same time, each node also acts as a server, by making its own files/resources available and uploading them to other nodes that request them (oe)
(b) Answer: Each node in a peer-to-peer network can act as a client, requesting and downloading a file from another node, while at the same time also acting as a server, by making its own files available and uploading them to other nodes that request them.
(c) B1 no single central server is required, so there is no single point of failure and no dedicated server hardware/bandwidth needs to be bought and maintained (oe)
(c) B1 as more users share/download a popular file, more peers hold copies of it, so the network's capacity to distribute that file can increase, rather than being limited by one server's bandwidth (oe)
(c) Answer: First, no single central server is required, so there is no single point of failure, and SwiftShare does not need to buy and maintain expensive dedicated server hardware and bandwidth. Second, as more users download a popular file, more peers end up holding a copy of it, so the network's overall capacity to supply that file can increase automatically, rather than being limited by one server's bandwidth.
(d) L3 (5-6): A balanced discussion covers reliability/availability, cost/scalability and central control, applied specifically to SwiftShare, and reaches a justified overall recommendation.
(d) L2 (3-4): Some accurate points are made on two of the three areas above, with limited balance and/or limited application to SwiftShare.
(d) L1 (1-2): A basic, one-sided or generic comment is made on client-server versus P2P, with little application to SwiftShare.
(d) L0 (0): No creditable content.
(d) Answer: Extended, levels-marked response: award marks holistically against the levels of response grid, using the indicative content as a guide to creditable points; there is no single correct wording.

Question 4

(a) B1 correct four layers named: Application, Transport, Internet, Link (allow Network Access/Network Interface for Link) (oe)
(a) B1 correct order given, starting nearest the application: Application, Transport, Internet, Link cao
(a) Answer: Application, Transport, Internet, Link.
(b) B1 TCP (or UDP) correctly identified as operating at the Transport layer
(b) B1 correct function stated, e.g. TCP establishes a connection and provides reliable, ordered delivery of data between two devices (or UDP provides fast, connectionless delivery with no guarantee of reliability) (oe)
(b) Answer: TCP (Transmission Control Protocol) operates at the Transport layer. Its function is to establish a connection between two devices and provide reliable, ordered delivery of data, using acknowledgements and retransmission of any lost data.
(c) B1 as the email data passes down through each layer of the sending device's TCP/IP stack, each layer adds its own header (and, at the link layer, typically a trailer) to the data it receives from the layer above (oe)
(c) B1 e.g. the Transport layer adds a header (containing port numbers and sequencing information), forming a segment; the Internet layer then adds a header (containing source and destination IP addresses), forming a packet (oe)
(c) B1 the original email data ends up wrapped inside multiple layers of headers, like nested envelopes, which are then removed in reverse order (de-encapsulated) by the corresponding layer at the receiving device (oe)
(c) Answer: Encapsulation is the process by which each layer of the TCP/IP stack adds its own header (and, at the link layer, a trailer) to the data passed down from the layer above, as the email and its attachment travel down through the sending device's stack. For example, the Transport layer adds a header with port and sequencing information to form a segment, and the Internet layer adds a header with the source and destination IP addresses to form a packet. The result is that the original email data is wrapped inside several nested layers of headers, which are removed one by one, in reverse order, by the matching layer at the receiving device.
(d) B1 Transport layer: segment
(d) B1 Link layer: frame
(d) Answer: Transport layer: segment. Link layer: frame.

Question 5

(a) M1 three of the four octets converted correctly
(a) A1 10101100.00010000.00000101.11001000 cao (allow without full stops)
(a) Answer: 10101100.00010000.00000101.11001000
(b) M1 8 host bits correctly identified
(b) M1 2⁸ = 256 total addresses calculated
(b) A1 254 usable host addresses (256 minus 2 for the network and broadcast addresses) cao
(b) Answer: 8 host bits; 254 usable host addresses.
(c) B1 a public IP address is globally unique and directly routable/reachable over the Internet, assigned by an ISP or regional Internet registry (oe)
(c) B1 a private IP address (e.g. from 192.168.x.x, 10.x.x.x or 172.16.x.x-172.31.x.x) is only unique within its own local network and is not routable directly over the Internet; separate private networks can reuse the same private ranges (oe)
(c) Answer: A public IP address is globally unique and can be reached directly over the Internet; it is assigned by an ISP or a regional Internet registry. A private IP address (from a reserved range such as 192.168.x.x, 10.x.x.x or 172.16.x.x to 172.31.x.x) is only unique within its own local network and cannot be routed directly over the Internet; separate private networks, such as different homes, can reuse the same private address ranges without conflict.
(d) B1 NAT is performed by the router at the boundary between the private local network and the Internet (oe)
(d) B1 when outgoing data leaves the local network, the router translates each device's private IP address (and port number) into its own single public IP address (and a different port number), recording the mapping in a translation table (oe)
(d) B1 when a reply arrives back at the public IP address, the router uses the translation table to determine which internal device/port the reply should be forwarded to (oe)
(d) Answer: NAT is carried out by the router at the boundary between the local network and the Internet. When a device on the local network sends data out to the Internet, the router translates that device's private IP address (and port number) into its own single public IP address (with a different port number), and records this mapping in a translation table. When a reply comes back addressed to the public IP address, the router looks up the translation table to work out which internal device (and port) the reply belongs to, and forwards it there.

Question 6

(a) B1 to translate/resolve human-readable domain names into the numerical IP addresses that computers use to locate each other (oe)
(a) Answer: DNS translates human-readable domain names (such as www.ravensmeadsfc.ac.uk) into the numerical IP addresses that computers use to locate and communicate with each other.
(b) B1 the browser/OS checks its local cache; since nothing is cached, the request is forwarded to a recursive DNS resolver (e.g. run by the ISP) (oe)
(b) B1 the resolver queries a root (DNS) server, which does not hold the exact record but returns the address of the relevant top-level domain (TLD) server (e.g. for .uk) (oe)
(b) B1 the resolver then queries that TLD server, which returns the address of the authoritative name server responsible for the ravensmeadsfc.ac.uk domain (oe)
(b) B1 the resolver queries the authoritative name server, which holds and returns the actual IP address; this is passed back to the browser, allowing it to connect to the correct web server (oe)
(b) Answer: The browser first checks whether the IP address is already cached; since it is not, the request is sent to a recursive DNS resolver. This resolver queries a root server, which returns the address of the .uk top-level domain (TLD) server. The resolver then queries that TLD server, which returns the address of the authoritative name server for ravensmeadsfc.ac.uk. Finally, the resolver queries that authoritative name server, which holds and returns the actual IP address, and this is passed back to the browser so it can connect to the correct web server.
(c) B1 caching stores a previous lookup's result locally (for its TTL, time to live) so the same domain does not need to be resolved again via the full root-TLD-authoritative process, reducing lookup time and load on DNS servers (oe)
(c) B1 drawback: if the IP address for a domain changes, the cached (old) address may still be returned/used until it expires, potentially directing users to an incorrect or outdated address in the meantime (oe)
(c) Answer: Caching stores the result of a previous lookup locally for a set period (its time to live), so the same domain does not need to be resolved again via the full process described in part (b), reducing lookup time and the load placed on DNS servers. One drawback is that if a domain's IP address changes, the cached (old) address may still be used until it expires, potentially sending users to an incorrect or outdated address in the meantime.

Question 7

(a) B1 a single, dedicated path (circuit) between the two devices is set up and reserved before any data/conversation is transmitted (oe)
(a) B1 this exclusive path remains reserved for the entire duration of the call, whether or not data is being sent at that moment, and is only released once the call ends (oe)
(a) Answer: Circuit switching sets up a single, dedicated path (circuit) between the two phones before any conversation is transmitted. This path remains exclusively reserved for the whole call, whether or not either person is actually speaking at that moment, and is only released once the call ends.
(b) B1 packetisation: the voice data is broken up into smaller units called packets, each labelled with a header containing information such as the source and destination address and a sequence number (oe)
(b) B1 routing: each packet is then transmitted independently across the network, potentially taking a different path/route, decided at each router along the way (oe)
(b) B1 reassembly: on arrival, the packets are put back into the correct order at the destination, using their sequence numbers, to reconstruct the original voice data (oe)
(b) Answer: The VoIP call's voice data is broken up into smaller packets, each with a header containing a source and destination address and a sequence number (packetisation). Each packet is then sent across the network independently, and may take a different route to reach the destination, decided by routers along the way (routing). On arrival, the packets are put back into the correct order using their sequence numbers, to reconstruct the original voice data (reassembly).
(c) B1 more efficient use of network bandwidth, since capacity is only used while packets are actually being sent, allowing it to be shared dynamically between many connections rather than reserved solely for one call (oe)
(c) B1 more resilient to failure, because if part of the network fails, packets can automatically be rerouted via an alternative path, whereas a circuit-switched connection using that path would simply be lost (oe)
(c) Answer: First, packet switching makes more efficient use of available bandwidth, since network capacity is only used while packets are actually being transmitted, allowing it to be shared dynamically between many different connections, rather than being reserved solely for one call. Second, it is more resilient to failure, because if part of the network breaks down, packets can automatically be rerouted via an alternative path, whereas a circuit-switched connection relying on that path would simply be lost.
(d) B1 because packets can take different routes and may be delayed, lost, or arrive out of order, the delay between packets can vary (jitter), and late packets may need to be dropped (oe)
(d) B1 for a real-time application like VoIP, this can cause noticeable problems such as choppy audio or gaps in the call, unlike circuit switching, which guarantees a constant amount of dedicated bandwidth for the whole call (oe)
(d) Answer: Because packets can take different routes and may be delayed, lost or arrive out of order, the delay between successive packets can vary (jitter), and packets that arrive too late may have to be dropped. For a real-time application like a VoIP call, this can cause noticeable problems such as choppy audio or gaps in the conversation, unlike circuit switching, which guarantees a constant, dedicated amount of bandwidth for the entire call.

Question 8

(a) B1 TCP is connection-oriented, establishing a connection (e.g. via a three-way handshake) before sending data, whereas UDP is connectionless and sends data without first establishing a connection (oe)
(a) B1 TCP provides reliable, ordered delivery using acknowledgements and retransmission of lost packets, whereas UDP gives no such guarantee but has lower overhead/latency (oe)
(a) Answer: TCP is connection-oriented, establishing a connection (e.g. via a three-way handshake) before sending any data, whereas UDP is connectionless and simply sends data without first setting up a connection. TCP also guarantees reliable, ordered delivery, using acknowledgements and retransmitting any lost data, whereas UDP gives no such guarantee, but has lower overhead and therefore lower latency.
(b) B1 HTTP: 80
(b) B1 HTTPS: 443
(b) B1 FTP (control): 21
(b) B1 SMTP: 25
(b) Answer: HTTP: 80. HTTPS: 443. FTP (control connection): 21. SMTP: 25.
(c) B1 live streaming needs data delivered with minimal delay, and can usually tolerate the occasional lost or corrupted packet (e.g. a brief glitch) without significantly affecting the viewer's experience (oe)
(c) B1 UDP has lower overhead than TCP, because it does not perform a connection handshake, acknowledgements or retransmission, so data can be sent and displayed with less delay (oe)
(c) B1 if TCP were used, a lost packet would need to be retransmitted and the stream would have to wait/buffer for it, introducing a delay more disruptive to a live broadcast than simply dropping that one packet (oe)
(c) Answer: Live video streaming needs data to arrive with minimal delay, and can usually tolerate the occasional lost or corrupted packet, such as a brief visual glitch, without significantly affecting the viewer's experience. UDP has lower overhead than TCP, since it performs no connection handshake, acknowledgements or retransmission, so packets can be sent and displayed with less delay. If TCP were used instead, a lost packet would have to be retransmitted, forcing the stream to wait or buffer for it, which introduces a delay far more disruptive to a live broadcast than simply dropping that one packet would be.
(d) B1 a webpage's HTML and resources must arrive complete and in the correct order for the page to display and function correctly, so TCP's reliable delivery and correct sequencing are important (oe)
(d) B1 a missing or corrupted packet in a webpage would produce a broken or incomplete page, which is generally far more disruptive/noticeable than the brief quality dip UDP-based streaming can tolerate (oe)
(d) B1 loading a webpage does not usually require the strict real-time delivery that streaming/VoIP need, so the small extra delay caused by TCP's handshake and acknowledgements is an acceptable trade-off for guaranteed accuracy (oe)
(d) Answer: A webpage's HTML and other resources must arrive complete, uncorrupted and in the correct order for the page to display and work correctly, so TCP's guarantees of reliable, ordered delivery (using acknowledgements and retransmission) are important. A missing or corrupted packet would produce a broken or incomplete page, which is far more disruptive to the user than the brief quality dip that UDP-based streaming can tolerate. Loading a webpage also does not need the strict real-time delivery that live streaming or VoIP require, so the small extra delay from TCP's handshake and acknowledgements is an acceptable trade-off for guaranteeing the page arrives correctly.

Question 9

(a) B1 the address used to locate/identify a specific resource (e.g. a webpage) on the Internet, typically specifying the protocol, the domain name (host) and the path to the resource (oe)
(a) Answer: A URL is the address used to locate a specific resource, such as a webpage, on the Internet. It typically specifies the protocol to use (e.g. https), the domain name of the host, and the path to the particular resource.
(b) B1 the browser checks whether the domain name's IP address is already cached; if not, it sends a request to resolve it to a DNS resolver (oe)
(b) B1 the DNS system resolves the domain name into the web server's IP address (e.g. via the root, TLD and authoritative name servers) and returns it to the browser (oe)
(b) B1 the browser establishes a TCP connection with the web server at that IP address, typically via a three-way handshake (oe)
(b) B1 the browser sends an HTTP (or HTTPS) request over this connection, asking the server for the specific webpage/resource (oe)
(b) B1 the web server processes the request and sends back an HTTP response, containing a status code and the requested HTML document (oe)
(b) B1 the browser receives the HTML, requests any additional linked resources it needs (such as images, CSS or JavaScript files), then parses and renders the complete page for display (oe)
(b) Answer: First, the browser checks whether the domain name's IP address is already cached; if not, it sends a request to a DNS resolver. The DNS system resolves the domain name into the web server's IP address and returns it to the browser. The browser then establishes a TCP connection with that IP address, typically via a three-way handshake. Next, the browser sends an HTTP (or HTTPS) request over this connection, asking for the specific webpage. The web server processes the request and sends back an HTTP response containing the requested HTML. Finally, the browser receives the HTML, requests any additional resources it needs (such as images, CSS or JavaScript), and then parses and renders the complete page on screen.

Question 10

(a) B1 phishing correctly identified
(a) B1 the attacker sends a fraudulent email that impersonates a trusted organisation (here, GreenLeaf), tricking the recipient into clicking a link and/or revealing sensitive information (e.g. card or login details), often via a fake website designed to look genuine (oe)
(a) Answer: This is a phishing attack. The attacker sends a fraudulent email that impersonates a trusted organisation, here GreenLeaf, tricking the recipient (Tariq) into clicking a link and revealing sensitive information, such as his card details, often via a fake website designed to look like the genuine one.
(b) B1 the attacker uses a large number of compromised devices (a botnet) to send an overwhelming volume of requests/traffic to the target web server, all at the same time (oe)
(b) B1 this consumes the server's available bandwidth, processing capacity, or connection limits (oe)
(b) B1 as a result, the server cannot process/respond to legitimate requests from genuine customers, becoming very slow or completely unavailable (oe)
(b) Answer: In a DDoS attack, the attacker uses a large number of compromised devices, forming a botnet, to send an overwhelming volume of requests to GreenLeaf's web server all at the same time. This consumes the server's available bandwidth, processing capacity or connection limits. As a result, the server cannot process legitimate requests from genuine customers, and becomes very slow or completely unavailable.
(c) B1 any valid technical measure, e.g. a firewall/intrusion detection or prevention system configured to detect and filter abnormal traffic, or a traffic-scrubbing/content delivery network/load-balancing service to absorb and spread the excess traffic across multiple servers (oe)
(c) Answer: GreenLeaf could use a firewall or intrusion prevention system configured to detect and filter abnormal traffic patterns, or use a content delivery network / traffic-scrubbing service to absorb and spread the excess traffic across multiple servers.

Question 11

(a) B1 symmetric encryption uses a single (the same) key to both encrypt and decrypt the data (oe)
(a) B1 asymmetric encryption uses a mathematically linked pair of keys instead: a public key, which can be shared openly and used to encrypt data, and a private key, kept secret by the recipient, used to decrypt it (oe)
(a) B1 symmetric encryption is faster/less computationally intensive, making it more efficient for encrypting large amounts of data, but requires a secret key to be exchanged safely in advance; asymmetric encryption solves the key-exchange problem but is slower/more computationally intensive (oe)
(a) Answer: Symmetric encryption uses a single key to both encrypt and decrypt the data. Asymmetric encryption instead uses a mathematically linked pair of keys: a public key, which can be shared openly and used to encrypt data, and a private key, kept secret by its owner, used to decrypt it. Symmetric encryption is faster and less computationally intensive, so it is more efficient for encrypting large amounts of data, but it requires a secret key to be exchanged safely in advance; asymmetric encryption solves this key-exchange problem, but is slower and more computationally intensive.
(b) B1 using asymmetric encryption means no secret key has to be shared/transmitted over the insecure Internet connection in advance, removing the risk of an attacker intercepting it in transit (oe)
(b) B1 only the intended recipient's private key (which is never shared) can decrypt data encrypted with the corresponding public key, so the session key can be sent securely even though the public key itself is sent in the open (oe)
(b) Answer: Using asymmetric encryption for the initial exchange means no secret key ever has to be shared over the insecure Internet connection in advance, removing the risk of an attacker intercepting a shared key in transit. Only the intended recipient's private key, which is never shared with anyone, can decrypt data that has been encrypted with the corresponding public key, so the symmetric session key can be sent securely even though the public key itself is sent openly.
(c) B1 a digital certificate, issued by a trusted Certificate Authority (CA), binds/confirms that a specific public key belongs to GreenLeaf's genuine web server (oe)
(c) B1 the browser checks the certificate's digital signature against the CA's own trusted public key, to verify that the certificate is authentic and has not been altered/forged (oe)
(c) B1 this allows the browser to trust that it is really communicating with GreenLeaf's genuine server, rather than an imposter carrying out a man-in-the-middle attack, before the session key is exchanged and the connection is encrypted (oe)
(c) Answer: A digital certificate, issued by a trusted Certificate Authority, confirms that a specific public key genuinely belongs to GreenLeaf's web server. The customer's browser checks the certificate's digital signature against the Certificate Authority's own trusted public key, to verify that the certificate is authentic and has not been forged or altered. This lets the browser trust that it is really communicating with GreenLeaf's genuine server, rather than an imposter carrying out a man-in-the-middle attack, before the session key described in part (b) is exchanged and the connection is encrypted.
(d) L3 (5-6): A balanced evaluation covers both the value and the limits of technical measures (firewall/encryption) and the value of staff training, applied to GreenLeaf's scenario, reaching a justified overall conclusion.
(d) L2 (3-4): Some accurate points are made about technical measures and/or training, but with limited balance or limited application to GreenLeaf's scenario.
(d) L1 (1-2): A basic or generic comment is made about security measures, with little reference to GreenLeaf's scenario.
(d) L0 (0): No creditable content.
(d) Answer: Extended, levels-marked response: award marks holistically against the levels of response grid, using the indicative content as a guide to creditable points; there is no single correct wording.

Question 12

(a) B1 thick or dense walls/floors (e.g. containing brick, concrete or metal) can block or weaken the signal (oe)
(a) B1 interference from other wireless devices/networks operating on the same or an overlapping channel/frequency (e.g. neighbouring routers, Bluetooth devices, microwaves), or the number of devices sharing the same access point at once (oe)
(a) Answer: First, thick or dense walls or floors, such as those containing brick, concrete or metal, can block or weaken the WiFi signal. Second, interference from other wireless devices or networks operating on the same or an overlapping channel, such as neighbouring routers or Bluetooth devices, can reduce reliability.
(b) B1 advantage: 5GHz offers a higher maximum data transfer rate, and is typically less congested/subject to interference, since fewer devices use this band (oe)
(b) B1 disadvantage: 5GHz has a shorter range and penetrates solid obstacles, such as walls, less effectively than 2.4GHz, so coverage is reduced (oe)
(b) Answer: Advantage: the 5GHz band offers a higher maximum data transfer rate and is typically less congested, since fewer devices use this band. Disadvantage: the 5GHz band has a shorter range and does not penetrate solid obstacles, such as walls, as effectively as 2.4GHz, so it provides reduced coverage.
(c) B1 WEP uses a single, static shared key with the relatively weak RC4 encryption algorithm, which has known flaws and can be cracked (e.g. using freely available tools) relatively quickly (oe)
(c) B1 WPA3 uses a much stronger, modern encryption/authentication method (e.g. Simultaneous Authentication of Equals, SAE), generating a unique session key for each connection rather than reusing one static key (oe)
(c) B1 this makes WPA3 far more resistant to offline dictionary/brute-force attacks and eavesdropping than WEP's outdated, easily broken encryption (oe)
(c) Answer: WEP uses a single, static shared key together with the relatively weak RC4 encryption algorithm, which has known flaws and can be cracked relatively quickly using freely available tools. WPA3 instead uses a much stronger, modern authentication method (Simultaneous Authentication of Equals, SAE), which generates a unique session key for each connection, rather than reusing one static key. This makes WPA3 far more resistant to offline dictionary and brute-force attacks and to eavesdropping than WEP's outdated, easily broken encryption.

Question 13

(a) M1 leading zeros correctly removed within each group and/or the longest run of consecutive all-zero groups correctly identified (the three groups in positions 3 to 5)
(a) A1 2001:db8::ff00:42:8329 cao
(a) Answer: 2001:db8::ff00:42:8329
(b) B1 IPv4's 32-bit address space (around 4.3 billion addresses) has effectively run out/been exhausted, given the huge growth in the number of Internet-connected devices, so a much larger address space was needed (oe)
(b) Answer: IPv4's 32-bit address space of around 4.3 billion addresses has effectively run out, given the huge growth in the number of Internet-connected devices, so IPv6's much larger 128-bit address space was introduced to provide enough unique addresses for the future.
(c) L3 (5-6): A clear discussion of at least three distinct, accurate challenges (e.g. compatibility/transition mechanisms, cost of upgrading hardware, and the slow/gradual pace of adoption), reaching a supported conclusion.
(c) L2 (3-4): Some accurate challenges are identified, with limited depth or development.
(c) L1 (1-2): A basic or generic comment is made about IPv4 to IPv6 migration, with little development.
(c) L0 (0): No creditable content.
(c) Answer: Extended, levels-marked response: award marks holistically against the levels of response grid, using the indicative content as a guide to creditable points; there is no single correct wording.

Networking and the Internet - Worksheets, Questions and Revision