Network Security - Worksheets, Questions and Revision

19 original exam-style questions - 9 pages of questions with a full mark scheme - free printable PDF.

Download PDF Jump to mark scheme (page 10)Read the revision guide

Next in this strand

Revision Library

revisionlibrary.co.uk

GCSE · Computer Science

P1.6 Network Security

OCR J277 · Calculators not allowed · about 90 minutes

Total Marks

Name: _______________________________ Date: ____ / ____ / ______

Answer ALL questions. Show all your working.

This question is about basic network security terminology.

(a)Which term describes software that is deliberately designed to damage, disrupt or gain unauthorised access to a computer system?(1)

A) Firmware
B) Malware
C) Freeware
D) Middleware

(b)Which type of malware can replicate itself and spread across a network without attaching itself to another program or needing a user to run it?(1)

A) Virus
B) Worm
C) Trojan
D) Spyware

(c)Which type of attack involves tricking a user into revealing personal or financial information by pretending to be from a genuine, trustworthy organisation (e.g. in a fake email)?(1)

A) Brute force
B) Denial of service
C) Phishing
D) SQL injection

(Total for Question 1 is 3 marks)

Four employees at a company called Hartlepool Logistics describe problems with their work computers. For each description, name the most likely type of malware responsible. Choose from: virus, worm, trojan horse, ransomware.

(a)Priya's files have all been encrypted and a message on her screen demands payment in exchange for the decryption key.(1)

(b)Deshawn downloaded a free game from an unofficial website. The game appeared to work normally, but it secretly installed a program that now lets an attacker access his files remotely.(1)

(c)Overnight, the same malicious program appeared on every computer on the office network, without any employee opening a file or clicking a link.(1)

(d)Aisha noticed her computer running slowly after opening an email attachment; the same corrupted code was then found attached to several of her other documents.(1)

(Total for Question 2 is 4 marks)

Explain the difference between phishing and pharming as methods of attacking a network user.

(Total for Question 3 is 3 marks)

State three separate offences created by the Computer Misuse Act (1990).

(Total for Question 4 is 3 marks)

A company issues staff with a PIN to unlock the office door keypad.

(a)The PIN is exactly 4 digits long, and each digit can be any digit from 0 to 9 (digits may repeat). Calculate the total number of different PINs that are possible.(2)

(b)The company is considering changing to a password made of exactly 4 characters, where each character can be any of the 26 lowercase letters, 26 uppercase letters or 10 digits (62 characters in total, repetition allowed). Write down the calculation, without evaluating it, that would give the total number of different passwords possible.(1)

(c)Using your answers to parts (a) and (b), explain why changing to the password system in part (b) would make the office door system more resistant to a brute-force attack.(2)

(Total for Question 5 is 5 marks)

A retailer's website becomes unavailable to customers after being targeted by a denial-of-service (DoS) attack.

(a)Describe what happens during a denial-of-service attack.(2)

(b)State one negative effect that a successful denial-of-service attack could have on the retailer's business.(1)

(Total for Question 6 is 3 marks)

A website's login page checks a user's credentials using the following line of code, which builds an SQL query from the text entered into the username and password boxes:

SELECT * FROM users WHERE username = 'INPUT_USERNAME' AND password = 'INPUT_PASSWORD';

An attacker enters the following into the username box, leaving the password box empty:

' OR '1'='1

(a)Identify the type of attack the code above is vulnerable to.(1)

(b)Explain how entering ' OR '1'='1 into the username box could allow the attacker to log in without knowing a valid username or password.(2)

(c)State one method a web developer could use to help prevent this type of attack.(1)

(Total for Question 7 is 4 marks)

A large organisation employs ethical hackers to carry out penetration testing on its network.

(a)State the purpose of penetration testing.(2)

(b)Describe the difference between black-box and white-box penetration testing.(2)

(Total for Question 8 is 4 marks)

Explain how a firewall helps to protect a school's internal network from threats on the internet.

(Total for Question 9 is 3 marks)

A cafe offers customers a wireless network.

(a)State one reason why an unencrypted (open) wireless network is a greater security risk than a wired network.(1)

(b)State the name of a protocol that could be used to encrypt traffic on the cafe's wireless network, and give one reason why using it is preferable to leaving the network open.(2)

(Total for Question 10 is 3 marks)

Every device on a network is identified, in part, by its IP address and MAC address.

(a)One octet of an IPv4 address has the denary value 182. Convert 182 to an 8-bit binary number.(2)

(b)Part of a device's MAC address is written in hexadecimal as 2F. Convert 2F to an 8-bit binary number.(2)

(c)Convert 2F (hexadecimal) to a denary number.(1)

(Total for Question 11 is 5 marks)

State three different physical security measures that an organisation could use to protect the server room containing its network hardware. For each measure, justify why it helps to keep the servers secure.

(Total for Question 12 is 6 marks)

Encryption is used to protect data sent across a network.

(a)Explain what is meant by encryption, and why it is used to protect data sent over a network.(3)

(b)A simple cipher encrypts a message by shifting every letter 3 places forward in the alphabet (wrapping around, so X->A, Y->B, Z->C). Show that encrypting the plaintext WIFI using this cipher produces the ciphertext ZLIL.(2)

(c)State one weakness of this shift cipher compared to modern encryption methods used on networks.(1)

(Total for Question 13 is 6 marks)

Explain how giving employees different user access levels can reduce the risk of an insider threat compromising sensitive data on a company's network.

(Total for Question 14 is 3 marks)

The pseudocode below is intended to check whether a password is "Strong" (at least 8 characters long and containing at least one digit) or "Weak". It uses the OCR Exam Reference Language function MID(string, start, numChars), which returns numChars characters from string, starting at position start (the first character in a string is at position 1).

password <- "Cod3"
length <- LEN(password)
hasDigit <- FALSE
count <- 0
FOR i <- 1 TO length
  currentChar <- MID(password, i, 1)
  IF currentChar >= "0" AND currentChar <= "9" THEN
    hasDigit <- TRUE
  ENDIF
  count <- count + 1
NEXT i
IF length >= 8 AND hasDigit = TRUE THEN
  OUTPUT "Strong"
ELSE
  OUTPUT "Weak"
ENDIF

(a)Complete a trace table to show the values of currentChar, hasDigit and count for each pass of the loop, when password is set to "Cod3".(4)

(b)State the output produced when this algorithm is run with password set to "Cod3".(1)

(Total for Question 15 is 5 marks)

A secondary school's network is regularly targeted by malware, often arriving as attachments in phishing emails sent to staff and students.

Discuss the effectiveness of anti-malware software and staff/student training as methods of protecting the school's network against malware threats. In your answer you should consider the strengths and weaknesses of each method, and reach a justified conclusion about which is likely to be more effective.

(Total for Question 16 is 6 marks)

Write an algorithm, using pseudocode, that could be used to control access to an account, as follows:
- the correct password is already stored in a variable called realPassword
- the user is asked to enter a password
- the user is allowed up to 3 attempts in total
- if the user enters the correct password within 3 attempts, the algorithm should output "Access granted" and stop asking for a password
- if the user has still not entered the correct password after 3 attempts, the algorithm should output "Account locked"

You may use any valid pseudocode. Marks will be awarded for correct logic; minor syntax errors will not be penalised.

(Total for Question 17 is 6 marks)

A network manager says: "Relying on just one security measure, such as a firewall, is not enough to keep a network secure. We need several different, overlapping measures working together." This approach is often called a 'layered' or 'defence in depth' approach.

Explain why using several different security measures together is more effective than relying on a single measure.

(Total for Question 18 is 4 marks)

A company director states: "As long as we encrypt all the data stored on our network, our network will be secure."

Evaluate this statement.

(Total for Question 19 is 6 marks)

Mark scheme · P1.6 Network Security

Question 1

(a) B1 B cao
(a) Answer: B) Malware
(b) B1 B cao
(b) Answer: B) Worm
(c) B1 C cao
(c) Answer: C) Phishing

Question 2

(a) B1 Ransomware
(a) Answer: Ransomware
(b) B1 Trojan (horse)
(b) Answer: Trojan horse
(c) B1 Worm
(c) Answer: Worm
(d) B1 Virus
(d) Answer: Virus

Question 3

B1 Phishing involves sending fraudulent/fake communications (e.g. emails or texts) that appear to be from a legitimate source, to trick the user into revealing information or clicking a link (1)
B1 Pharming redirects a user from a genuine website to a fake one (e.g. by altering DNS records or a hosts file) (1)
B1 Pharming does not rely on the user being tricked into clicking anything and can happen without any deliberate action by the user, whereas phishing relies on deceiving the user into acting (1)
Answer: Phishing = fraudulent messages trick the user into acting; pharming = malicious redirection to a fake website, often without any action needed from the user.

Question 4

B1 Any one of: unauthorised access to computer material
B1 Any one of: unauthorised access with intent to commit or facilitate a further offence
B1 Any one of: unauthorised modification of computer material; or unauthorised acts with intent to impair (or reckless as to impairing) the operation of a computer
Answer: Any three of: unauthorised access to data; unauthorised access with intent to commit a further offence; unauthorised modification of data; unauthorised acts impairing the operation of a computer.

Question 5

(a) M1 10⁴ oe (e.g. 10 x 10 x 10 x 10 seen)
(a) A1 10000 cao
(a) Answer: 10000
(b) B1 62⁴ oe
(b) Answer: 62⁴
(c) B1 62⁴ gives a much larger number of possible combinations than 10⁴, because a larger character set increases the number of possible combinations (ft from (a)/(b))
(c) B1 An attacker trying every combination (brute force) would therefore need far more attempts/take far longer to find the correct password, making the attack much less likely to succeed in a practical time
(c) Answer: 62⁴ (14776336) is far greater than 10⁴ (10000), so brute-forcing the password would take much longer, making the system more secure.

Question 6

(a) B1 An attacker floods a server/network with a very large number of (useless/fake) requests or traffic (1)
(a) B1 This overwhelms the server's resources/bandwidth so it cannot respond to genuine/legitimate users (1)
(a) Answer: An attacker overwhelms a server with excessive traffic/requests so it cannot process genuine requests, taking the service offline for legitimate users.
(b) B1 Any sensible effect, e.g. loss of sales/revenue while the site is down; damage to the company's reputation; customers unable to place orders; cost of restoring the service
(b) Answer: Loss of sales/revenue because customers cannot access the website to make purchases (or other valid effect).

Question 7

(a) B1 SQL injection
(a) Answer: SQL injection
(b) M1 The entered text changes/completes the structure of the SQL query so that the condition '1'='1' is added into the WHERE clause (1)
(b) A1 Because '1'='1' is always true, the whole WHERE condition becomes true for every row, so the query returns a user record even though no correct username/password was supplied (1)
(b) Answer: It alters the query so the WHERE condition is always true, so the database returns a valid user row without a correct username/password being entered.
(c) B1 Any one of: use parameterised queries/prepared statements; validate/sanitise user input; escape special characters (e.g. apostrophes) entered by the user; use least-privilege database accounts
(c) Answer: Use parameterised queries (prepared statements) so user input cannot be interpreted as SQL code.

Question 8

(a) B1 To deliberately/legally attempt to find weaknesses/vulnerabilities in a network (1)
(a) B1 So that these vulnerabilities can be fixed before a real/malicious attacker can exploit them (1)
(a) Answer: To deliberately test a network to find security weaknesses so they can be fixed before a real attacker exploits them.
(b) B1 In black-box testing the tester is given no prior knowledge of the network/system (e.g. no login details, network diagrams or source code) and must test as an outside attacker would (1)
(b) B1 In white-box testing the tester is given full knowledge of the network/system (e.g. credentials, diagrams, source code) before testing (1)
(b) Answer: Black-box testing: tester has no prior knowledge of the system. White-box testing: tester is given full knowledge/access before testing.

Question 9

B1 A firewall sits between the internal network and an external network (e.g. the internet), monitoring incoming and outgoing traffic/packets (1)
B1 It checks traffic against a set of rules (e.g. allowed IP addresses, ports or protocols) (1)
B1 It blocks (or flags) any traffic/packets that do not meet the rules, preventing unauthorised access to or from the network (1)
Answer: A firewall monitors traffic entering/leaving the network and blocks any traffic that does not meet its security rules, preventing unauthorised access.

Question 10

(a) B1 Any nearby device can intercept/eavesdrop on the wireless signal without needing physical access to the cabling, because data travels through the air and can be picked up by anyone in range
(a) Answer: Data sent over an open wireless network can be intercepted by any device within range, without needing physical access to network cables.
(b) B1 WPA (or WPA2 or WPA3) named
(b) B1 Encrypts data sent over the wireless network so it cannot easily be read/understood if intercepted by an attacker
(b) Answer: WPA2 (or WPA3); it encrypts wireless traffic so intercepted data cannot easily be read by an attacker.

Question 11

(a) M1 Correct method shown, e.g. 128+32+16+4+2 = 182 or place-value table attempted
(a) A1 10110110 cao
(a) Answer: 10110110
(b) M1 2 -> 0010 and F -> 1111 (nibbles identified/attempted)
(b) A1 00101111 cao
(b) Answer: 00101111
(c) B1 47 cao (ft from (b) if binary answer evaluated consistently)
(c) Answer: 47

Question 12

B1 Measure 1, e.g. keycard/biometric access lock on the server room door
B1 Justification 1, e.g. only authorised staff whose card/fingerprint is registered can enter, preventing unauthorised physical access
B1 Measure 2, e.g. CCTV cameras covering the server room
B1 Justification 2, e.g. records who enters/leaves and can deter, or help identify, anyone attempting unauthorised access
B1 Measure 3, e.g. security guards/visitor sign-in log at the building entrance, or locked server cabinets/cages
B1 Justification 3, e.g. ensures only checked/verified individuals can reach the area containing the server room
Answer: Any three distinct physical security measures (e.g. keycard/biometric locks, CCTV, security guards, locked server cabinets, alarmed doors), each with a valid justification.

Question 13

(a) B1 Encryption converts data (plaintext) into an unreadable/scrambled form (ciphertext) using an algorithm and a key (1)
(a) B1 If the data is intercepted while being transmitted, it cannot be understood/read by the attacker (1)
(a) B1 Only someone with the correct key can decrypt the data back into its original readable form (1)
(a) Answer: Encryption scrambles data into ciphertext using a key so that, if intercepted, it cannot be understood; only someone with the correct key can decrypt it back to plaintext.
(b) M1 At least two letters correctly shifted with working shown, e.g. W(+3)->Z, I(+3)->L
(b) A1 All four letters correctly shown: W->Z, I->L, F->I, I->L, giving ZLIL cso
(b) Answer: ZLIL (answer given in question; working must be shown)
(c) B1 Any one of: only 25 possible shifts/keys so it can quickly be broken by trying every shift (brute force); the pattern/frequency of letters is unchanged so it is vulnerable to frequency analysis; it does not use a complex/long key like modern encryption algorithms
(c) Answer: It only has 25 possible keys (shifts), so an attacker could try every shift and break it very quickly by brute force.

Question 14

B1 Different user accounts/groups are given different permissions (e.g. read-only, read/write, administrator) depending on their role (1)
B1 Employees can only access/view/edit the data and systems that they need for their job, not the whole network (1)
B1 This limits the amount of damage/data an employee could deliberately or accidentally misuse, and makes it easier to trace which account accessed particular data (1)
Answer: Access levels restrict each employee to only the data/systems needed for their role, limiting the damage any one account could cause and making misuse easier to trace.

Question 15

(a) B1 i=1: currentChar = C, hasDigit = FALSE, count = 1
(a) B1 i=2: currentChar = o, hasDigit = FALSE, count = 2
(a) B1 i=3: currentChar = d, hasDigit = FALSE, count = 3
(a) B1 i=4: currentChar = 3, hasDigit = TRUE, count = 4 (ft correct identification of a digit character)
(a) Answer:
i currentChar hasDigit count
1 C FALSE 1
2 o FALSE 2
3 d FALSE 3
4 3 TRUE 4
(b) B1 "Weak" ft from part (a) if length and hasDigit evaluated consistently
(b) Answer: Weak

i	currentChar	hasDigit	count
1	C	FALSE	1
2	o	FALSE	2
3	d	FALSE	3
4	3	TRUE	4

Question 16

Level 1 (1-2): Basic, undeveloped comments about anti-malware software and/or staff training are given, with little or no comparison. Little relevant technical terminology is used. No conclusion, or an unsupported conclusion.
Level 2 (3-4): Some relevant strengths and/or weaknesses of both methods are described, showing some understanding of how each works. Some comparison is attempted, but the discussion may be one-sided or lack detail in places. Relevant technical terminology is generally used correctly. A conclusion is given, with limited justification.
Level 3 (5-6): A well-balanced discussion clearly describes strengths and weaknesses of both anti-malware software and staff training, showing clear understanding of how each reduces the risk of malware infection and the limitations of each. Relevant technical terminology is used correctly throughout. A justified conclusion is reached that is well supported by the points made.
Indicative content:
- Anti-malware software can automatically scan files/emails/attachments and detect or quarantine known malware using a database of virus definitions/signatures
- Anti-malware software needs to be regularly updated to recognise new malware; it may not detect brand new (zero-day) malware whose signature is not yet known
- Anti-malware runs continuously/automatically without relying on staff remembering to act, so it protects against mistakes even when staff are careless
- Staff/student training teaches users to recognise suspicious emails/attachments/links (e.g. unexpected sender, spelling mistakes, urgent requests) and not to open or click them
- Training relies on human behaviour, which is not always reliable; a single tired, rushed or careless user can still open a malicious attachment even after training
- Training does not stop malware that arrives through other routes (e.g. infected USB sticks, software vulnerabilities) that do not require a user to be tricked
- The two methods are complementary: anti-malware provides a technical safety net, while training reduces the number of malicious emails opened in the first place
- A justified conclusion might state that using both together is most effective, since anti-malware alone cannot stop all new threats and training alone cannot guarantee human error is eliminated

Question 17

M1 Uses a loop (e.g. WHILE or FOR) that will not run more than 3 times in total
M1 Inputs a password from the user inside the loop, on each pass
M1 Compares the entered password to realPassword
M1 Correctly counts/tracks the number of incorrect attempts (e.g. increments a counter only when incorrect, or an equivalent valid method)
M1 Stops asking for further passwords and outputs "Access granted" as soon as a correct password is entered (within the 3 attempts)
M1 Outputs "Account locked" if, and only if, 3 incorrect attempts have been made

Answer:

realPassword <- "Sunfl0wer"
attempts <- 0
accessGranted <- FALSE
WHILE attempts < 3 AND accessGranted = FALSE
  password <- INPUT("Enter password: ")
  IF password = realPassword THEN
    accessGranted <- TRUE
  ELSE
    attempts <- attempts + 1
  ENDIF
ENDWHILE
IF accessGranted = TRUE THEN
  OUTPUT "Access granted"
ELSE
  OUTPUT "Account locked"
ENDIF

Question 18

B1 No single security measure can protect against every type of threat (e.g. a firewall controls network traffic but does not stop a user being tricked by phishing, or malware arriving on a USB stick) (1)
B1 If one measure fails or is bypassed (e.g. an attacker gets past the firewall), other measures (e.g. anti-malware, access levels, encryption) can still stop or limit the attack (1)
B1 Different measures target different stages/types of attack (e.g. prevention, detection and limiting damage), so combining them covers more of the possible ways a network could be attacked (1)
B1 This reduces the overall risk/likelihood of a successful attack and/or reduces the impact if one layer is breached, compared with depending on a single measure (1)
Answer: No single measure covers every threat; combining measures means that if one is bypassed, others still provide protection, reducing the overall risk and impact of a successful attack.