Cyber security: free AQA GCSE Computer Science practice questions

The mistakes that cost the most marks

These are the confusions the examiners see most.

• Saying a virus and a worm are the same. A virus needs a host file and usually a user action. A worm spreads by itself.
• Saying a denial of service attack steals data. It denies access. It does not take anything.
• Naming a threat when the question asks for a prevention method, or the other way round.
• Saying a firewall stops viruses. A firewall filters network traffic. Anti-malware software deals with malware already on the machine.
• Giving have a strong password as the answer to SQL injection. The fix is input validation and parameterised queries.
• Forgetting physical security. Locked rooms and shredded documents are part of the answer.

Attacks on people rather than technology

Cyber security means the processes, practices and technologies used to protect networks, computers, programs and data from attack, damage and unauthorised access. Social engineering means manipulating people into giving away information or access. It works because people, not software, are usually the weakest point. Blagging, also called pretexting, is inventing a scenario to persuade a victim to hand over information, such as pretending to be from the IT department. Phishing sends a message that looks like it comes from a trusted organisation to trick the victim into clicking a link or entering credentials on a fake site. Pharming redirects a victim to a fake website even though they typed the correct address. Shouldering is simply watching someone enter a PIN or password.

The malware families

Malware is any software written to cause harm. A virus attaches itself to a file and spreads when that file is run. A worm spreads by itself across a network without needing a host file or user action. A trojan pretends to be useful software so the user installs it willingly, then does something harmful once inside. Ransomware encrypts the victim's files and demands payment for the key. Spyware records what the user does, and a keylogger records keystrokes including passwords.

Attacks on systems

A brute force attack tries every possible password until one works. Longer, more varied passwords and a limit on failed attempts make it impractical. A denial of service attack floods a server with more requests than it can handle so that genuine users cannot get through. It stops the service and steals nothing. Data interception and theft means capturing data as it travels across a network, for example on an open wireless network, and encryption is the defence. SQL injection means typing SQL into an input box so that it is executed by the database, letting an attacker read or destroy data. It works when input is not validated or the query is built by pasting user text into it.

The defences you have to name

Penetration testing means deliberately attacking your own system, with permission, to find weaknesses before a real attacker does. A firewall inspects traffic entering and leaving a network and blocks anything that does not meet the rules. User access levels give each person only the rights they need, so a compromised ordinary account cannot reach everything. Strong passwords, changed regularly and never reused, plus two factor authentication, defeat most casual attacks. Anti-malware software detects and removes known malware. Encryption protects data even if it is stolen, because without the key the file is unreadable.

Physical security is part of the answer

Locked server rooms, cable locks, CCTV and shredding printed data all count. There is no point having a firewall if someone can walk out with the server. The topic notes list physical measures alongside the technical ones, so a question that asks for several ways of protecting a system can be answered from more than one kind.