Question bank › GCSE Computer Science › Cyber security

Cyber security: social engineering, malware & threats

Answer on paper first, then reveal the mark scheme one mark at a time.

1Grade 4–56 marks

(a) Describe each of the following forms of social engineering. [3]

(i) Blagging
(ii) Phishing
(iii) Shouldering

(b) Explain one difference between a virus and a trojan. [2]

(a)(i) Blagging: creating / using an invented scenario (pretending to be someone, e.g. on the phone or in person) to persuade the victim to give out information or do something they normally would not; allow pretexting(1)
(a)(ii) Phishing: sending fake emails / text messages (SMS) that appear to come from a trusted organisation to trick people into giving private information (e.g. passwords, bank details)(1)
(a)(iii) Shouldering: watching someone (e.g. over their shoulder) to see private information such as a PIN or password as they enter it; allow shoulder surfing(1)
(b) Virus: attaches itself to / infects other files or programs and replicates / spreads itself (when the infected file is run)(1)
(b) Trojan: is disguised as legitimate / useful software that the user is tricked into installing or running or does not replicate / spread by itself (either idea earns the mark; the two halves may describe the defining feature of each, e.g. 'a virus copies itself, a trojan pretends to be useful software'). A one-sided answer (only virus or only trojan described) = max 1(1)
(c) Secretly gathers / monitors information about the user or their activity (e.g. keystrokes, websites visited) without their knowledge; allow and sends it to a third party(1)
Answer: (a) Blagging = using an invented scenario to get information; phishing = fake emails/texts to obtain private details; shouldering = watching someone enter private information. (b) A virus replicates by attaching to other files; a trojan is disguised as useful software and does not replicate. (c) Spyware secretly gathers information about the user without their knowledge.
Examiner tip: Blagging and phishing are different: blagging is a made-up scenario usually in person or by phone, phishing is via fake messages.

2Grade 6–76 marks

A school employs a security company to carry out penetration testing on its network.

(a) Describe the two types of penetration testing the company could carry out. [2]

(b) The test finds that many staff use weak passwords and that students can open folders containing staff records. For each problem, explain why it is a risk and describe how the school could reduce it. [4]

(a) Insider test: the tester has knowledge of, and possibly basic login credentials for, the system, simulating an attack by a malicious insider (either the credentials idea or the insider idea earns the mark); allow white-box testing if described(1)
(a) External test: the tester has no knowledge of any credentials for the system, simulating an attack by an external attacker / hacker from outside (either idea earns the mark); allow black-box testing if described(1)
(b) Weak passwords: can easily be guessed / cracked (e.g. by a brute-force or dictionary attack), so an attacker could get unauthorised access to staff accounts and data(1)
(b) Reduce by enforcing a strong password policy, e.g. minimum length, mix of letters / numbers / symbols, not using common words, locking the account after several failed attempts; allow two-factor authentication / biometrics / requiring regular password changes(1)
(b) Folders: access rights are wrongly set, so students could view / change / delete / share staff personal data they should not see (allow could breach data protection law); the consequence is needed, the phrase 'misconfigured' is not(1)
(b) Reduce by setting correct access rights / user permissions (e.g. user groups) so only authorised staff can access staff records(1)
Answer: (a) Insider test: tester has knowledge and basic credentials (simulates a malicious insider); external test: tester has no credentials (simulates an outside attack). (b) Weak passwords can be guessed/cracked – enforce a strong password policy / 2FA; misconfigured access rights let students see staff data – set correct permissions.
Examiner tip: Each risk needs a consequence (what an attacker could DO) as well as the fix.

Still losing marks on this topic?

Book a free introductory session and we'll find exactly which step is costing you.

Book a free intro