Detecting & preventing cyber security threats – GCSE Computer Science exam questions with mark scheme

1Grade 1–33 marks

Many smartphones let the owner unlock the phone without typing a passcode.

(a) Give two biometric measures that a smartphone could use to identify its owner. [2]

(b) State what is meant by a biometric measure. [1]

(a) Any two from, one mark each: fingerprint (scan / recognition, accept 'touch ID'); face / facial recognition; iris or retina scan; voice recognition; accept any other valid biometric. Do not accept PIN, pattern or password(1)
(a) Second, different biometric from the list above (e.g. fingerprint and thumbprint count as one)(1)
(b) A measure that uses a unique physical (or behavioural) characteristic of the person / 'something you are'; accept 'part of the body'(1)
Answer: (a) e.g. fingerprint scan and facial recognition (b) Identification using a unique physical characteristic of the person
Examiner tip: A passcode or swipe pattern is not biometric – it is something you know, not something you are.

2Grade 1–33 marks

When a customer buys tickets on a concert website, they must copy the characters shown in the box below before the purchase is allowed.

(a) State the name of this security measure. [1]

(b) Explain why the website uses this measure. [2]

(a) CAPTCHA; accept 'Completely Automated Public Turing test to tell Computers and Humans Apart'; accept 'I am not a robot test'(1)
(b) To check that the user is a human (and not a computer program / bot / automated script)(1)
(b) Because distorted characters are easy for a human to read but hard for a program to read // so bots cannot buy up all the tickets / create many accounts / flood the site automatically(1)
Answer: (a) CAPTCHA (b) It checks the buyer is a human, not a bot, because distorted text is hard for software to read – stopping automated programs from bulk-buying tickets
Examiner tip: The second explanation mark needs a consequence – say what the bot would otherwise do (bulk-buy, spam accounts), not just 'to stop bots'.

3Grade 4–53 marks

Priya creates an account on a food-delivery app. Before she can place an order, the app sends an email to the address she typed in. The email contains a link that she must click.

(a) State the name of this security measure. [1]

(b) Explain how this measure helps to protect the app and its users. [2]

(a) Email confirmation; accept 'email verification' / 'confirmation link'(1)
(b) It confirms that the email address belongs to / is controlled by the person creating the account (because only the owner can read the inbox and click the link)(1)
(b) So accounts cannot be created using someone else's email address // so fake / bot accounts are harder to create // so the user can be contacted (e.g. to reset a password) at a genuine address(1)
Answer: (a) Email confirmation (b) Clicking the link proves Priya controls that inbox, so nobody can sign up using an address they do not own and fake accounts are harder to create
Examiner tip: Say what the link proves (control of the inbox) – 'it checks the email is real' on its own is too vague for the first explanation mark.

Stuck on Detecting & preventing cyber security threats?

Get it sorted in a free 30-minute session

We work through your weakest questions on this topic on Zoom. I reply the same day.

Free 30-min session on this topic Send me 5 questions a day

4Grade 4–54 marks

A tablet can be unlocked with a PIN made of digits 0–9 only.

(a) Calculate the number of different 5-digit PINs that are possible. [1]

(b) The owner changes the setting so that the PIN must be 7 digits long. Calculate how many times more PINs are possible with 7 digits than with 5 digits. [1]

(c) A password system allows letters as well as digits. Explain why a password that mixes upper-case letters, lower-case letters and digits is harder to crack than a PIN of the same length. [2]

(a) 100 000; accept $10^5$(1)
(b) 100 (times more); accept $10^7 \div 10^5$ or $10^2$; allow follow-through from an incorrect (a)(1)
(c) There are more possible characters (symbols) to choose from in each position (62 rather than 10)(1)
(c) So there are (many) more possible combinations / it takes a brute-force attack far longer to try every combination(1)
Answer: (a) 100 000 (b) 100 times (c) Each position can be one of 62 characters instead of 10, so there are far more combinations and a brute-force attack takes much longer
Examiner tip: For (b) divide the two totals – students who write '10 000 000' have found the number of 7-digit PINs, not how many times more.

5Grade 4–54 marks

A library has 40 public computers. The IT technician has set the operating system and web browser on every computer to install updates automatically.

(a) Explain why automatic updates help to protect the computers from cyber security threats. [2]

(b) Describe one disadvantage of installing updates automatically. [2]

(a) Updates fix / patch security vulnerabilities (bugs / weaknesses) in the software that attackers or malware could exploit(1)
(a) Installing them automatically means the fix is applied as soon as it is released / without relying on the technician or users remembering, so the computers are not left unpatched (out of date)(1)
(b) Any one disadvantage, e.g. the update may install / restart at an inconvenient time; the update may introduce a new bug or stop other software working; uses network bandwidth / storage; no chance to test the update first(1)
(b) Expansion of the chosen disadvantage in context, e.g. a computer restarting while a library user is working loses their work; an untested update could stop the library catalogue software running on all 40 computers at once(1)
Answer: (a) Updates patch known vulnerabilities; doing it automatically means no computer is left unpatched because someone forgot (b) e.g. a forced restart could interrupt a library user and lose their work
Examiner tip: The spec threat is 'unpatched and/or outdated software' – use the word patch or vulnerability, not just 'keeps it up to date'.

6Grade 4–53 marks

The table lists three cyber security problems found at a small business. Complete the table by writing the most suitable measure from the list to solve each problem. Each measure may be used once. [3]

Measures: automatic software updates biometric measures CAPTCHA email confirmation password system

Problem	Measure
Hundreds of fake customer accounts are being created every hour on the company's website.
Several laptops are running an old version of their operating system that has a known vulnerability.
Staff share one short word to log in to the stock system and it has not been changed for three years.

Fake accounts → CAPTCHA; allow email confirmation(1)
Old operating system → automatic software updates(1)
Shared short word → password system (e.g. strong, individual passwords that are changed regularly); accept biometric measures(1)
Answer: CAPTCHA (or email confirmation); automatic software updates; password system
Examiner tip: Read the clue words: 'every hour' points to bots (CAPTCHA), 'old version' points to updates – matching questions are lost by guessing rather than reading.

7Grade 6–74 marks

Part of the login log for a company's email server is shown.

Time	Username	Result	Source address
02:14:05	jkhan	FAIL	203.0.113.9
02:14:06	jkhan	FAIL	203.0.113.9
02:14:06	jkhan	FAIL	203.0.113.9
02:14:07	jkhan	FAIL	203.0.113.9
02:14:07	jkhan	FAIL	203.0.113.9
02:14:08	jkhan	FAIL	203.0.113.9
02:14:08	jkhan	OK	203.0.113.9

(a) Explain why this log suggests that the account was accessed by an attacker rather than by the real user. [2]

(b) Describe one feature that could be added to the password system to detect or prevent this kind of attack. [2]

(a) Many attempts (six failures) in a very short time / several per second, which is too fast for a human typing, so a program (brute-force / automated attack) is trying passwords(1)
(a) Any further evidence: it happens at 02:14 at night when staff are unlikely to be working // the attempts all come from one outside address // the final success straight after repeated failures suggests the password was eventually guessed(1)
(b) One feature: lock the account (or block the address) after a set number of failed attempts // add a delay / increasing wait after each failure // require a CAPTCHA after repeated failures // alert the user/administrator about failed logins // require a second factor (e.g. code sent to phone)(1)
(b) How it stops the attack: e.g. the lockout means the program cannot keep trying passwords / the delay makes trying thousands of passwords take far too long / the real user is warned and can change the password(1)
Answer: (a) Six failures within three seconds at 2 a.m. from one address, then a success – far too fast for a person, so an automated password-guessing program was used (b) e.g. lock the account after 3 failed attempts so the program cannot keep guessing
Examiner tip: Quote the evidence from the log (times, count of failures) – a general answer about 'hackers' without reference to the data scores at most one mark.

8Grade 6–74 marks

A smartphone can be unlocked either by typing a 6-digit passcode or by scanning the owner's fingerprint.

Compare using a fingerprint scan with using a passcode to unlock the phone. [4]

Fingerprint cannot be forgotten / does not need to be remembered, whereas a passcode can be forgotten(1)
Fingerprint cannot be watched and copied (shouldering) / guessed / shared with someone else, whereas a passcode can be seen being typed, guessed or told to another person(1)
Fingerprint is quicker / more convenient to use than typing six digits(1)
A passcode can be changed if it is discovered, but a fingerprint cannot be changed if the stored data is stolen // a fingerprint scanner may fail to recognise the owner (wet / cut finger) or may be fooled by a copy, whereas a passcode always works if typed correctly // both are 'something you are' vs 'something you know'; max 3 marks if only advantages of one method are given(1)
Answer: Fingerprint: can't be forgotten, can't be shouldered or shared, faster. Passcode: can be changed if compromised and works even when the scanner fails to read a finger
Examiner tip: 'Compare' means both sides must appear – give at least one point in favour of the passcode (e.g. it can be changed) or the fourth mark is capped.

9Grade 6–74 marks

A company tests the facial-recognition unlock on a new phone.

The owner tried to unlock the phone 2000 times. The phone unlocked 1950 times and refused 50 times.
500 other people tried to unlock the phone. The phone wrongly unlocked for 5 of them.

(a) Calculate the percentage of the owner's attempts that were wrongly refused. [1]

(b) Calculate the percentage of other people's attempts that were wrongly accepted. [1]

(c) The company says the phone is secure because only 0.2 % of all 2500 attempts wrongly unlocked the phone. Explain why this figure is misleading. [2]

(a) 2.5 %; accept 2.5 without % sign(1)
(b) 1 %; accept 1.0 %(1)
(c) The figure mixes the owner's attempts (which cannot be wrongly accepted) with other people's / most of the 2500 attempts were by the owner(1)
(c) The security risk is the 1 in 100 strangers (1 %) who could unlock it, which is five times worse than 0.2 % suggests // false acceptances should only be measured against the attempts by other people(1)
Answer: (a) 2.5 % (b) 1 % (c) 2000 of the 2500 attempts were by the owner, so they dilute the figure; the real false-accept rate is 1 in 100 strangers (1 %), which is five times higher than 0.2 %
Examiner tip: Use the correct denominator: false rejections are out of the owner's 2000 attempts, false acceptances out of the strangers' 500 – not out of 2500.

10Grade 8–96 marks

An online pharmacy lets customers create an account, log in and order prescription medicines. The pharmacy has had problems with bots creating fake accounts, customers choosing weak passwords, and one customer's account being accessed by someone else.

Discuss the measures the pharmacy could use to detect and prevent these threats. In your answer you should explain how each measure would help the pharmacy. [6]

CAPTCHA at sign-up / checkout: distorted text or image puzzle that a human can solve but a bot cannot, stopping automated creation of fake accounts(1)
Email confirmation: a link sent to the given address must be clicked before the account works, proving the person controls that inbox and making bulk fake accounts harder(1)
Password system rules: minimum length, mix of character types, reject common passwords, so brute-force / dictionary attacks take far longer(1)
Password system features: lock account or add delays after repeated failed logins; alert the customer to logins from a new device; require a second factor such as a code sent to the phone(1)
Biometric login in the pharmacy's mobile app (fingerprint / face) so the customer need not type a password that can be guessed, shouldered or reused(1)
Automatic software updates on the pharmacy's servers / app so known vulnerabilities are patched before attackers exploit them(1)
Evaluation: trade-offs such as CAPTCHA annoying genuine customers, biometrics cannot be changed if stolen, lockouts can be used to lock out genuine users; links each measure to a stated problem(1)

Level	Marks	What it looks like
Level 3	5–6	Three or more relevant measures explained clearly and each linked to the specific problem it solves; the answer is well organised and shows some judgement about which measures matter most or their drawbacks.
Level 2	3–4	At least two measures described with some explanation of how they help; links to the pharmacy's problems may be partial or uneven.
Level 1	1–2	One or two measures named with little or no explanation; general statements about security that are not tied to the scenario.

Answer: A top answer picks CAPTCHA and email confirmation for the bot problem, strong-password rules plus lockout/alerts/second factor for weak passwords and account takeover, biometrics in the app, and automatic updates, explaining how each one addresses the named problem and noting a drawback or two
Examiner tip: Tie every measure to one of the three named problems – a list of five security words with no link to bots, weak passwords or the hijacked account stays in Level 1.

Stuck on this topic?

Book a free 30-minute session on WhatsApp and we'll find exactly which step is costing you the marks. Or build a timed paper on it.

Free 30-minute session