Threats to computer systems and networks – GCSE Computer Science exam questions with mark scheme

1Grade 1–33 marks

Identify the threat described in each situation. Choose from: brute-force attack, denial of service (DoS) attack, phishing, data interception.

(a) A program tries thousands of passwords one after another to log into an account. [1]

(b) A website receives so many fake requests that real customers cannot use it. [1]

(a) Brute-force attack(1)
(b) Denial of service / DoS; allow DDoS(1)
(c) Phishing; allow 'smishing'(1)
Answer: (a) Brute-force (b) DoS (c) Phishing
Examiner tip: Read each description for the key clue: 'tries many passwords' = brute force; 'flooded with requests' = DoS.

2Grade 4–54 marks

(a) State what is meant by malware. [1]

(b) Describe what ransomware does. [2]

(a) Software written / designed to cause harm / damage to a computer system or its user (e.g. delete data, steal data, take control). Do not accept 'malicious software' alone without saying what it does(1)
(b) Encrypts the user's files / locks the user out of their system / data(1)
(b) Demands a payment / ransom (often in cryptocurrency) to decrypt / unlock them(1)
(c) Anti-malware / anti-virus software; allow firewall; allow keeping software updated / patched; allow staff training not to open unknown attachments or links; allow user access levels that stop users installing software(1)
Answer: (a) Software designed to harm a system (b) Encrypts files and demands payment to unlock them (c) Anti-malware software
Examiner tip: 'Malicious software' on its own just expands the word – add that it is designed to cause damage or harm.

3Grade 4–54 marks

Employees at a company receive the email below.

From: [email protected]
Subject: URGENT – account suspended

Dear user,
Your account will be deleted in 1 hour.
Click here to verify your password: http://c0mpany-login.biz

(a) Identify two features of the email that suggest it is a phishing attempt. [2]

(b) Describe two ways the company could reduce the risk of employees being affected by phishing. [2]

(a) Any two from: sender address is not the company's real domain / uses a zero instead of an 'o'; link goes to a non-company / misspelt site (c0mpany-login.biz); allow link is http not https; urgency / threat ('URGENT', 'deleted in 1 hour'); generic greeting ('Dear user'); asks the user to enter / verify their password(1)
(a) Second, different feature from the list(1)
(b) Any two from: train staff to recognise phishing emails and not click links / give out passwords (and to report them); use email / spam filtering to block suspicious emails; two-factor authentication so a stolen password alone is not enough; a policy that IT never asks for passwords by email; allow firewall / web filtering that blocks known phishing sites(1)
(b) Second, different method from the list(1)
Answer: (a) Fake domain with 0 for o; urgent threat; generic greeting; asks for password (b) Staff training; spam filtering / 2FA
Examiner tip: Quote the actual evidence from the email – 'it looks fake' scores nothing.

4Grade 6–75 marks

An online shop's login page builds an SQL query from what the user types:

SELECT * FROM customers WHERE username = 'username' AND password = 'password'

(a) Explain how a hacker could use SQL injection on this login page. [2]

(b) Give two ways the shop could prevent SQL injection. [2]

(a) The hacker types SQL code / commands into an input box (e.g. the username or password field), such as ' OR '1'='1 in the password box or admin'-- in the username box; accept any valid example or a description of entering SQL instead of normal data(1)
(a) This changes the query that is run on the database so it always returns true / bypasses the login / reveals, changes or deletes data(1)
(b) Any two from: input validation / sanitisation – check or reject inputs containing SQL characters (e.g. quotes) or keywords, escape special characters, or limit input length (these are all one method: e.g. 'validation' plus 'length check' = 1 mark only); parameterised queries / prepared statements so input is treated as data, not code; limit the database access level of the web page's account so it cannot change / delete data; allow regular penetration testing only if linked to finding and fixing the weakness(1)
(b) Second, different method from the list(1)
(c) Authorised / simulated attacks on a system (by people employed to do so) to find weaknesses / vulnerabilities so they can be fixed(1)
Answer: (a) Enter SQL code into a field so the query is changed, e.g. always true → login bypassed / data revealed (b) Input validation/sanitisation; parameterised queries (c) Authorised simulated attacks to find vulnerabilities
Examiner tip: In (a), say what the injected code does to the query – 'they hack the database' scores 0.

Still losing marks on this topic?

Book a free introductory session and we'll find exactly which step is costing you.

Book a free intro