Network security: firewalls, vulnerabilities, countermeasures and encryption

Explain the difference between symmetric and asymmetric encryption, and state why HTTPS uses both. [4]

A school's network administrator configures a firewall.

(a) Outline what is meant by a whitelist in the context of a firewall. [1]

(b) Outline what is meant by a blacklist in the context of a firewall. [1]

(c) State which of the two approaches is more secure against a newly created malicious website, giving a reason. [1]

A packet-filtering firewall checks each incoming packet against the rules below in order, from rule 1 downwards. The first rule that matches is applied and no further rules are checked.

(a) For each packet below, state whether it is allowed or denied and the number of the rule that decides this. [4]

(b) The administrator accidentally swaps the positions of rules 2 and 3. Explain the effect this has on packet B. [1]

(c) State whether rule 5 makes this firewall work as a whitelist or a blacklist. [1]

A home network uses a router with network address translation (NAT), as shown in the diagram. The router's public IP address is 81.2.69.160.

(a) The tablet requests a web page from a server on the internet. State the source IP address that the web server sees on the request. [1]

(b) An attacker on the internet sends a packet to 81.2.69.160 that is not a reply to any request made from inside the network. Explain how NAT helps protect the devices on the home network in this situation. [2]

(c) State one limitation of relying on NAT alone for security. [1]

A small accountancy firm has installed a firewall between its office network and the internet. The manager says: "Now that we have a firewall, our network is fully protected."

Discuss the effectiveness of the firewall in protecting the firm's network. [6]

For each scenario, identify the network vulnerability being exploited and state one countermeasure that would reduce the risk.

(a) A student connects to a café's open Wi-Fi. An attacker on the same network secretly relays the traffic between the student's laptop and a website, reading and altering the data. [2]

(b) On a forum, a user posts a comment containing a hidden script. When other users view the comment, the script runs in their browsers and sends their session cookies to the attacker. [2]

(c) Several staff at a company use passwords such as Summer2026. An attacker uses a list of leaked passwords and logs in to an employee's email account. [2]

A website's login page builds an SQL query by joining the user's input directly into a string:

query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'"

The table users contains a row for the user admin. In SQL, -- starts a comment, so the rest of the line is ignored.

An attacker enters admin' -- as the username and x as the password.

(a) Write down the exact query that is sent to the database. [1]

(b) Explain why the attacker is logged in as admin without knowing the password. [2]

(c) Describe one countermeasure that would prevent this attack. [2]

An online ticket shop monitors the number of requests per second reaching its web server. The graph shows the rate over a 10-minute period. During minutes 4–9 the requests came from about 30 000 different IP addresses around the world, and genuine customers could not load the site.

(a) Identify the type of attack shown, justifying your answer with evidence from the graph and the information above. [2]

(b) The mean request rate during minutes 0–3 was 195 requests per second. Use the graph to calculate how many times greater the rate at minute 9 is than this mean. Give your answer to the nearest whole number. [1]

(c) Explain why adding a firewall rule to block one IP address would not stop this attack. [1]

(d) Describe one measure the shop could use to mitigate this type of attack. [1]

(e) The shop installs an intrusion prevention system (IPS) rather than an intrusion detection system (IDS). Distinguish between an IDS and an IPS. [2]

When a user visits https://www.examplebank.co.uk, the web server sends the browser its digital certificate.

Describe how the browser uses this certificate to check that it is communicating with the genuine website. [4]

A research group of 40 people needs every pair of members to be able to exchange messages that no other member can read.

(a) Using symmetric encryption, each pair of members needs its own shared secret key. Calculate the number of keys needed for the whole group. [2]

(b) Using asymmetric encryption instead, state the total number of keys needed for the whole group. [1]

(c) Explain the key-distribution problem with symmetric encryption and how asymmetric encryption overcomes it. [2]

(d) One member's private key is stolen. State one action that should be taken as part of key management. [1]