Cyber security — GCSE Computer Science practice questions

Question 1

Priya is a member of an online chess club. The club's security log shows that, in one night, there were more than 20 000 failed attempts to log in to her account. Each attempt used a different password, and they were all made automatically by a program.

Which type of attack is this?

Accepted Answer

A: Brute-force attack. A brute-force attack uses trial and error: a program tries password after password on an account until the right one is found. A DDoS attack floods a server to stop it working, rather than trying to get into one account. Data interception captures data while it is being sent, and phishing tricks the user into giving the password away.

Question 2

Lukas uses a café's free, unsecured Wi-Fi to upload his homework to his school's website. Someone in the café is running a packet sniffer. The school's website encrypts all the data before it is sent.

What is the effect of the encryption?

Accepted Answer

A: The attacker can still capture the packets but cannot understand the data without the key. Encryption does not stop data being intercepted: a packet sniffer can still capture the packets. The data in them is scrambled, so it is meaningless to the attacker without the decryption key. Encryption does not change the route of the packets or remove anything from the network.

Question 3

A school's online homework portal gives students, teachers and parents different access levels. A student's password is stolen and an attacker logs in to the student's account.

How do the access levels limit the damage the attacker can do?

Accepted Answer

A: The attacker can only see and do what a student's account is allowed to, so they cannot change other students' marks. Access levels give each type of user permission to see or change only the data they need. A student account cannot change marks or see other students' work, so an attacker using it is limited in the same way. A code sent to a phone is two-step verification (part of logging in), encryption protects data that is stored or sent, and hiding a profile is a privacy setting.