IGCSE ICT: Safety and Security — Practice Questions

These questions cover all of Cambridge IGCSE ICT 0417 Topic 8: physical safety (8.1), eSafety and data protection (8.2), and threats to data and methods of protecting it (8.3). They are written for Paper 1 Theory, where each answer must be linked to the context in the question.

These are original questions written for Marlbridge, for revision and practice on this content. They are not reproduced past-paper questions, and they do not replicate the exam’s exact structure, question count or mark tariffs — Cambridge International holds copyright in its own papers. Use these alongside the official past papers available through your school or Cambridge directly.

Related: Safety and Security revision notes · Safety and security study guide

---

Section A: short answers

1. State two causes of fire in a computer room. [2]

2. Give one example of personal data and one example of sensitive data. [2]

3. State what is meant by vishing. [1]

4. Name the protection method that uses a person’s fingerprint to identify them. [1]

---

Section B: structured questions

5. A school has just opened a new computer room with 30 computers.

(a) Identify two safety hazards in the room. For each, give its cause and a method of preventing it. [4] (b) Explain why drinks should not be allowed in the room. [2]

6. A hospital stores patients’ medical histories.

(a) State three principles of a typical data protection act. [3] (b) Explain why it is important that patients’ medical histories are kept confidential. [2]

7. A 13-year-old student uses social media and plays online games.

(a) Give three ways the student can use social media safely. [3] (b) Give two ways the student can stay safe when gaming online. [2] (c) The student receives an email from an unknown person asking for a photograph. Explain why the student should not reply. [2]

8. A bank customer receives a text message: “Your account has been suspended. Click here to confirm your details.”

(a) Name this type of threat. [1] (b) Describe how pharming differs from this threat. [2] (c) Give two actions the customer should take. [2]

9. Describe three types of card fraud. [3]

---

Section C: extended questions

10. An online shop wants customers to trust that its website is genuine and that their payment details are safe. Explain how a digital certificate and SSL help. [4]

11. A company’s computers are connected to the internet. Describe how a firewall, encryption and two-factor authentication each help protect the company’s data. [6]

12. A user downloads a free game from an unknown website. Explain the risk and describe two preventative actions. [4]

---

Worked answers

1. Any two of: sockets overloaded with too many plugs; equipment overheating; blocked ventilation; faulty or damaged wiring. [2]

2. Personal: any of name, address, date of birth, photograph in school uniform (1). Sensitive: medical history (1). [2]

3. Phishing carried out by telephone or voicemail, to trick a person into giving personal details. [1]

4. Biometrics. [1]

5. (a) Two of the following, with 1 mark for hazard plus cause and 1 for a matching prevention:

• Tripping over trailing cables → use cable ducts or covers / run cables along walls / use wireless networking.
• Fire from overloaded sockets → use enough sockets, no daisy-chained extension leads; have a CO2 extinguisher.
• Fire from overheating → keep vents clear; use fans or air conditioning.
• Heavy equipment falling → use strong desks; keep equipment away from edges.
• Electrocution from bare cables → check cables regularly and replace damaged ones. [4] (b) A spilled drink could reach the electrical parts (1) and cause electrocution or a short circuit that damages equipment or starts a fire (1). [2]

6. (a) Any three of: processed fairly and lawfully; used only for the purpose collected; adequate, relevant and not excessive; accurate and up to date; not kept longer than necessary; processed in line with the data subject’s rights; kept secure; not transferred to countries without adequate protection. [3] (b) Medical history is sensitive data (1); if disclosed it could lead to discrimination, embarrassment or misuse, for example by employers or insurers, so patients would lose trust in the hospital (1). [2]

7. (a) Any three of: block and report unwanted users; do not meet an online contact face to face; do not post or send inappropriate images; do not use inappropriate language; respect other people’s personal data; keep personal details private. [3] (b) Do not use a real name (1); do not give out personal or financial details (1). [2] (c) The person is unknown and could be pretending to be someone else (1); sending personal images could allow the student to be identified, located or exploited, and the image cannot be recalled once sent (1). [2]

8. (a) Smishing. [1] (b) In pharming, malicious code on the user’s computer or a server redirects the user to a fake website (1) even when the correct web address is typed, so the user does not have to click a link (1). [2] (c) Any two of: do not click the link; do not reply; contact the bank using its official number or website; delete or report the message. [2]

9. Shoulder surfing: watching someone enter their PIN or password, directly or with a camera (1). Card cloning: copying the data on a card’s magnetic stripe using a skimmer to make a duplicate card (1). Key logging: software that records keystrokes so card numbers and passwords can be stolen (1). [3]

10. A digital certificate is issued by a certificate authority and proves the website belongs to the shop (1); it contains details such as the owner’s name, serial number, expiry date and public key, which the browser checks (1). SSL creates an encrypted link between the customer’s computer and the shop’s server (1), so payment details intercepted in transit cannot be read; the customer sees https and a padlock (1). [4]

11. Two marks per method:

• Firewall: monitors traffic between the network and the internet (1) and blocks traffic that does not meet set rules, preventing unauthorised access / hacking (1).
• Encryption: scrambles data using a key so it is meaningless (1); if data is stolen or intercepted it cannot be understood without the decryption key (1).
• Two-factor authentication: requires two different proofs, such as a password and a code sent to a phone (1), so a hacker with a stolen password still cannot log in (1). [6]

12. The file may contain a virus or other malware (1) that could delete or corrupt files, slow the computer or steal data (1). Prevention, any two: scan the file with up-to-date anti-virus/anti-malware software before opening; only download from trusted websites; do not run files from unknown sources (1 + 1). [4]

Frequently asked questions

How do I score full marks on a hazard question? Name the hazard, give its cause and give a prevention that matches it. A prevention that does not deal with the stated cause usually earns no mark.

Is a virus the same as malware? A virus is one type of malware. Malware is the general term for any malicious software.

Can I answer “anti-virus” for phishing? No. Phishing tricks the user rather than infecting the computer, so the answer is about not clicking links and checking the sender and URL.

Official syllabus

Cambridge International, Cambridge IGCSE Information and Communication Technology (0417) syllabus for 2026, 2027 and 2028, Version 3, Topic 8 “Safety and security” (8.1 Physical safety, 8.2 eSafety, 8.3 Security of data).