OxfordAQA IGCSE Computer Science: Cyber Security — Practice Questions (9210)

These are original questions written for Marlbridge, for revision and practice on this content. They are not reproduced past-paper questions, and they do not replicate the exam’s exact structure, question count or mark tariffs — examination boards hold copyright in their own papers. Use these alongside the official past papers available free from your board.

Related: Cyber security study guide | Cyber security revision notes

These questions cover section 3.6 of the OxfordAQA International GCSE Computer Science (9210) specification, which is assessed on Paper 2.

---

Section A: definitions

1. Define the term cyber security. [2]

2. Define social engineering and malware. [2]

Section B: threats

3. For each threat, explain why it puts a system at risk: (a) weak and default passwords (b) misconfigured access rights (c) removable media (d) unpatched software. [4]

4. Identify the form of social engineering in each case and suggest one way to protect against it: (a) A caller claiming to be from the IT department asks an employee for their password to “fix an urgent fault”. [2] (b) A customer types the correct address of their bank’s website but is taken to a fake copy of the site. [2] (c) Someone in a queue watches a shopper enter a PIN at a card machine. [2] (d) A text message says a parcel could not be delivered and asks the recipient to enter card details at a link. [2]

5. Describe the difference between a computer virus and a trojan. [2]

6. Describe what spyware and adware do. [2]

7. Give three ways a user can protect a computer against malware. [3]

Section C: penetration testing

8. (a) Explain what penetration testing is and why an organisation would pay for it. [2] (b) Describe the two types of penetration testing and the kind of attack each simulates. [4]

Section D: detection and prevention

9. Explain why biometric measures are particularly suitable for mobile devices. [2]

10. Describe three features of a password system that improve security. [3]

11. A website asks new users to complete a CAPTCHA and then click a link in a confirmation email. (a) Explain the purpose of the CAPTCHA. [2] (b) Explain the purpose of the confirmation email. [2]

12. Explain how automatic software updates reduce the risk of a cyber attack. [2]

13. A small accounts firm stores clients’ financial records on a network. Staff often use USB sticks to take work home, several staff share one login, and the computers have not been updated for a year. Identify three threats in this scenario and recommend a measure to reduce each. [6]

---

Answers

1. The processes, practices and technologies [1] designed to protect networks, computers, programs and data from attack, damage or unauthorised access [1].

2. Social engineering: the art of manipulating people so they give up confidential information [1]. Malware: an umbrella term for a variety of forms of hostile or intrusive software [1].

3. (a) They can be guessed easily or found in lists of factory settings, letting an attacker log in [1]. (b) Users may be able to see, change or delete data that they should not have access to [1]. (c) A USB stick can bring malware into the system, or allow data to be copied and lost or stolen [1]. (d) Known vulnerabilities have not been fixed, so attackers can exploit them [1].

4. (a) Blagging (pretexting) [1]; staff training never to reveal passwords and to verify callers by ringing back on a known number [1]. (b) Pharming [1]; check the site uses HTTPS and the address is correct, and keep security software up to date [1]. (c) Shouldering (shoulder surfing) [1]; shield the keypad with a hand when entering a PIN [1]. (d) Phishing [1]; do not follow links in unexpected messages – contact the delivery company directly using its official website [1].

5. A virus attaches itself to files or programs and copies itself to other files when it is run [1]; a trojan disguises itself as legitimate software, so the user installs it themselves [1].

6. Spyware secretly monitors the user’s activity, such as keystrokes, and sends the information to a third party [1]. Adware displays unwanted advertisements, sometimes based on tracking the user’s browsing [1].

7. Any three: install anti-malware software and keep it up to date; turn on automatic updates; only download software from trusted sources; do not open unexpected email attachments; scan removable media before use [3].

8. (a) Penetration testing is an authorised attempt to gain access to resources without knowing usernames, passwords or other normal means of access [1], to find weaknesses so they can be fixed before a real attacker exploits them [1]. (b) Internal test: the tester has knowledge of, and possibly basic credentials for, the target system [1], simulating an attack by a malicious insider [1]. External test: the tester has no knowledge of any credentials [1], simulating an attack from outside the organisation [1].

9. Mobile devices are easily lost or stolen, and a fingerprint or face scan is unique to the owner and hard to copy [1]; it is also quick and convenient, so users are more likely to keep the device locked [1].

10. Any three: minimum password length; a mix of upper case, lower case, digits and symbols; regular changes and no reuse of old passwords; locking the account after several failed attempts [3].

11. (a) A CAPTCHA is easy for a human but hard for an automated program to solve [1], so it stops bots creating large numbers of fake accounts or guessing passwords automatically [1]. (b) It confirms the user’s identity by proving they control the email address given [1], so accounts cannot be created with someone else’s address [1].

12. Updates often include patches that fix known security vulnerabilities [1]; installing them automatically means the holes are closed as soon as possible, before attackers can exploit them [1].

13. Any three threats, each with a matching measure [2 each]:

• Removable media: USB sticks could carry malware in or lose client data -> ban personal USB sticks, use encrypted approved devices, or scan media automatically.
• Shared login (misconfigured access rights / weak password practice): no individual accountability, and everyone can access all records -> give each person their own account and strong password, with access only to the files they need.
• Unpatched/outdated software: known vulnerabilities remain open -> turn on automatic software updates.

---

Where marks are usually lost

• Naming a threat correctly but giving a protection that does not match it.
• Defining phishing as “a fake website” – that is closer to pharming; phishing uses fraudulent messages.
• Describing penetration testing without saying it is done without the normal means of access.
• Using vague terms such as “hacking” instead of the specification’s named threats.

Frequently asked questions

Do I need to know about ransomware or worms for 9210? The specification lists computer virus, trojan, spyware and adware as the forms of malware to describe. Learn those four precisely.

How should I answer a scenario question on threats? Quote the detail from the scenario that shows the threat, name it using the specification’s term, and give a protection that directly addresses it.