IGCSE · Practice questions · Cyber security threats

Process, then aim.

Six original Cambridge-style questions on cyber security threats, with mark-scheme style solutions.

Original questions All questions on this page are original work, written in the Cambridge IGCSE style. They are not from past papers. They test the same concepts and skills the syllabus rewards.

Keep these straight

How, and why.

Process: describe how the attack is carried out, step by step.
Aim: say what the attacker wants: data, access, money or disruption.
Malware: virus, worm, Trojan horse, spyware, adware, ransomware: know the difference.
Phishing vs pharming: a link in a message, versus redirection by malicious code.

Explain

[3 marks]

Describe the process and the aim of a distributed denial of service (DDoS) attack.

Many computers are infected with malware to form a botnet. ✓
They are all made to send large numbers of requests to a web server at the same time, so it is overloaded. ✓
Aim: the server cannot respond to genuine users, so the website / service is unavailable. ✓

Explain

[4 marks]

Explain the difference between phishing and pharming.

Phishing: the user is sent an email / message that appears to come from a trusted source. ✓
It contains a link to a fake website where the user enters personal details. ✓
Pharming: malicious code is installed on the user's computer or a DNS server. ✓
It redirects the user to a fake website even when they type the correct URL (no link has to be clicked). ✓

Recall

[3 marks]

Describe what is meant by ransomware.

Malware that encrypts the user's files / locks the computer. ✓
So the user cannot access their data. ✓
The attacker demands payment in return for the decryption key. ✓

Explain

[2 marks]

Explain how a worm differs from a virus.

A virus attaches to a host file / program and needs that file to be run (user action) to replicate. ✓
A worm is a standalone program that replicates and spreads across a network by itself, without user action. ✓

Calculate

[2 marks]

A PIN is made of 4 digits, each 0 to 9. A brute-force program tries 50 PINs per second. Calculate the maximum time needed to try every PIN.

There are 10⁴ = 10 000 possible PINs. ✓
10 000 ÷ 50 = 200 seconds (3 minutes 20 seconds). ✓

Apply

[3 marks]

An employee receives a phone call from someone claiming to be from the company's IT department, who asks for the employee's password to fix a problem. Identify the threat and describe its process and aim.

Social engineering. ✓
Process: the attacker manipulates / deceives a person by pretending to be someone trusted, so the person breaks security procedures. ✓
Aim: to obtain confidential information (the password) and gain unauthorised access to the system. ✓

Mark this once you have attempted all six and checked your working. It records a Practiced badge on the topic and adds a one-time bonus. Revealing the solutions alone does not count.