Practise 34 exam-style questions on Cyber security threats for Cambridge IGCSE Computer Science (Paper 1). Write your answer as you would in the exam and get it marked in seconds against the mark scheme, point by point, with an AI tutor on hand if you get stuck.
34 questions
1–6 marks each
Instant marking
No sign-up needed
20 questions, marked as you go
Sample questions with model answers
Here are 4 of the questions in this topic, each with a model answer, an explanation of why it earns the marks and the mark scheme an examiner would use.
Question 1
1 mark
State what is meant by hacking.
Model answer
Hacking is gaining unauthorised access to a computer system without the owner's permission.
Explanation
The key idea is access without permission. What the hacker then does - stealing, changing or deleting data - is the aim of the hack, not the definition.
Mark scheme
1 mark
Gaining unauthorised/illegal access to a computer system/network/data (without the owner's permission)
the idea of unauthorised access is required; do not accept 'breaking into a computer' without the idea of no permission; do not accept 'spreading a virus'
Question 2
2 marks
Explain the difference between ethical hacking and malicious hacking.
Model answer
Ethical hacking is done with the organisation's permission to find weaknesses in its security so that they can be fixed. Malicious hacking is unauthorised access that aims to steal, change or damage data.
Explanation
Both involve breaking into a system; the difference is permission and purpose. Ethical hackers are hired to test security, whereas malicious hackers break the law to cause harm or make money.
Mark scheme
1 mark
Ethical hacking is authorised by the organisation/owner to find weaknesses in its security so that they can be fixed
1 mark
Malicious hacking is unauthorised/illegal access, aiming to steal, change, delete or damage data/systems
Question 3
3 marks
The diagram shows how a cybercriminal carries out a pharming attack by altering the data stored on a DNS server.
Describe the process shown in the diagram and explain the aim of the attack.
Model answer
The criminal has changed the IP address stored on the DNS server for the bank's domain name, so it points to the fake website. When the user types the bank's correct URL, the DNS server returns the fake website's IP address, so the browser goes to the fake site without the user knowing. The user then enters their login details, believing it is the real bank. The aim is to steal these details and use them to take money from the user's account.
Explanation
Pharming can work by altering a DNS server (or by malicious code on the user's computer). The user does nothing wrong - they type the correct URL - which is what makes pharming so dangerous compared with phishing.
Mark scheme
1 mark
The criminal changes the IP address stored for the bank's domain name on the DNS server (to the IP address of the fake website)
max 3; accept 'DNS cache poisoning'
1 mark
When the user enters the bank's correct URL/domain name, the DNS returns the fake website's IP address, so the browser is redirected to the fake website without the user knowing
1 mark
The fake website looks like the real one, so the user enters their login/bank details, which are captured
1 mark
Aim: to obtain personal/banking data to steal money / commit fraud or identity theft
Question 4
4 marks
Describe the stages of a typical social engineering attack.
Model answer
First, the criminal researches a target and decides how to attack. Next, they contact the victim, for example by phone, pretending to be someone trusted such as the company's IT support. They gain the victim's trust or create a sense of urgency so that the victim breaks normal security procedures, for example by revealing a password. Finally, the criminal uses the information to steal data or money and then ends contact, removing any traces.
Explanation
Social engineering follows a pattern: research, contact (often impersonating someone trusted), manipulation of emotions, the victim breaking the rules, then exploitation and exit. The attack is on the person, not the computer.
Mark scheme
1 mark
The criminal researches/chooses a target (person or organisation) and plans the method of attack
max 4; stages in a logical order
1 mark
The criminal makes contact with the victim, e.g. phone call, email, instant message, in person, pretending to be someone trusted (e.g. a bank, IT support)
1 mark
The criminal gains the victim's trust / uses emotions such as fear, urgency or curiosity to manipulate them
1 mark
The victim is persuaded to break normal security procedures, e.g. reveal a password, click a link, install software, let the criminal into a building
1 mark
The criminal uses the information/access, e.g. steals data or money, installs malware
1 mark
The criminal ends contact and removes traces of the attack
Ready to try the rest? Every answer you write is marked against the mark scheme, so you can see exactly where the marks are.
Ctrl + Enter to check
AI TutorHints first, answers after you try
Hi! Stuck? Ask me for a hint and I’ll help you work it out. Once you’ve checked your answer I can explain exactly where the marks are.
