Mark Scheme — Predicted Paper 1

1(a)(i) State what is meant by phishing. (2 marks)

Award marks for a definition with linked expansion:

• Fraudulent/emails that appear to come from a trusted source (1)
• intended to trick the recipient into revealing personal information or opening a malicious link/attachment (1)

1(a)(ii) Explain one difference between phishing and spear phishing. (3 marks)

• Phishing is mass/generic, sent to many people (1)
• Spear phishing is targeted at a specific individual using personal research about them (1)
• link to increased chance of success / harder to detect (1)

1(b)(i) Identify the type of malware. (1 mark)

• Ransomware (1)

1(b)(ii) Explain one countermeasure to reduce spread. (3 marks)

• Staff training/phishing awareness (1)
• so staff recognise and do not open suspicious attachments (1)
• reducing the chance of infection at source (1)

Accept: email filtering, antivirus/antimalware, network segmentation, backups.

1(c) Describe one security risk of BYOD. (4 marks)

• Personal devices may not be patched/updated (1)
• so they carry known vulnerabilities (1)
• organisational data stored on a private device may be exposed if the device is lost/stolen (1)
• and it is harder for the organisation to enforce its own security policy (1)

1(d) Evaluate the effectiveness of the backup strategy. (9 marks)

2(a) Explain the risk of a shared switch and the change needed. (6 marks)

• Guest traffic shares hardware with the internal network (1)
• guests could access/scan internal devices (1)
• malware on guest devices could spread to internal systems (1)
• use a second switch / VLANs to segment the network (1)
• so guest traffic only reaches the internet (1)
• and cannot reach internal servers/staff systems (1)

2(b)(i) State the purpose of an SSID. (1 mark)

• To identify/name the wireless network (1)

2(b)(ii) Explain one consequence for guests if the SSID is hidden. (3 marks)

• Guests cannot see the network listed on their device (1)
• so they must ask staff for the network details (1)
• which is inconvenient / slows the connection process (1)

2(c) Evaluate the use of MAC address filtering. (9 marks)

2(d) Describe how the VPN functions and one drawback. (4 marks)

• Establishes an encrypted/protected connection over the internet (1)
• data is encrypted so it cannot be read if intercepted (1)
• reduces risk of man-in-the-middle attack (1)
• Drawback: cost of running the server, or slower speed, or higher data usage (1)

3(a) State the four stages of Plan-Do-Check-Act. (2 marks)

• Plan, Do, Check, Act — award ½ per stage, any two correct stages for 1 mark (2 marks for all four)

3(b) Give two other sections of a password policy. (2 marks)

• Frequency of password reuse / minimum password age (1)
• Prevent password sharing / disallow personal names and birthdays (1)

Accept: lockout policy, deny lists of common passwords.

3(c) Role of DPO and importance of data protection policy. (6 marks)

• DPO monitors compliance with GDPR/data protection principles (1)
• advises on data protection obligations and staff training (1)
• acts as contact point for the regulator and data subjects (1)
• policy protects rights/privacy of data subjects (1)
• ensures system security procedures are followed (1)
• applies to external contractors/vendors who handle data (1)

3(d) Three contacts in an incident response policy. (6 marks)

• Incident response team leader/provider — coordinates the response (2)
• Senior management — authorises decisions and resources (2)
• Legal / public relations / HR / insurance — manages legal, reputational and staff implications (2)

3(e) Purpose of disaster recovery policy and three triage plans. (6 marks)

• Purpose: defines how the organisation recovers IT/operations after a major incident (2)
• Triage activates: cyber security incident response plan (1)
• business continuity plan (1)
• disaster recovery plan (1)
• plus linked expansion of purpose (1)

4(a) Two actions to preserve a seized device. (2 marks)

• Isolate from network/communications (1)
• Retain current power state / photograph the screen (1)

Accept: use Faraday bag, document chain of custody, appropriate packaging.

4(b) Importance of chain of custody. (5 marks)

• Records who has handled the evidence at every stage (1)
• proves the evidence has not been altered/tampered with (1)
• so evidence remains admissible in legal proceedings (1)
• documents responsibility for collection/decisions (1)
• creates an unbroken trail from seizure to court (1)

4(c) Why a hash is generated for a forensic copy. (4 marks)

• A hash/checksum is a unique digital fingerprint of the data (1)
• comparing hashes verifies the copy is identical to the original (1)
• any change to the data produces a different hash (1)
• so integrity of the evidence can be proven (1)

4(d) Three indicators of compromise. (8 marks)

• Unusual inbound/outbound traffic or traffic from unusual geographical regions (2)
• Unusual login attempts / unusual DNS requests (2)
• Increase in file/data reads or requests / unusual port usage (2)
• Suspicious changes to files or system data (2)

4(e) Report structure and improvements. (4 marks)

• Structure: title, contents, introduction, headings/sub-headings, conclusions (2)
• Improvements: improvements to IT policies; improvements to security protection measures (physical, software, hardware, processes, training) (2)