Mark Scheme — Predicted Paper 2

1(a)(i) Describe how an SQL injection attack works. (4 marks)

• Attacker enters a malicious SQL query into an input field (1)
• the query is passed to the back-end database (1)
• it is executed as a database instruction (1)
• to reveal/alter/delete data or bypass authentication (1)

1(a)(ii) Explain one method of preventing SQL injection. (3 marks)

• Use parameterised queries/prepared statements (1)
• so user input is treated as data, not executable code (1)
• preventing rogue SQL statements from running (1)

Accept: input validation/sanitisation, web application firewall.

1(b) Difference between DoS and DDoS. (4 marks)

• DoS comes from a single device/source/IP address (1)
• DDoS comes from multiple devices/sources (often a botnet) (1)
• DDoS is harder to block because traffic comes from many sources (1)
• both aim to overwhelm the target so legitimate users are denied service (1)

1(c) Explain two security risks of BYOD. (6 marks)

• Personal devices may not be patched/updated → vulnerabilities (2)
• Organisational data on a private device may be exposed if lost/stolen (2)
• Harder to enforce password policy and data security on private devices (2)

1(d) Two GDPR responsibilities. (6 marks)

• Process data lawfully, fairly and transparently (2)
• Keep data accurate and up to date, only for the stated purpose (2)
• Maintain confidentiality/integrity of data — appropriate security (2)
• Respect data subjects' rights (access, correction, erasure, objection) (2)

2(a) Why default passwords should be changed. (4 marks)

• Default passwords are publicly known/documented (1)
• so an attacker can gain admin access easily (1)
• changing them prevents unauthorised configuration changes (1)
• reduces the risk of device compromise (1)

2(b) Evaluate WPA2 vs WPA3. (9 marks)

2(c) Benefit of network segmentation. (4 marks)

• Limits access to devices, data and applications (1)
• restricts lateral movement of an attack/malware (1)
• smaller attack surface (1)
• simpler damage control/containment (1)

2(d)(i) Two DHCP configuration items. (2 marks)

• Range of available IP addresses (1)
• Lease length / fixed (reserved) IP addresses (1)

2(d)(ii) One method of attacking via DHCP. (4 marks)

• Spoofing/using a rogue DHCP server (1)
• to supply clients with fake configuration information (1)
• enabling a man-in-the-middle attack (1)
• or to disrupt/prevent network traffic (1)

Accept: DHCP starvation — rogue client makes repeated requests to exhaust the address pool.

3(a) How Plan-Do-Check-Act supports improvement. (6 marks)

• Plan: establish objectives and plan security measures (1)
• Do: implement the plan (1)
• Check: monitor/audit and evaluate results against the plan (1)
• Act: take corrective action to improve (1)
• continuous cycle so security is reviewed and improved over time (1)
• derived from ISO 27001 (1)

3(b)(i) One advantage of a password manager. (3 marks)

• Stores all passwords securely (1)
• allows use of long, unique random passwords for each account (1)
• reduces password reuse / only one master password to remember (1)

3(b)(ii) One disadvantage of a password manager. (3 marks)

• Single point of failure — if the master password is compromised all accounts are at risk (1)
• dependency on the provider's security (1)
• loss of access if the vault is corrupted or the provider is unavailable (1)

3(c) DPO responsibilities and external contractors. (6 marks)

• DPO monitors compliance with data protection principles (1)
• advises on obligations and staff training (1)
• acts as contact for the regulator and data subjects (1)
• policy applied to external contractors/consultants/vendors (1)
• who must also comply with data protection requirements (1)
• responsibility and accountability rest with the organisation (1)

3(d) Backup policy testing and storage strategy. (6 marks)

• Testing strategy verifies backups can actually be restored (2)
• so the organisation knows recovery works before it is needed (1)
• Storage strategy determines where backups are kept (onsite/offsite/cloud) (2)
• off-site/cloud protects against fire, theft and ransomware at the primary site (1)

4(a) Why a physical image rather than a targeted image. (4 marks)

• A physical image captures the entire drive (1)
• including deleted/temporary/unallocated data (1)
• a targeted image may miss relevant evidence elsewhere on the drive (1)
• the full image preserves all potential evidence of the compromise (1)

4(b) Process for creating a forensic image. (4 marks)

• Use a write-blocker to prevent changes to the original (1)
• connect the tablet drive to a forensic workstation (1)
• use a forensic imaging tool to create a bit-for-bit copy (1)
• generate and record a hash to verify integrity (1)

4(c) Which log file contains evidence. (4 marks)

• Application/event logs (1)
• record application launches, logins and errors (1)
• would show unusual access/authentication to the password manager (1)
• or system/security logs showing unauthorised login attempts (1)

4(d) Avoiding false positives. (4 marks)

• Define file signatures and search criteria precisely (1)
• be aware of known/estimated error rates of tools (1)
• manually review all positives to filter obvious false ones (1)
• investigate/check filtered positives further (1)

4(e) Report structure and improvements. (4 marks)

• Structure: title, contents, introduction, headings/sub-headings, conclusions (2)
• Improvements: IT policies and security protection measures (physical, software, hardware, processes, training) (2)