Mark Scheme — Predicted Paper 3

1(a) Why unseparated guest Wi-Fi is a risk. (4 marks)

• Guest devices share the network with internal systems (1)
• guests could access/scan internal servers holding patient records (1)
• malware on a guest device could spread to internal systems (1)
• confidential patient data could be exposed or stolen (1)

1(b) How a USB security key works. (4 marks)

• The USB key contains a cryptographic code/certificate (1)
• when plugged in, the system reads/checks the code (1)
• to verify the identity of the user (1)
• providing a second “possession” factor alongside the password (1)

1(c)(i) Device-based security for a lost/stolen tablet. (4 marks)

• Remote wipe/lock — erase data remotely when reported lost (2)
• Full-disk encryption — data unreadable without the key (2)
• Timed lockout/screen lock — prevents access without credentials (2)
• plus linked expansion of how it protects the data (2)

1(c)(ii) Technology to locate a lost device. (1 mark)

• GPS / Global Positioning System (or “phone home”/device tracking software) (1)

1(d) Impact of a data breach under GDPR. (9 marks)

2(a) How to change the network to reduce risk. (6 marks)

• Use a second switch or VLANs to segment the network (1)
• place guest Wi-Fi on a separate segment (1)
• so guest traffic only reaches the internet (1)
• and cannot reach internal servers/staff systems (1)
• apply access controls/firewall rules between segments (1)
• reducing the attack surface for patient data (1)

2(b)(i) One vulnerability of a WAP. (2 marks)

• Wi-Fi radio signals can pass outside the building (1)
• so the network can be accessed from public areas (1)

Accept: default credentials, Evil Twin attack, wireless sniffing.

2(b)(ii) One way to secure a WLAN. (4 marks)

• Use WPA2/WPA3 encryption (1)
• so data transmitted over Wi-Fi is encrypted (1)
• change default passwords/SSID (1)
• use MAC filtering/block and allow lists (1)

2(c) Evaluate MAC address filtering. (9 marks)

2(d) VPN function and drawback. (4 marks)

• Establishes an encrypted tunnel over the internet (1)
• protects data in transit from interception (1)
• reduces risk of man-in-the-middle attack (1)
• Drawback: cost of running the server, or slower speed (1)

3(a) Two rules in an internet/email use policy. (2 marks)

• No inappropriate/offensive/illegal material (1)
• No downloading of executable files / no visiting dangerous websites (1)

Accept: no sending confidential information without authorisation, no upload of copyrighted material.

3(b) Staff responsibilities and training. (6 marks)

• Complete required security training (1)
• follow security procedures and report problems (1)
• respond to/report suspicious activity (1)
• maintain security in own workspace/behaviour (1)
• Training: flexible, range of resources/learning styles (1)
• ongoing for reinforcement and new threats, with progress tracking (1)

3(c) Procedures in an incident response policy. (6 marks)

• Procedures for initial decisions/triage/escalation (2)
• main response: analysis, containment, mitigation, recovery (2)
• reviewing, reporting and closing the incident (2)

3(d) Disaster recovery purpose and triage plans. (6 marks)

• Purpose: define how to recover IT/operations after a major incident (2)
• Triage activates: cyber security incident response plan (1)
• business continuity plan (1)
• disaster recovery plan (1)
• plus linked expansion (1)

4(a) Isolating a device to preserve evidence. (4 marks)

• Isolate from network/communications (1)
• disable wireless / use airplane mode (1)
• use a Faraday bag/cage to block signals (1)
• retain current power state and photograph the screen (1)

4(b) Two challenges of live forensics. (4 marks)

• Data is changing in situ, so evidence may be lost (2)
• capturing data in active memory/RAM before power loss (2)

Accept: recovering corrupted data, capturing remote data, not losing temporary files.

4(c) Infrastructure reviewed during network forensics. (6 marks)

• Firewalls and infrastructure devices (1)
• switch (1), router (1), wireless access point (1)
• client/server logs (1)
• malware activity and alerts (1)

4(d) Two requirements for recording findings. (4 marks)

• No action that could change data on the device (2)
• Creation of a trail/record of all actions (chain of custody) (2)
• Documentation of who is responsible for collection/decisions (2)

4(e) How the report prevents recurrence and improvements. (5 marks)

• Report analyses the incident to identify errors/omissions in procedures (1)
• identifies errors in preventative measures and delays in detection (1)
• recommends remedial actions to prevent recurrence (1)
• Improvements: IT policies (1) and security protection measures (physical, software, hardware, processes, training) (1)