Pearson Level 3 Alternative Academic Qualification BTEC National (Extended Certificate)
Predicted assessment material
Time 2 hours 15 minutes
Information Technology
UNIT 2: Cyber Security and Incident Management
You do not need any other materials.
Instructions
Information
Advice
Read the scenario below carefully. Answer ALL questions.
Greenfield Logistics Ltd is a UK distribution company with 14 warehouses and a central head office. It recently adopted a hybrid working policy: office staff connect from home using personal laptops, while warehouse staff use handheld scanners connected over Wi-Fi.
The network has been flagged with several weaknesses after a recent audit. Staff connect personal mobile devices to a guest Wi-Fi network that shares a single switch with the main office network. The guest network has no MAC address filtering and broadcasts a default SSID. Remote workers connect over a VPN run from a Greenfield server.
Last month a warehouse computer was infected after an employee opened a phishing email and downloaded an attachment. The malware encrypted several shared folders and a ransom demanded payment in cryptocurrency. Greenfield's backup strategy currently relies on a single USB drive rotated daily and RAID 1 on the file server.
Threats, vulnerabilities and protection methods
1 (a) Greenfield was attacked after an employee opened a phishing email.
(i) State what is meant by phishing. (2)
(ii) Explain one difference between phishing and spear phishing. (3)
1 (b) The malware that infected the warehouse computer encrypted shared folders and demanded a ransom.
(i) Identify the type of malware described. (1)
(ii) Explain one countermeasure that would reduce the risk of this malware spreading. (3)
1 (c) Remote workers use personal laptops to connect over a VPN.
Describe one security risk of allowing staff to use personal devices for work (BYOD). (4)
1 (d) Greenfield's backup strategy uses a single daily USB drive and RAID 1 on the file server.
Evaluate the effectiveness of Greenfield's current backup strategy. (9)
(Total for Question 1 = 22 marks)
Networking architectures and principles for security
2 (a) The guest Wi-Fi shares a single switch with the main office network.
Explain how this is a security risk and how the network should be changed to reduce it. (6)
2 (b) The guest Wi-Fi broadcasts a default SSID and has no MAC address filtering.
(i) State the purpose of an SSID. (1)
(ii) Explain one consequence for guests if the SSID is hidden. (3)
2 (c) Greenfield is considering using MAC address filtering on the guest and staff Wi-Fi.
Evaluate the use of MAC address filtering on Greenfield's Wi-Fi. (9)
2 (d) Greenfield's remote workers connect using a VPN run from a Greenfield server.
Describe how this VPN functions and state one drawback of using it. (4)
(Total for Question 2 = 23 marks)
Cyber security documentation
3 (a) Following the ransomware incident, Greenfield is reviewing its internal IT security policies.
State the four stages of the Plan-Do-Check-Act loop used in a cyber security policy. (2)
3 (b) Greenfield's staff password policy currently only specifies length and complexity.
Give two other sections that a password policy should contain. (2)
3 (c) Explain the role of a Data Protection Officer and why a data protection policy is important to Greenfield. (6)
3 (d) Greenfield is producing a cyber security incident response policy.
Describe three contacts that should be listed in the policy and explain why each is needed. (6)
3 (e) Explain the purpose of a disaster recovery policy and state the three plans its triage process may activate. (6)
(Total for Question 3 = 22 marks)
Forensic procedures
4 (a) Following the ransomware attack, a forensic investigator seizes the infected warehouse computer.
State two actions the investigator should take to preserve the device for forensic analysis. (2)
4 (b) Explain the importance of documenting the chain of custody when collecting forensic evidence. (5)
4 (c) The investigator creates a forensic image of the computer's drive and generates a hash of the image.
Explain why a hash (checksum) is generated for a forensic copy. (4)
4 (d) The investigator must assess network logs for evidence that the system was compromised externally.
Describe three indicators of compromise the investigator may look for. (8)
4 (e) The investigator writes a security report for Greenfield's management.
Explain the structure of the report and state two categories of improvement it should recommend. (4)
(Total for Question 4 = 23 marks)
TOTAL FOR SECTION A = 90 MARKS