BTEC IT Unit 2 — Predicted Paper 2

Candidate surname

Other names

Centre NumberLearner Registration Number

Pearson Level 3 Alternative Academic Qualification BTEC National (Extended Certificate)

Predicted assessment material

Time 2 hours 15 minutes

Paper referenceTotal Marks 90

Information Technology

UNIT 2: Cyber Security and Incident Management

You do not need any other materials.

Instructions

Use black ink or ball-point pen.
Fill in the boxes at the top of this page with your name, centre number and learner registration number.
Answer all questions.
Answer the questions in the spaces provided — there may be more space than you need.

Information

The total mark for this paper is 90.
The marks for each question are shown in brackets — use this as a guide as to how much time to spend on each question.

Advice

Read each question carefully before you start to answer it.
Try to answer every question.
Check your answers if you have time at the end.

SECTION A

Read the scenario below carefully. Answer ALL questions.

Bluewater College

Bluewater College is a further education college with 2,400 students and 180 staff. It has three campuses connected by a Wide Area Network (WAN). Students and staff bring their own devices and connect to a campus Wi-Fi network.

An audit revealed the Wi-Fi uses WPA2, broadcasts its SSID, and has a weak default administrator password on the access points. The college web server, which hosts an online enrolment portal, has been the target of SQL injection and Distributed Denial of Service (DDoS) attacks.

The college stores personal data about applicants, including contact details and exam results. Following a data breach, the college is reviewing its data protection policy and appointing a Data Protection Officer. Staff use a password manager, and the college has a written password policy covering length and complexity.

Question 1

Threats, vulnerabilities and protection methods

1 (a) The college web server has been attacked by SQL injection and DDoS.

(i) Describe how an SQL injection attack works. (4)

(ii) Explain one method of preventing SQL injection. (3)

1 (b) The college has been subject to both DoS and DDoS attacks.

Describe the difference between a DoS and a DDoS attack. (4)

1 (c) Students and staff bring their own devices and connect to the campus Wi-Fi.

Explain two security risks of a Bring Your Own Device (BYOD) policy. (6)

1 (d) The college stores personal data about applicants under GDPR.

Explain two legal responsibilities the college has under the General Data Protection Regulation (GDPR). (6)

(Total for Question 1 = 23 marks)

Question 2

Networking architectures and principles for security

2 (a) The campus Wi-Fi uses WPA2 with a weak default administrator password on the access points.

Explain why default passwords should be changed on network devices. (4)

2 (b) The college is considering upgrading from WPA2 to WPA3.

Evaluate the use of WPA2 and WPA3 on the college's access points. (9)

2 (c) The three campuses are connected by a WAN, and each campus runs its own LAN.

Describe one security benefit of dividing the college network into separate sub-domains (segmentation). (4)

2 (d) The college uses a Dynamic Host Configuration Protocol (DHCP) server to allocate IP addresses.

(i) State two pieces of configuration information an administrator must enter on a DHCP server. (2)

(ii) Describe one method of attacking a network by exploiting DHCP. (4)

(Total for Question 2 = 23 marks)

Question 3

Cyber security documentation

3 (a) The college is writing a cyber security policy that uses the Plan-Do-Check-Act loop.

Explain how the Plan-Do-Check-Act loop supports ongoing security improvement. (6)

3 (b) The college encourages staff to use a password manager.

(i) Explain one advantage of using a password manager. (3)

(ii) Explain one disadvantage of using a password manager. (3)

3 (c) The college's data protection policy must ensure compliance with GDPR.

Explain the responsibilities of the Data Protection Officer and how the policy applies to external contractors. (6)

3 (d) The college is producing a backup policy after the data breach.

Explain why a backup policy must include a testing strategy and a clear storage strategy. (6)

(Total for Question 3 = 24 marks)

Question 4

Forensic procedures

4 (a) A staff member suspects their password manager has been compromised on a college tablet.

Explain why the IT manager should take a physical image of the tablet's entire drive rather than a targeted image of the password manager files. (4)

4 (b) Describe the process for creating a forensic image of the tablet's drive. (4)

4 (c) The physical image contains copies of the tablet's log files.

Explain which type of log file is likely to contain evidence about the possible compromise of the password manager. (4)

4 (d) The investigator must analyse the image while avoiding false positives.

Explain how an investigator ensures findings are relevant and not false positives. (4)

4 (e) The investigator writes a security report recommending improvements.

State the structure of the report and describe two categories of security improvement it should recommend. (4)

(Total for Question 4 = 20 marks)