Pearson Level 3 Alternative Academic Qualification BTEC National (Extended Certificate)
Predicted assessment material
Time 2 hours 15 minutes
Information Technology
UNIT 2: Cyber Security and Incident Management
You do not need any other materials.
Instructions
Information
Advice
Read the scenario below carefully. Answer ALL questions.
Atlas Health Centre is a GP practice with 12 consulting rooms, a server room and a public reception area. It holds sensitive patient records under GDPR. Staff use desktop PCs in consulting rooms and tablets when visiting patients at home.
The practice's network has a single managed switch connecting staff PCs, tablets, and a guest Wi-Fi used by patients in the waiting room. The guest network is not separated from the internal network. Staff authenticate with a username and password, and use a USB security key for multi-factor authentication (MFA) when accessing patient records.
A tablet was recently stolen from a staff member's car. The tablet contained cached patient records. The practice is reviewing its device-based security, its backup strategy, and its cyber security incident response and disaster recovery policies.
Threats, vulnerabilities and protection methods
1 (a) The waiting room guest Wi-Fi is not separated from the internal network.
Explain why this is a security risk to patient data. (4)
1 (b) Staff use a USB security key for MFA when accessing patient records.
Explain how a USB security key works as a second factor. (4)
1 (c) A tablet containing cached patient records was stolen from a staff member's car.
(i) Explain one device-based security measure that would protect data on a lost or stolen tablet. (4)
(ii) State the term for the technology that can locate a lost or stolen device. (1)
1 (d) Atlas Health Centre holds sensitive patient records.
Explain the impact a data breach could have on the practice under GDPR. (9)
(Total for Question 1 = 22 marks)
Networking architectures and principles for security
2 (a) The guest Wi-Fi and staff PCs connect to a single managed switch.
Describe how the network should be changed to reduce the risk to patient data. (6)
2 (b) Staff tablets connect to the practice network over Wi-Fi.
(i) State one vulnerability of a wireless access point (WAP). (2)
(ii) Explain one way to secure a WLAN against unauthorised access. (4)
2 (c) The practice is considering using Media Access Control (MAC) address filtering.
Evaluate the use of MAC address filtering on the practice's Wi-Fi. (9)
2 (d) Staff use a VPN when accessing patient records from home.
Describe how the VPN functions and state one drawback for the practice. (4)
(Total for Question 2 = 25 marks)
Cyber security documentation
3 (a) Atlas Health Centre is writing an internet and email use policy.
State two rules that an internet and email use policy should include. (2)
3 (b) The practice is reviewing its staff responsibilities and IT security training.
Explain the security responsibilities of staff and how IT security training should be delivered. (6)
3 (c) The practice is producing a cyber security incident response policy.
Describe the procedures/flowcharts an incident response policy should include. (6)
3 (d) The practice is producing a disaster recovery policy.
Explain the purpose of a disaster recovery policy and the three plans its triage may activate. (6)
(Total for Question 3 = 20 marks)
Forensic procedures
4 (a) Following the theft, the practice initiates a forensic investigation of a recovered tablet.
Explain how an investigator isolates a device suspected of communicating, to preserve evidence. (4)
4 (b) Explain two challenges of live forensics. (4)
4 (c) The investigator reviews network infrastructure during forensic analysis.
Describe the infrastructure the investigator reviews during network forensics. (6)
4 (d) The investigator must maintain an accurate record of findings.
State two requirements for recording forensic findings reliably. (4)
4 (e) The investigator writes a security report.
Explain how the report helps prevent future incidents and state two categories of improvement it should recommend. (5)
(Total for Question 4 = 23 marks)
TOTAL FOR SECTION A = 90 MARKS