← IGCSE Computer Science Paper 1

Matching a threat to its process and aim

Match a threat by finding its process (how it works) and its aim (why the attacker does it), e.g. phishing: fake emails trick users to steal login details.

Part of: IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 24, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 9, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 42

Understanding Matching a threat to its process and aim in IGCSE Computer Science Paper 1

What it does: A denial of service attack works by flooding a server with requests, and the aim is to stop real users from reaching the service. A dictionary attack tries likely words one by one, and the aim is to gain unauthorised access to an account. A worm spreads by itself through a network. A virus needs a user to run an infected file, so the 'no user action' clue points to a worm. A Trojan horse looks like useful or harmless software but hides a harmful purpose. It does not copy itself like a worm does. The second answer describes a DoS attack. Phishing has a process (fake messages and links) and an aim (stealing personal data).

Common mistakes: The aim of phishing is to steal login details. Crashing a website is the aim of a denial of service attack. The line should be aim = "steal login details". A worm spreads by itself across a network and does not need a host file. Needing a host file describes a virus. The line should say it spreads by itself.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Matching a threat to its process and aim to a class →

This module's key terms are also in a printable crossword (Modules 520–546) and word search (Modules 510–546).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A program copies itself across a network without any user action, using up bandwidth and slowing the network. Which threat is it?
WormVirus
Matches
Trojan horse: copies itself across a network
↓
This describes a worm. A Trojan horse pretends to be useful software and relies on the user installing it. It does not copy itself.
Applying
Meanings
Term
process and aim
Meaning
Match a threat by finding its process (how it works) and its aim (why the attacker does it), e.g. phishing: fake emails trick users to steal login details.
Practice
Threat: phishing
Testing
Gaps
THREAT:
Check Answer
Spots
2how = "fake email tricks user"
3aim = "crash a website"

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Bear' badge — Forest Guardian, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A program copies itself across a network without any user action, using up bandwidth and slowing the network. Which threat is it?
A. Worm ✓
B. Virus
A worm spreads by itself through a network. A virus needs a user to run an infected file, so the 'no user action' clue points to a worm.
2. A free game is installed by a student. In the background it gives the attacker remote access to the computer. Which threat is it?
A. Worm
B. Trojan horse ✓
A Trojan horse looks like useful or harmless software but hides a harmful purpose. It does not copy itself like a worm does.
3. Which statement gives the process AND the aim of phishing?
A. Fake emails trick users into entering login details, so the attacker can steal their accounts ✓
B. A huge number of requests floods a server, so that real users cannot reach the website
The second answer describes a DoS attack. Phishing has a process (fake messages and links) and an aim (stealing personal data).
4. A student types the correct web address but is sent to a fake bank site. Which threat is this?
A. Phishing
B. Pharming ✓
Pharming changes where the address leads, often by tampering with DNS or by using malicious code. Phishing needs the user to be tricked into clicking a link.
5. An attacker tries thousands of possible passwords one after another until one works. Which threat is it?
A. Brute-force attack ✓
B. Denial of service attack
Brute-force is repeated guessing to get into an account. A DoS attack floods a server to stop it working.

Match the Pairs

Worm: copies itself across a network → Process: spreads by itself with no user action. Aim: use up bandwidth and slow or crash the network.
Pharming: DNS sends you to a fake site → Process: redirects users to a fake website even if they type the right address. Aim: steal personal data.
Thousands of requests flood a server so real users cannot get in → DoS: process = flood requests, aim = make site unavailable
Trying every common word in a list to guess a password → Dictionary attack: process = try listed words, aim = gain access
Trojan horse: copies itself across a network → This describes a worm. A Trojan horse pretends to be useful software and relies on the user installing it. It does not copy itself.
Brute-force attack: aim = make a website unavailable → That is the aim of a DoS attack. A brute-force attack tries many passwords with the aim of gaining access to an account.

Key Term

process and aim
Match a threat by finding its process (how it works) and its aim (why the attacker does it), e.g. phishing: fake emails trick users to steal login details.

Fill in the Blanks

1. THREAT: phishing PROCESS: fake email tricks the user AIM: steal login details
Hint: Type the threat that uses fake emails to trick users.
2. THREAT: pharming PROCESS: code redirects users to a fake site AIM: steal data typed on the fake site
Hint: Type the threat that redirects users to a fake website using DNS.
3. THREAT: virus PROCESS: attaches to a file; user runs it AIM: corrupt or delete data
Hint: Type the malware that needs a host file and a user to run it.
4. THREAT: DoS PROCESS: floods a server with requests AIM: make the website unavailable to users
Hint: Type the word that describes the site after a flood of requests.
5. THREAT: brute-force PROCESS: tries many passwords in turn AIM: gain unauthorised access
Hint: Type what the attacker keeps trying in turn to break into an account.

Spot the Error

Question 1
A threat = "phishing"
B how = "fake email tricks user"
C aim = "crash a website"
Line C — The aim of phishing is to steal login details. Crashing a website is the aim of a denial of service attack. The line should be aim = "steal login details".
Question 2
A threat = "worm"
B how = "needs a host file"
C aim = "slow the network"
Line B — A worm spreads by itself across a network and does not need a host file. Needing a host file describes a virus. The line should say it spreads by itself.
Question 3
A threat = "worm"
B how = "looks like a safe app"
C aim = "open a backdoor"
Line A — Software that looks like a safe app but hides harmful code is a Trojan horse, not a worm. A worm spreads by itself. The first line should be threat = "trojan horse".
Question 4
A threat = "pharming"
B how = "sends a fake email"
C aim = "steal login details"
Line B — Pharming works by redirecting the user to a fake website, often by changing DNS information. Sending a fake email is the process of phishing. The line should be how = "redirects to fake site".
Question 5
A threat = "DoS attack"
B how = "floods a server"
C aim = "make site unavailable"
D source = "many devices"
Line D — A DoS attack comes from one device. Many devices flooding a server is a DDoS attack. The line should be source = "one device".

Student with a class code? Join your class →