← IGCSE Computer Science Paper 1

Writing exam answers about cyber security

A full-mark answer names the threat, says how it works and what it aims to do, then names a solution and explains how it stops the threat, using 'because' to link each point.

Part of: IGCSE Computer Science 0478 — 5.3 Cyber Security — Module 50

Understanding Writing exam answers about cyber security in IGCSE Computer Science Paper 1

What it does: The word 'because' joins the solution to the reason it works, which earns the explanation mark. This answer names the threat, describes the process, states the aim and gives a solution. Examiners want a specific aim, such as demanding payment. 'Bad program' is too vague. A virus needs a host file and user action. A worm spreads by itself. Mixing these up loses marks. The second option is phishing. Pharming redirects the user, often by changing DNS data. A firewall monitors network traffic. Antivirus scans files for malware. Do not mix them up. Be specific. Say what the second factor is and why it stops the attacker.

Common mistakes: A firewall checks network traffic, so it does not scan files for viruses. The solution that scans files and removes viruses is antivirus software, so the line should read 'Fix: antivirus software'. This mixes up a worm and a virus. A virus attaches to a host file, but a worm copies itself across a network with no host file and no help from the user. It should read 'It needs no host file'.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Writing exam answers about cyber security to a class →

This module's key terms are also in a printable crossword (Modules 553–577) and word search (Modules 553–607).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which answer structure earns full marks for a cyber security question?

Name the threat, describe how it works and its aim, then explain how a named solution stops itName the threat and write 'use antivirus' without saying how it works

Matches

A worm needs a user to run an infected file to spread, so it is a virus.

↓

Mixes up virus and worm: a virus needs a host file and user action, but a worm replicates by itself across a network.

Applying

Meanings

Term

threat + process + aim + solution

Meaning

A full-mark answer names the threat, says how it works and what it aims to do, then names a solution and explains how it stops the threat, using 'because' to link each point.

Practice

Threat: a worm

Testing

Gaps

Threat:

Check Answer

Spots

3Aim: corrupt or delete data

4Fix: firewall software

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which answer structure earns full marks for a cyber security question?

A. Name the threat and write 'use antivirus' without saying how it works

B. Name the threat, describe how it works and its aim, then explain how a named solution stops it ✓

A full-mark answer links threat, process, aim and solution. Naming alone is not enough.

2. Which sentence describes the aim of a ransomware attack?

A. It encrypts the files so the victim pays money to get them back ✓

B. It is a bad program that harms the computer

Examiners want a specific aim, such as demanding payment. 'Bad program' is too vague.

3. Which sentence correctly describes a worm?

A. A worm copies itself across a network without needing a host file or user action ✓

B. A worm attaches itself to a file and only spreads when the file is opened

A virus needs a host file and user action. A worm spreads by itself. Mixing these up loses marks.

4. Which sentence correctly describes pharming?

A. A fake email tricks the user into clicking a link to a fake website

B. Malicious code redirects the user to a fake website, even if they type the correct address ✓

The second option is phishing. Pharming redirects the user, often by changing DNS data.

5. Which solution should you name to stop unauthorised traffic entering a network?

A. A firewall, because it checks incoming and outgoing traffic against rules and blocks suspicious traffic ✓

B. Antivirus, because it checks incoming and outgoing network traffic against rules

A firewall monitors network traffic. Antivirus scans files for malware. Do not mix them up.

Match the Pairs

Threat + process + aim → Name the attack, describe how it works, then say what the attacker wants to achieve

Solution + how it protects → Name a fix, then explain how it stops the threat from working

Use 'because' to link each point to a reason so the examiner sees your explanation → A firewall helps because it blocks unauthorised traffic into the network

A complete answer gives the threat, how it works, its aim, then a solution → Phishing: fake emails trick users into giving passwords; it aims to steal data; spam filters stop it

A worm needs a user to run an infected file to spread, so it is a virus. → Mixes up virus and worm: a virus needs a host file and user action, but a worm replicates by itself across a network.

Pharming is when a fake email tricks you into clicking a link. → Mixes up phishing and pharming: that describes phishing, while pharming redirects users to a fake website using malicious code or DNS changes.

Key Term

threat + process + aim + solution

A full-mark answer names the threat, says how it works and what it aims to do, then names a solution and explains how it stops the threat, using 'because' to link each point.

Fill in the Blanks

1. Threat: worm Process: spreads itself over a network Aim: use up bandwidth and slow it down

Hint: Type the malware that copies itself across a network without needing a host file.

2. Threat: DDoS attack Process: floods a server with requests Aim: make the website unavailable

Hint: Type the label for the part of the answer that states the attacker's purpose.

3. Threat: pharming Process: bad code redirects to a fake site Aim: steal your data

Hint: Type the threat that redirects users to a fake website, not the one that uses fake emails.

4. Solution: antivirus software It scans files and removes malware

Hint: Type the solution that scans files for malicious code, not the one that filters network traffic.

5. Use MFA because a stolen password alone will not let the hacker log in.

Hint: Type the linking word that connects a point to its reason in a full-mark answer.

Spot the Error

Question 1

A Threat: virus

B Process: attaches to a file

C Aim: corrupt or delete data

D Fix: firewall software

E Because it scans for viruses

Line D — A firewall checks network traffic, so it does not scan files for viruses. The solution that scans files and removes viruses is antivirus software, so the line should read 'Fix: antivirus software'.

Question 2

A Threat: worm

B Process: spreads by itself

C Aim: clog the network

D It needs a host file

Line D — This mixes up a worm and a virus. A virus attaches to a host file, but a worm copies itself across a network with no host file and no help from the user. It should read 'It needs no host file'.

Question 3

A Threat: phishing

B Process: bad code alters DNS

C Aim: steal personal details

D Fix: check the sender

Line B — Altering DNS to redirect users is how pharming works, not phishing. Phishing sends fake emails containing links that trick the user, so the line should be 'Process: fake email with link'.

Question 4

A Threat: brute-force attack

B Process: tries many passwords

C Use short passwords because

D they have more combinations

Line C — Short passwords are easier to guess, so the reason does not follow. Long, strong passwords have more possible combinations, which makes brute-force attacks take much longer. It should read 'Use strong passwords because'.

Question 5

A Threat: adware

B Process: records key presses

C Aim: send data to a criminal

D Fix: anti-spyware software

Line A — Recording key presses and sending data to a criminal is what spyware does. Adware only shows unwanted adverts. The threat should be named as spyware so it matches the process and aim.

Student with a class code? Join your class →