Writing exam answers about cyber security

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which answer structure earns full marks for a cyber security question?

A Name the threat and write 'use antivirus' without saying how it works

B Name the threat, describe how it works and its aim, then explain how a named solution stops it

2. Which sentence describes the aim of a ransomware attack?

A It encrypts the files so the victim pays money to get them back

B It is a bad program that harms the computer

3. Which sentence correctly describes a worm?

A A worm copies itself across a network without needing a host file or user action

B A worm attaches itself to a file and only spreads when the file is opened

4. Which sentence correctly describes pharming?

A A fake email tricks the user into clicking a link to a fake website

B Malicious code redirects the user to a fake website, even if they type the correct address

5. Which solution should you name to stop unauthorised traffic entering a network?

A A firewall, because it checks incoming and outgoing traffic against rules and blocks suspicious traffic

B Antivirus, because it checks incoming and outgoing network traffic against rules

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Threat + process + aim		AMixes up virus and worm: a virus needs a host file and user action, but a worm replicates by itself across a network.
2Solution + how it protects		BPhishing: fake emails trick users into giving passwords; it aims to steal data; spam filters stop it
3Use 'because' to link each point to a reason so the examiner sees your explanation		CName the attack, describe how it works, then say what the attacker wants to achieve
4A complete answer gives the threat, how it works, its aim, then a solution		DMixes up phishing and pharming: that describes phishing, while pharming redirects users to a fake website using malicious code or DNS changes.
5A worm needs a user to run an infected file to spread, so it is a virus.		EName a fix, then explain how it stops the threat from working
6Pharming is when a fake email tricks you into clicking a link.		FA firewall helps because it blocks unauthorised traffic into the network

Definitions

threat + process + aim + solution

Fill in the Blanks

Complete each line of code by filling in the missing parts.

Threat: ____ Process: spreads itself over a network Aim: use up bandwidth and slow it down

Threat: DDoS attack Process: floods a server with requests ___: make the website unavailable

Threat: ________ Process: bad code redirects to a fake site Aim: steal your data

Solution: _________ software It scans files and removes malware

Use MFA _______ a stolen password alone will not let the hacker log in.

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A Threat: virus

B Process: attaches to a file

C Aim: corrupt or delete data

D Fix: firewall software

E Because it scans for viruses

Question 2

A Threat: worm

B Process: spreads by itself

C Aim: clog the network

D It needs a host file

Question 3

A Threat: phishing

B Process: bad code alters DNS

C Aim: steal personal details

D Fix: check the sender

Question 4

A Threat: brute-force attack

B Process: tries many passwords

C Use short passwords because

D they have more combinations

Question 5

A Threat: adware

B Process: records key presses

C Aim: send data to a criminal

D Fix: anti-spyware software

Answer Key

Writing exam answers about cyber security

Section A: Quick Questions

B — Name the threat, describe how it works and its aim, then explain how a named solution stops it

A — It encrypts the files so the victim pays money to get them back

A — A worm copies itself across a network without needing a host file or user action

B — Malicious code redirects the user to a fake website, even if they type the correct address

A — A firewall, because it checks incoming and outgoing traffic against rules and blocks suspicious traffic

Section B: Match the Pairs

Threat + process + aim → Name the attack, describe how it works, then say what the attacker wants to achieve

Solution + how it protects → Name a fix, then explain how it stops the threat from working

Use 'because' to link each point to a reason so the examiner sees your explanation → A firewall helps because it blocks unauthorised traffic into the network

A complete answer gives the threat, how it works, its aim, then a solution → Phishing: fake emails trick users into giving passwords; it aims to steal data; spam filters stop it

A worm needs a user to run an infected file to spread, so it is a virus. → Mixes up virus and worm: a virus needs a host file and user action, but a worm replicates by itself across a network.

Pharming is when a fake email tricks you into clicking a link. → Mixes up phishing and pharming: that describes phishing, while pharming redirects users to a fake website using malicious code or DNS changes.

Section C: Definitions

threat + process + aim + solution — A full-mark answer names the threat, says how it works and what it aims to do, then names a solution and explains how it stops the threat, using 'because' to link each point.

Section D: Fill in the Blanks

Threat: worm
Process: spreads itself over a network
Aim: use up bandwidth and slow it down

Threat: DDoS attack
Process: floods a server with requests
Aim: make the website unavailable

Threat: pharming
Process: bad code redirects to a fake site
Aim: steal your data

Solution: antivirus software
It scans files and removes malware

Use MFA because a stolen password alone
will not let the hacker log in.

Section E: Spot the Error

D — A firewall checks network traffic, so it does not scan files for viruses. The solution that scans files and removes viruses is antivirus software, so the line should read 'Fix: antivirus software'.

D — This mixes up a worm and a virus. A virus attaches to a host file, but a worm copies itself across a network with no host file and no help from the user. It should read 'It needs no host file'.

B — Altering DNS to redirect users is how pharming works, not phishing. Phishing sends fake emails containing links that trick the user, so the line should be 'Process: fake email with link'.

C — Short passwords are easier to guess, so the reason does not follow. Long, strong passwords have more possible combinations, which makes brute-force attacks take much longer. It should read 'Use strong passwords because'.

A — Recording key presses and sending data to a criminal is what spyware does. Adware only shows unwanted adverts. The threat should be named as spyware so it matches the process and aim.