EOU Preparation

L1: Cyberattacks

Comprehension Questions

1. What motivates cyberattacks?

2. Describe how tailgating works and give an example.

3. What is the difference between DoS and DDoS attacks?

4. How does spoofing deceive users?

5. What are the dangers of an insider attack?

GCSE-Style Questions

1. Explain what is meant by "social engineering" and provide two examples. (4 marks)

2. Discuss how spoofing attacks work and why they can be dangerous. (6 marks)

3. Describe the term "backdoor access" and explain how attackers use it to gain unauthorized entry. (4 marks)

4. Explain two motives behind cyberattacks and provide an example for each. (4 marks)

5. Evaluate the impact of DDoS attacks on businesses and suggest ways to mitigate them. (6 marks)

L2: Malware

Comprehension Questions

1. What is the main purpose of ransomware?

2. Name three methods malware uses to infect systems.

3. What was the impact of the WannaCry ransomware attack on the NHS?

4. How does spyware collect user information?

5. What security measures can help prevent malware infections?

GCSE-Style Questions

1. Explain the term "spyware" and describe how it can be used to steal information. (4 marks)

2. Describe two methods malware uses to infect systems and suggest how to prevent these infections. (6 marks)

3. Compare viruses and worms in terms of how they spread and their impact on a system. (4 marks)

4. Discuss the role of anti-malware software in preventing cyber threats. (5 marks)

5. Evaluate the effectiveness of system patching in preventing malware attacks. (6 marks)

L3: Phishing

Comprehension Questions

1. What are three common features of phishing emails?

2. How does spear phishing differ from general phishing?

3. What is smishing, and how does it work?

4. Why is CEO fraud considered a dangerous phishing attack?

5. What security measures can help prevent phishing attacks?

GCSE-Style Questions

1. Describe the term "vishing" and explain how it can be used in a phishing attack. (4 marks)

2. Explain two techniques that can prevent phishing attacks and discuss their effectiveness. (6 marks)

3. What is credential harvesting, and how do attackers use it in phishing scams? (4 marks)

4. Discuss the impact of phishing attacks on businesses and individuals. (5 marks)

5. Evaluate the effectiveness of two-factor authentication (2FA) in preventing phishing attacks. (6 marks)

L4: Brute Force & DoS

Comprehension Questions

1. How does a botnet amplify a DDoS attack?

2. Why is CAPTCHA an effective method against brute force attacks?

3. What is the difference between a dictionary attack and a hybrid attack?

4. How does IP blocking help mitigate DDoS attacks?

5. What was the impact of the 2016 Dyn DDoS attack?

GCSE-Style Questions

1. Explain how a DDoS attack works and describe its potential impact on a business. (6 marks)

2. Suggest two measures to prevent brute force attacks and explain how they improve security. (4 marks)

3. Compare the effectiveness of account lockout policies and CAPTCHA in preventing brute force attacks. (5 marks)

4. Describe how salting strengthens password security. (4 marks)

5. Evaluate the role of CDNs in mitigating the effects of DoS/DDoS attacks. (6 marks)

L5: Interception

Comprehension Questions

1. What is the main difference between passive and active interception attacks? Provide an example of each.

2. Why is public Wi-Fi considered a high-risk environment for interception attacks?

3. What is HTTPS stripping, and how does it make a network more vulnerable to interception?

4. How does a Man-in-the-Middle (MITM) attack work, and what types of information can hackers steal?

5. Describe two security measures that can help prevent interception attacks.

GCSE-Style Questions

1. Describe the difference between passive interception and active interception. Give one example of each. (3 marks)

2. Explain how a Man-in-the-Middle (MITM) attack works and describe two security measures that can help prevent it. (4 marks)

3. A user connects to free public Wi-Fi in a café. Explain why this is a security risk and describe two methods an attacker could use to intercept the user’s data. (5 marks)

4. Explain how SSL/TLS encryption protects data and discuss the advantages and limitations of using encryption to secure network communication. (6 marks)

5. A company has discovered that sensitive customer data was stolen through an interception attack. Explain two ways the attack could have happened and describe three security measures the company should implement to prevent future interception attacks. (8 marks)

L6: SQL Injection

Comprehension Questions

1. How does SQL injection allow attackers to bypass authentication?

2. What are two consequences of SQL injection attacks?

3. Why is input validation important in preventing SQL injection?

4. What happened in the Sony Pictures hack, and how did SQL injection contribute to it?

5. How do parameterized queries protect against SQL injection?

GCSE-Style Questions

1. A website login form is vulnerable to SQL injection. The attacker enters ' OR '1'='1' --.
   a) What does this query do?
   b) Suggest two ways to fix this vulnerability. (4 marks)

2. A company stores customer data in a database but does not use parameterized queries.
   a) Describe one risk the company faces.
   b) Explain how parameterized queries reduce this risk. (4 marks)

3. Compare the risks of error-based and blind SQL injection attacks. (5 marks)

4. Explain the concept of “least privilege” and how it helps protect databases from SQL injection attacks. (4 marks)

5. Evaluate the effectiveness of penetration testing in identifying SQL injection vulnerabilities before they are exploited. (6 marks)

L7: Identifying Vulnerabilities

Comprehension Questions

1. How can unpatched software lead to cyberattacks?

2. Describe the role of penetration testing in cybersecurity.

3. What is the function of a vulnerability scanner?

4. Why is multi-factor authentication (MFA) important for securing systems?

5. What are the dangers of privilege escalation in system security?

GCSE-Style Questions

1. Define a vulnerability and provide an example. (2 marks)

2. Explain the difference between black-box and white-box testing. (4 marks)

3. Identify two ways that organizations can prevent cyberattacks by reducing vulnerabilities. (4 marks)

4. Describe what a zero-day vulnerability is and why it is dangerous. (3 marks)

5. Explain the benefits of penetration testing for an organization. (5 marks)