Exam questions and the scenario question

The internet is not the same as the web

The internet is the physical network. It is millions of computers, cables, routers and wireless links joined together across the world. It is the infrastructure.

The World Wide Web (WWW) is a collection of websites and web pages stored on computers connected to the internet.

The web is one service that uses the internet. Email, online gaming and video calls also use the internet, but they are not the web.

The parts of a URL

A URL (uniform resource locator) is the text address of a web page. It is what you type into the address bar.

Cambridge splits a URL into three parts: the protocol, the domain name and the web page/file name.

The protocol is the set of rules used to transfer the page, such as `https`. The domain name names the web server, such as `www.bbc.co.uk`. The web page/file name is the exact page or file on that server, often with a folder path before it.

There is something to try for this step in the IGCSE library.

HTTP and HTTPS

HTTP (Hypertext Transfer Protocol) is the set of rules for sending web pages between a web server and a browser.

HTTPS (Hypertext Transfer Protocol Secure) is HTTP with encryption added, using SSL/TLS. Encryption scrambles the data so that anyone who intercepts it cannot read it.

A browser shows a padlock in the address bar when HTTPS is used. You should only type passwords or card numbers on HTTPS pages.

What a web browser does

A web browser is application software that lets you find, fetch and view web pages. Examples are Chrome, Firefox, Safari and Edge.

Its main job is to render HTML: it reads the HTML code from the server and turns it into the page you see, with text, images and links.

Cambridge lists these other functions. Learn each one.

How a web page is retrieved, step by step

Every web server has an IP address, a number that identifies it on the internet, such as `151.101.0.81`. Computers need this number to send data to each other.

People type a domain name, not a number. The Domain Name System (DNS) is a system of servers that look up the IP address for a domain name. It works like a phone book for the internet.

Follow the numbered arrows in the diagram, then read the steps.

There is a diagram for this step in the IGCSE library.

Cookies: session and persistent

A cookie is a small text file that a website stores on the user's device. The next time the browser visits that site, it sends the cookie back, so the site recognises the user.

A session cookie is temporary. It is kept in memory and deleted when the browser is closed.

A persistent cookie is saved on the device's storage. It stays until its expiry date or until the user deletes it. It remembers you between visits.

What cookies are used for

Cambridge lists four main uses of cookies.

Saving personal details, such as your name and delivery address, so you do not retype them.

Tracking user preferences, such as language, dark mode or the pages you look at, so the site can be personalised and show targeted adverts.

Holding items in an online shopping cart while you keep browsing.

Storing login details, so you stay logged in when you return.

Brute-force attack

A brute-force attack is when a criminal tries every possible password (or key) until one works. Software tries millions of guesses each second.

The aim is to get into an account or system, then steal data or cause harm.

Longer passwords with a mix of character types have far more possible combinations, so they take much longer to crack.

Data interception

Data interception is when data is stolen while it is being sent, for example over Wi-Fi or across the internet.

A criminal can use a packet sniffer, a program that captures and examines data packets as they pass. On an unsecured public Wi-Fi network this is easy.

The aim is to read passwords, card numbers or private messages.

Distributed denial of service (DDoS)

A denial of service (DoS) attack floods a web server with so many requests that it cannot cope. Real users cannot reach the website.

In a distributed DoS (DDoS), the requests come from thousands of computers at once. These are often ordinary devices infected with malware and controlled by the criminal. This group is called a botnet.

The aim is to take a website offline, often to cause loss of sales or to demand money.

Hacking

Hacking is gaining unauthorised access to a computer system. Unauthorised means without permission.

A hacker may steal, change or delete data, or install malware. This is illegal in most countries.

Ethical hacking is different: a company pays an expert to try to break in, so weaknesses can be found and fixed.

Malware: virus, worm and Trojan horse

Malware (malicious software) is any software written to cause harm. Cambridge lists six types. The first three spread or get in; the last three do specific damage.

Malware: spyware, adware and ransomware

These three types are named after what they do once they are on a device.

Phishing and pharming

Phishing is sending a fake email or message that looks like it comes from a trusted organisation, such as a bank. It tries to make the user click a link to a fake website and type in their personal details.

Pharming is when malicious code is installed on the user's computer, or a DNS server is tampered with. It redirects the user to a fake website, even when they type the correct URL.

Both aim to steal login details, card numbers or other personal data.

Social engineering

Social engineering is manipulating people, rather than computers, into breaking security. It uses trust, fear, curiosity or urgency.

Phishing is one kind. Another is a phone call from someone pretending to be the IT department.

Baiting leaves a USB stick labelled "Salaries" in the car park, hoping someone plugs it in. Scareware is a fake pop-up saying "Your PC is infected, call now".

The aim is to get passwords, access to a building or system, or to get malware installed.

Solutions: access levels, anti-malware and authentication

Access levels give each user only the rights they need. A student can read the school timetable but cannot change it. This limits the damage if an account is hacked.

Anti-malware software includes anti-virus and anti-spyware. It scans files and compares them with a database of known malware. It quarantines or deletes anything harmful and checks downloads as they arrive.

Authentication proves a user is who they say they are.

Solutions: updates, checking messages and links

Automating software updates means the OS and apps download and install fixes by themselves. Updates close security holes that hackers and malware use.

Checking the spelling and tone of communications helps spot phishing. Warning signs are spelling mistakes, a general greeting such as "Dear customer", and an urgent or threatening tone.

Checking URLs in links before clicking: hover over the link to see where it really goes. Look for misspellings such as `paypa1.com` or extra words such as `bbva-secure-login.net`.

Solutions: firewalls and privacy settings

A firewall sits between a computer (or network) and the internet. It can be hardware, software or both.

It examines all traffic coming in and going out. It checks each packet against a set of rules, such as allowed IP addresses or ports. Traffic that breaks the rules is blocked.

It can also log traffic and warn the user when a program tries to connect to the internet.

Privacy settings control who can see your information, for example on social media. Setting a profile to "friends only" stops strangers seeing your location and photos, which social engineers use.

Solutions: proxy servers

A proxy server is a server that sits between the user's computer and the web server. Requests go to the proxy first, and the proxy fetches the page on the user's behalf.

It can filter requests, blocking access to certain websites. Schools use this to block unsuitable sites.

It hides the user's IP address, because the web server only sees the proxy's address. This protects the user's identity.

It can cache (store copies of) popular pages, so they load faster the next time.

In front of a web server, it can absorb and filter heavy traffic, helping to protect against DDoS attacks.

Solutions: SSL

SSL (Secure Sockets Layer) is a security protocol that encrypts data sent between a browser and a web server. Its modern version is called TLS, but the exam uses the name SSL.

It is what turns HTTP into HTTPS. It uses an SSL certificate: a digital document that proves the website is who it claims to be.

Matching threats to defences

Exam questions often give a scenario and ask you to name the threat and the best defence. Try the threats toy: read each scenario, name the threat, then pick the defence.

Always explain how the defence stops that threat. "Install a firewall" is a weak answer. "A firewall blocks incoming traffic that does not meet its rules" is stronger.

There is something to try for this step in the IGCSE library.

Be precise, and amend with care

An algorithm must say exactly what to do. 'More than 50' is `> 50`. '50 or more' is `>= 50`. These give different results for 50.

Set every total, counter, highest and lowest to a start value before the loop. Use meaningful names like `PassCount`, not `x`, and `//` comments.

An amend question asks you to change a given algorithm. Find the line that controls the behaviour and change only that line.

Example: to make the bubble sort give descending order (largest first), change `>` to `<` in the comparison.

// Original: sorts into ascending order (smallest first)
IF Numbers[Index] > Numbers[Index + 1]

// Amended: sorts into descending order (largest first)
IF Numbers[Index] < Numbers[Index + 1]

numbers = [7, 3, 9, 2, 5]
top = 5
swap = True
while swap == True and top > 1:
    swap = False
    for index in range(top - 1):
        # amended: < instead of > gives descending order
        if numbers[index] < numbers[index + 1]:
            temp = numbers[index]
            numbers[index] = numbers[index + 1]
            numbers[index + 1] = temp
            swap = True
    top = top - 1
print(numbers)

The 15-mark scenario question: plan first

The last question on Paper 2 is a scenario worth 15 marks. Allow about 30 minutes. You may answer in pseudocode, Python, Visual Basic or Java.

Read the scenario twice. Underline every task. Make a numbered checklist and tick each item as you code it.

Sample scenario: a teacher records three tests for each of 30 students. Each test is out of 50. Names are already in `StudentName[1:30]`.

Model answer in pseudocode and Python

The model answer uses two nested `FOR` loops: one for students, one for tests. It reuses validation, totalling, counting, maximum and average.

Read the comments. They say what each part does, which also earns marks.

Python lists start at index 0, so the Python loops use `range(30)` and `range(3)`.

The first Python line is a stand-in for the names, so the program can run. In the exam you do not write it, because the names are already stored.

// StudentName[1:30] already holds the 30 names
DECLARE StudentName : ARRAY[1:30] OF STRING
DECLARE StudentMark : ARRAY[1:30, 1:3] OF INTEGER
DECLARE StudentTotal : ARRAY[1:30] OF INTEGER
DECLARE Student : INTEGER
DECLARE Test : INTEGER
DECLARE Mark : INTEGER
DECLARE Total : INTEGER
DECLARE Average : REAL
DECLARE ClassTotal : INTEGER
DECLARE MeritCount : INTEGER
DECLARE TopTotal : INTEGER
DECLARE TopStudent : INTEGER

// set the class totals and counters to their start values
ClassTotal ← 0
MeritCount ← 0
TopTotal ← -1
TopStudent ← 1

FOR Student ← 1 TO 30
  Total ← 0
  FOR Test ← 1 TO 3
    // input one mark and validate it with a range check (0 to 50)
    OUTPUT "Enter mark for test ", Test, " for ", StudentName[Student]
    INPUT Mark
    WHILE Mark < 0 OR Mark > 50 DO
      OUTPUT "Error: a mark must be from 0 to 50. Enter it again"
      INPUT Mark
    ENDWHILE
    // store the valid mark and add it to this student's total
    StudentMark[Student, Test] ← Mark
    Total ← Total + Mark
  NEXT Test
  // store the total, work out the average and output the results
  StudentTotal[Student] ← Total
  Average ← ROUND(Total / 3, 1)
  OUTPUT StudentName[Student], " Total: ", Total, " Average: ", Average
  ClassTotal ← ClassTotal + Total
  // a total of 120 or more earns a merit
  IF Total >= 120
    THEN
      MeritCount ← MeritCount + 1
  ENDIF
  // remember the highest total so far and whose it is
  IF Total > TopTotal
    THEN
      TopTotal ← Total
      TopStudent ← Student
  ENDIF
NEXT Student

// whole-class results
OUTPUT "Class average total: ", ROUND(ClassTotal / 30, 1)
OUTPUT "Number of merits: ", MeritCount
OUTPUT "Highest total: ", StudentName[TopStudent], " with ", TopTotal

# The question says the names are already stored.
# This line is a stand-in so the program can run.
student_name = ["Student " + str(n) for n in range(1, 31)]
student_mark = [[0, 0, 0] for row in range(30)]
student_total = [0] * 30

# set the class totals and counters to their start values
class_total = 0
merit_count = 0
top_total = -1
top_student = 0

for student in range(30):
    total = 0
    for test in range(3):
        # input one mark and validate it with a range check (0 to 50)
        mark = int(input("Enter mark for test " + str(test + 1) + " for " + student_name[student] + ": "))
        while mark < 0 or mark > 50:
            mark = int(input("Error: a mark must be from 0 to 50. Enter it again: "))
        # store the valid mark and add it to this student's total
        student_mark[student][test] = mark
        total = total + mark
    # store the total, work out the average and output the results
    student_total[student] = total
    average = round(total / 3, 1)
    print(student_name[student], "Total:", total, "Average:", average)
    class_total = class_total + total
    # a total of 120 or more earns a merit
    if total >= 120:
        merit_count = merit_count + 1
    # remember the highest total so far and whose it is
    if total > top_total:
        top_total = total
        top_student = student

# whole-class results
print("Class average total:", round(class_total / 30, 1))
print("Number of merits:", merit_count)
print("Highest total:", student_name[top_student], "with", top_total)

How the 15 marks are awarded

Recent mark schemes use levels, not one mark per line. AO2 (applying techniques and data structures) gives up to 9 marks. AO3 (comments, identifiers, logic and accuracy) gives up to 6 marks.

The examiner reads the whole answer and picks the band that fits best. Minor syntax errors are ignored if the logic is clear.