Answer Key

Protecting information and systems from unauthorised access, change or disruption.

Integrity.

The school portal is down during online enrolment.

Data can still be corrupted or made unavailable even if it is kept secret.

Threat: malware. Vulnerability: no antivirus / no updates.

Risk = Threat × Vulnerability × Impact.

A control — it reduces vulnerability.

Some threats and vulnerabilities always remain; risk can only be reduced, not eliminated.

A breach is a specific type of incident involving unauthorised access to data.

Notify affected users; patch the vulnerability; sometimes offer credit monitoring.

Systems should be designed to reduce user error; multiple layers usually failed.

A virus needs a host program to spread; a worm spreads by itself over networks.

It tricks the user into running it, giving attackers direct control.

Disconnect from the network, do not pay, report to IT, restore from backup.

Urgency, misspelt domain, unexpected attachment (also generic greeting, hidden link, request for OTP).

Hover over it (desktop) or long-press (mobile) to preview the URL before clicking.

Disconnect, change the affected password, enable MFA, run a malware scan, report to IT.

A unique pattern that identifies a known piece of malware.

Signatures only catch known malware; heuristics catch new variants by watching behaviour.

Isolating a suspicious file so it cannot run or spread.

Something you know, something you have, something you are.

You cannot change your fingerprint.

Password (know), phone OTP (have), face unlock (are).

The number of possible combinations grows exponentially with length.

One leaked site exposes every other account that shares the password.

It generates and stores unique long passwords so users only remember one.

Codes are generated on the device and cannot be intercepted by SIM swap.

To log in when the second factor (phone) is lost or unavailable.

Even a stolen password is useless without the second factor.

Incoming and outgoing network traffic based on rules.

Malicious files opened locally (e.g. a virus on a USB stick).

Use multiple overlapping controls so the failure of one does not compromise the whole system.

A software fix that closes a security vulnerability.

It removes human delay and installs patches quickly.

A vulnerability the vendor has not yet fixed.

3 copies, 2 media types, 1 offsite.

A backup that cannot be restored is worthless.

Incremental — it copies only what changed since the last backup.

That the connection is encrypted and the certificate was issued to that domain by a trusted CA — not that the site is honest.

To verify domain ownership and issue trusted certificates.

No — the identity of the server cannot be verified.

WPA3.

Evil-twin hotspots, packet sniffing, or captive-portal phishing.

It encrypts all your traffic between the device and a trusted server, hiding it from the local network.

Any four from the list above.

Phishing, malware download, or the VPN provider itself.

It only hides local history; ISPs, sites and networks still see your activity.

Digital theft does not always remove the original; new laws define new offences.

Unauthorised access, identity fraud, data interference, etc.

Attackers and victims are often in different countries with different laws.

Plagiarism is passing off work as your own; copyright violation is copying without permission.

Reuse with attribution, but not for commercial purposes.

Yes — copying a public-domain text into your essay without citation is plagiarism, not illegal copying.

Any three of: flaming, harassment, impersonation, outing, exclusion, sextortion.

Do not reply; save evidence.

It signals approval and isolates the target.

Data that identifies an individual, e.g. name + ID number.

IP address, cookies, GPS location, purchase history.

Innocent pieces of data can combine to identify or profile you.

Public or nearly public.

They may still have access to your data long after you stopped using them.

Turning off ad personalisation or limiting cookie use.

Would you be comfortable with your grandmother seeing this post?

Screenshots and archives can preserve content forever.

It respects their privacy and dignity.

Every 20 minutes, look at something 20 feet away for 20 seconds.

Repeated typing/mouse movements in poor posture.

Blue light suppresses melatonin.

Roughly at eye level.

About 90°.

It causes eye strain and forced posture changes.

CO2 (or dry powder) — never water.

Trailing cables, overloaded sockets, drinks near equipment, damaged plugs.

Raise the alarm.

Every control answers a specific threat, e.g. MFA answers password theft.

Topic 3 — Ethics, Law & Digital Citizenship.

Topic 2 — Protective Measures.

Personal — record it and plan revision.

Pausing to identify the topic before answering.

It strengthens memory by forcing retrieval.

Multiple wrong answers cluster in one topic.

Reasons and examples, not just the fact.

Divide total time by total marks.

The single step you want your audience to do.

It gives you a fresh perspective before real audiences see the work.

Specific, Measurable, Achievable, Relevant, Time-bound.

It consolidates memory and highlights next steps.