Tick (✓) one box in each row to identify the specific threat described.

Description of Threat	Phishing	Brute-force	SQL Injection	Data Interception
Software used to monitor and capture network traffic packets.
Malicious code entered into a website form to manipulate a database.
An automated software tool used to guess passwords through trial and error.
Emails sent to a user pretending to be a legitimate company to steal personal data.

A bank is concerned about Social Engineering attacks against its staff.

(a) Define what is meant by 'Social Engineering'.
(b) Phishing and Pharming are two forms of social engineering.
Explain one difference between them.
(c) Shoulder Surfing (or 'Blagging') is another form of social engineering.
Describe how a shoulder surfing attack takes place.

A web server hosting an online shop has become very slow and is now crashing repeatedly, denying access to legitimate customers.

(a) Identify the type of attack described above.
(b) Explain how this attack works and why it causes the website to crash.

Malware poses a significant risk to computer systems.

(a) Describe the difference between a Virus and Spyware.
(b) Ransomware has infected a school's network.
Describe the specific impact this threat has on the school's data.

A programmer is developing a website that uses a database to store user login details.

(a) Explain the concept of an SQL Injection attack.
[Image of sql injection diagram] (b) Identify one consequence of a successful SQL Injection attack on the database.

A user is setting up a new account on a website.

(a) Describe how a Brute-force attack would attempt to gain access to this account.
(b) The website uses a "lockout policy" after three failed attempts.
Explain how this prevents a brute-force attack from succeeding.
(c) State two other measures (one software, one physical) that could help prevent unauthorised access to a single computer.
(d) The user visits a coffee shop and logs into the website using public Wi-Fi.
Explain why Data Interception is a higher risk on this network and what the user should check for in the URL bar to mitigate this.