GCSE (9-1) Computer Science
Mark Scheme
J277/01: Unit 1.4 Prevention & Management
Question Answer Marks Guidance
1
  • Row 1: Anti-malware (1)
  • Row 2: Penetration Testing (1)
  • Row 3: Firewall (1)
 3
AO1 (Recall)
1 mark for each correct tick.
If more than one tick appears in a row, award 0 marks for that row.
2a
  • Authorised users / specialists... (1)
  • ...simulate an attack / attempt to hack the system (to find weak points). (1)
 2
AO1/AO2
Candidates must mention that it is a simulated or deliberate attempt to breach security.
2b
  • To identify vulnerabilities / bugs / security holes... (1)
  • ...so they can be fixed before a malicious hacker exploits them. (1)
 2
The key concept here is "Prevention" or "Fixing" known issues proactively.
2c White hat (hacker) / Ethical hacker 1
Do not allow: Just "Hacker".
3a 2 marks for each action (Max 4):
  • Action 1: Monitors/Scans incoming and outgoing traffic (1) to check against criteria/whitelist/blacklist. (1)
  • Action 2: Blocks unauthorised traffic (1) preventing hackers from entering the network. (1)
  • Action 3: Opens/Closes ports (1) to allow/deny specific applications. (1)
 4
Simply saying "It protects the network" is too vague.
Do not allow: "It blocks viruses" (unless qualified with "malicious traffic"). The firewall is primarily a traffic filter.
3b
  • Firewalls filter network traffic / transmissions coming from the internet. (1)
  • The USB stick is a physical connection / storage device (not network traffic), so the firewall does not scan it. (1)
 2
This tests the student's understanding of the scope of a firewall. It monitors the "gate" (internet), not the "room" (USB ports).
4a Any one:
  • When a file is downloaded (from the internet).
  • When a file is opened / run.
  • Scheduled scan (e.g., daily/weekly).
 1
4b
  • It alerts the user. (1)
  • It Quarantines the file (stops it running). (1)
  • It asks the user to Delete / Clean the file. (1)
 3
"Quarantine" is the specific technical term expected for J277.
5a
  • Firewall: Blocks unauthorised access/connections to the computer (Packet Filtering). (1)
  • But it cannot detect malicious software hidden inside valid files/downloads. (1)
  • Anti-malware: Scans the contents of files/programs to find malicious code. (1)
  • It is needed to remove viruses that might bypass the firewall (e.g., via email or USB). (1)
 4
Examiner's Note: This is a common "trap" question. Students must clearly distinguish between Connection/Traffic (Firewall) and Content/Code (Anti-malware).
5b
  • Staff Training / Education / Awareness courses.
  • Acceptable Use Policy (AUP).
 1
Do not allow: "Tell them not to click links" (too informal/vague). "Training" is the prevention method.
5c
  • Classification: It is a method of Recovery. (1)
  • Justification: Backups do not stop the attack from happening (Prevention). (1) They only allow you to restore data after it has been lost/damaged. (1)
 3
Examiner's Note: Mark schemes are very strict on this. Backups are never accepted as a "Prevention" method for attacks like viruses or hacking. They mitigate the impact, not the threat.
OCR 2026