GCSE (9-1) Computer Science
Mark Scheme
J277/01: Unit 1.4 User Security
Question Answer Marks Guidance
1a 1 mark for each valid method (Max 2):
  • Locked doors / Keypad entry / Swipe cards.
  • Biometrics (Fingerprint/Retina scanner).
  • CCTV / Security Cameras.
  • Security Guards.
 2
Do not allow: "Passwords" (this is software security).
Do not allow: "Firewalls" (this is network security).
Must be a physical barrier.
1b
  • Definition: Restricting what users can do/see based on their job role/seniority. (1)
  • Improvement: It limits access to sensitive data to only those who need it (1). It prevents accidental (or malicious) deletion/editing of important files by unauthorised staff (1).
 3
Candidates often just define it. To get full marks, they must explain why it improves security (e.g., preventing data loss/theft).
2a 1 mark for each characteristic (Max 3):
  • Minimum length (e.g., 8+ characters).
  • Mixture of uppercase and lowercase letters.
  • Inclusion of numbers/symbols/special characters.
  • Not using personal data (e.g., name/DOB).
 3
Examiner's Note: "Hard to guess" is too vague – NE (Not Enough). They must specify what makes it hard to guess.
2b
  • Biometrics uses unique physical characteristics (fingerprint/face). (1)
  • Unlike a password, you cannot "forget" it, so there is no need to write it down (removing the risk of theft). (1)
 2
Allow: "Harder to fake/steal" as a benefit.
2c
  • Account Lockout: Lock the account after a set number of failed attempts (e.g., 3 tries). (1)
  • This stops the automated trial-and-error process of a brute-force attack. (1)
  • OR Progressive Delays: Increasing the time wait between login attempts. (1)
 2
Do not accept: "Make the password stronger" – the question asks for a rule to prevent the attack from succeeding, not just make it harder.
3a
  • It scrambles/jumbles the data using an algorithm. (1)
  • If the laptop is stolen, the data is unreadable / meaningless without the decryption key. (1)
 2
Crucial: Do not accept "It stops them accessing the files". Encryption doesn't stop access; it stops understanding.
3b Plain (text) (1)
Cipher (text) (1) 		2
Must be in the correct order.
4a
  • Doctor: Read-Write (1)
  • Receptionist: No Access / Read-Only (Context dependent, but strictly "Medical History" implies No Access usually, but Read-Only is acceptable if justified for checking records exist). Best answer: No Access. (1)
  • Cleaner: No Access (1)
 3
Check the context carefully. If a student argues a receptionist needs "Read-Only" to see if a file exists, allow it. But "Read-Write" for receptionist is definitely incorrect.
4b
  • Kensington Locks / Cable locks. (1)
  • Bolting the hardware to the desk. (1)
 2
Do not allow: "Lock the door" (Question asks about the computer hardware in a public waiting area).
Allow: Tracker tags / Etching.
5a
  • After entering the password... (1)
  • ...a code is sent to a separate device (e.g., mobile phone). (1)
  • The hacker cannot log in because they do not have physical possession of the second device. (1)
 3
Must mention the "second device" or "separate channel" concept.
5b Any one:
  • Privacy screens / filters on the display.
  • Winged guards around the keypad.
  • Positioning the ATM so the screen is not visible to the queue.
 1
6 Indicative Content:
Physical Security: Prevents physical access to the server room/terminals. Stops theft of hard drives.
User Access Levels: Prevents valid users (staff) from seeing data they shouldn't (insider threat). Stops accidental deletion. Prevents a hacker who gains physical access from having "Admin" rights instantly.
Interdependence: If you only have physical security, a cleaner could accidentally delete a file if logged in. If you only have access levels, a thief could steal the server and bypass the OS permissions entirely.

Levels:
Level 3 (5-6): Detailed discussion of both. Explains clearly how they target different threats. Justifies the need for both.
Level 2 (3-4): Discusses both methods but lacks depth. Explains what they do but consequence of missing one is vague.
Level 1 (1-2): Identifies the methods but descriptions are limited or generic. 		6
AO3 (Evaluation/Discussion)
OCR 2026