Community resourceWorksheet

1CP2-P-4.6 Defragmentation and anti-malware utilities

Part 6 of 7 · 1CP2-P-4 · Operating systems and utilities

The maintenance worksheet, distinguishing a fragmentation problem from a malware problem and choosing the right utility for each.

Students will:

  • say which storage technology defragmentation suits
  • explain how defragmentation reduces file access time
  • compare signature detection with behaviour detection
  • give one strength or limitation of each detection approach
  • apply the correct utility to each fault in a scenario

Inside: 5 explanation cells, 3 multiple-choice questions, 2 fill-in-the-blanks cells and 3 written answers. 19 marks, about 45 minutes.

Series: 1CP2-P-4 · Operating systems and utilities, part 6 of 7.

Shared by Coding PathwayVerified teacher

  • 13 cells
  • About 45 minutes
  • CC BY-SA 4.0
  • Shared 17 Aug 2026

Preview

The whole resource, exactly as a class sees it. Answers and marking are held back.

Defragmentation and anti-malware utilities

Utilities can improve storage access or protect a system, but each operates through a specific mechanism. Strong examination answers name the mechanism and link it to an effect rather than merely saying the computer becomes 'better'.

1. Two different maintenance problems

Defragmentation and anti-malware utilitiesMagnetic HDD defragmentationbeforeafterA1B1A2A3A1A2A3B1Related blocks are placed together to reduce head movement.Anti-malwaresignature detectionmatch known malicious patternsbehaviour detectionspot suspicious actionsdetect · quarantine · removeDefragmentation is appropriate for magnetic HDDs, not SSDs.

On a magnetic hard disk drive (HDD), blocks of one file can become scattered. Defragmentation reorganises blocks so related blocks are contiguous, reducing mechanical read/write-head movement and access time.

Do not recommend defragmentation for a solid-state drive (SSD): it has no moving read/write head and unnecessary writes contribute to wear.

Fill in the blanks3 marks
Defragmentation places related file gap 1 together on a magnetic gap 2, reducing movement of the read/write gap 3.
  • blocks
  • HDD
  • head
  • SSD
Multiple choice1 mark

For which device is routine defragmentation appropriate?

  • AA magnetic HDD
  • BAn SSD
  • CA keyboard
  • DA CPU register
Written answer3 marks

Explain how defragmenting a fragmented magnetic HDD can reduce file access time.

Follow blocks, head movement and access time.

Students type their answer here.

2. Detect known patterns and suspicious actions

Signature detection compares files or code with stored patterns for known malware. It can identify known threats efficiently but depends on updated signature data.

Behaviour detection monitors actions and looks for suspicious activity. It may identify previously unknown malware, but legitimate unusual behaviour can cause a false positive. Anti-malware may quarantine a suspect item before deleting or cleaning it.

Fill in the blanks3 marks
A stored pattern for known malware is a gap 1. Monitoring suspicious actions is gap 2 detection. Isolating a suspect file is called gap 3.
  • behaviour
  • quarantine
  • signature
  • timeslot
Multiple choice1 mark

Which approach is more likely to flag a previously unknown threat whose actions are suspicious?

  • ASignature detection only
  • BBehaviour detection
  • CDefragmentation
  • DFile renaming
Written answer4 marks

Compare signature and behaviour detection, including one strength or limitation of each.

Use known patterns, unknown threats and false positives where relevant.

Students type their answer here.

3. Apply the correct utility

Defragmentation changes disk layout; anti-malware detects and responds to malicious software. Neither replaces backups, permissions or user care. Resilience often comes from layers with distinct purposes.

Written answer3 marks

A technician finds a slow magnetic HDD with scattered file blocks and also a suspicious program changing many files. Recommend the appropriate response to each issue and justify it.

Treat the storage-layout issue and malicious-behaviour issue separately.

Students type their answer here.

Multiple choice1 mark

Why should signature data be updated regularly?

  • ASo known newer malware patterns can be recognised
  • BSo SSDs gain moving heads
  • CSo full backups become incremental
  • DSo user permissions are removed

Route forward

You can explain HDD defragmentation precisely and compare signature with behaviour detection. The theory checkpoint now consolidates operating systems and utilities without mixing in CT assessment.