Community resourceWorksheet

1CP2-P-5.1 Malware types and behaviours

Part 1 of 6 · 1CP2-P-5 · Cyber security and robust software

The opening cyber security worksheet, classifying malware by the mechanism it uses rather than by the harm it causes.

Students will:

  • compare a virus with a worm by mechanism
  • identify the malware type a scenario describes
  • explain how a Trojan reaches a system and one harm it causes
  • explain why paying a ransomware demand is not a recovery plan
  • describe two different impacts malware could have on a school

Inside: 6 explanation cells, 5 multiple-choice questions, 1 fill-in-the-blanks cell and 6 written answers. 20 marks, about 45 minutes.

Series: 1CP2-P-5 · Cyber security and robust software, part 1 of 6.

Shared by Coding PathwayVerified teacher

  • 18 cells
  • About 45 minutes
  • CC BY-SA 4.0
  • Shared 17 Aug 2026

Preview

The whole resource, exactly as a class sees it. Answers and marking are held back.

Malware types and behaviours

Malware is software designed to cause harm, disruption, unauthorised access or data theft. Pearson requires five types: viruses, worms, Trojans, ransomware and keyloggers. Strong answers distinguish them by mechanism rather than treating every malicious program as a virus.

1. Classify by mechanism

Required malware types and their mechanismsIdentify malware by what it does and how it reaches the systemreplicate and spreadviruswormvirus attaches · worm self-spreads across systemsdisguise and installationTrojanappears legitimate; user installs or runs itdeny access and extortransomwareencrypts/locks data and demands paymentsecretly monitor inputkeyloggerrecords keystrokes to steal sensitive dataMalware is malicious software: the name alone earns little unless linked to its behaviour.

A virus attaches to a host file or program and replicates when that host runs. A worm is standalone and can copy itself across systems or networks. Both spread, but their dependence on a host differs.

Fill in the blanks3 marks
A gap 1 attaches to a host and replicates when it runs. A standalone gap 2 can self-spread between systems. Both are forms of gap 3.
  • malware
  • Trojan
  • virus
  • worm
Written answer2 marks

Compare a virus with a worm.

Give one similarity and one difference in how they spread.

Students type their answer here.

2. Disguise, extortion and monitoring

A Trojan appears legitimate or useful so that a user installs or runs it; it may then create unauthorised access or install further malware. Ransomware denies access to data or a system—often by encryption—and demands payment. A keylogger records keystrokes, which can expose passwords and other sensitive information.

Multiple choice1 mark

A free game appears genuine but secretly installs a remote-access tool when the user runs it. Which type best fits?

  • AWorm
  • BTrojan
  • CRansomware
  • DKeylogger
Written answer2 marks

Explain how the Trojan in the scenario reaches the system and one harm it could cause.

Link the disguise to the user's action, then to an outcome.

Students type their answer here.

Multiple choice1 mark

Files are made inaccessible and a payment demand appears. Which type best fits?

  • AVirus
  • BWorm
  • CRansomware
  • DKeylogger
Written answer2 marks

Explain why paying a ransomware demand does not itself provide a reliable recovery plan.

Distinguish an attacker's promise from controlled restoration.

Students type their answer here.

Multiple choice1 mark

Which malware would most directly capture a password as it is typed?

  • AKeylogger
  • BWorm
  • CRansomware
  • DVirus

3. Use evidence from a scenario

Examination questions often describe behaviour without naming the malware. First identify the mechanism; then state a linked consequence. Do not award yourself a cause merely because the consequence sounds serious.

Written answer2 marks

A malicious program copies itself automatically from one unpatched school computer to others. Identify the malware type and explain your choice.

Use its independence and method of spread.

Students type their answer here.

Written answer2 marks

Describe two different impacts malware could have on a school.

Make the outcomes distinct and specific.

Students type their answer here.

Multiple choice1 mark

Which statement is accurate?

  • AEvery malware program is a virus.
  • BA Trojan must copy itself across a network.
  • CA keylogger can steal credentials by recording keystrokes.
  • DRansomware is a backup utility.

4. Retrieval: anti-malware

Anti-malware can use signatures for known malicious patterns and behaviour detection for suspicious actions. It may quarantine or remove threats. This was taught in 1CP2-P-4; here the important transfer is that current anti-malware reduces risk but cannot guarantee that every threat or human action is prevented.

Written answer2 marks

Explain why anti-malware should be kept up to date but should not be the school's only protection.

Link updates to recognition and give one remaining route or limitation.

Students type their answer here.

Multiple choice1 mark

Which pair is correctly matched?

  • ATrojan—standalone self-spread; worm—disguise
  • BRansomware—records keys; keylogger—demands payment
  • CVirus—attaches to a host; worm—standalone self-spread
  • DVirus—backup; ransomware—compression

Route forward

You can recognise all five required malware types from behaviour and explain their impact. Next you will examine how attackers exploit technical vulnerabilities such as unpatched software.