Community resourceWorksheet

OCR H446 1.3.3 Network controls and layered protection

Part 6 of 10 · H446 1.3.3 · Networks

Having diagnosed threats in the previous worksheet, students here choose the protection. H446 1.3.3 expects a control to be justified by its mechanism against a plausible attack route, so every control proposed here also has to carry a limitation, which stops any single tool being presented as making a network secure.

Students will:

  • explain the mechanism by which a control blocks a particular attack route
  • state a realistic limitation for each control they propose
  • combine complementary controls into a layered defence for a described site
  • explain why a firewall-only or encryption-only answer leaves gaps open

Inside: 5 explanation cells, 1 multiple-choice question, 2 fill-in-the-blanks cells and 2 written answers. 28 marks, about 40 to 50 minutes.

Series: H446 1.3.3 · Networks, part 6 of 10.

Shared by Coding PathwayVerified teacher

  • 10 cells
  • About 45 minutes
  • CC BY-SA 4.0
  • Shared 31 Aug 2026
  • Updated 3 Sept 2026

Preview

The whole resource, exactly as a class sees it. Answers and marking are held back.

Network controls: layered protection

A control is only justified when its mechanism addresses a plausible route. Every control also has limits. Strong answers combine complementary controls instead of claiming that one tool makes a network secure.

Several boundaries, several controls

Layered network controls and their limitsdata and servicesaccess control, updates and anti-malwareencryption reduces readability if protected data is interceptedfirewall and proxy mediate selected network traffic/requestsEach control addresses some routes and has limits; several complementary layers reduce risk.

  • A firewall applies rules to selected network traffic, allowing or blocking it by configured criteria.
  • A proxy acts as an intermediary for requests and can filter, log or cache according to policy.
  • Encryption converts plaintext into ciphertext using a key so intercepted protected data is difficult to interpret without the required key.
  • Strong authentication/access control reduces unauthorised access; updates and anti-malware address known vulnerabilities and malicious software.

These mechanisms reduce risk; they do not guarantee prevention.

Worked control chain

Threat: a stolen backup is read by an unauthorised person.

Useful control: encrypt the backup and protect access to the decryption key. Mechanism: stored plaintext becomes unreadable ciphertext without the key. Limitation: encryption does not stop deletion, prevent a stolen authorised session or repair weak access controls.

A firewall is not the main control for an already stolen offline backup; choose from the actual attack path.

Multiple choice1 mark

Which statement about encryption is accurate?

  • AIt guarantees that a service cannot be denied
  • BIt reduces the readability of intercepted protected data but does not prevent every attack
  • CIt removes the need for authentication
  • DIt detects every phishing message
Fill in the blanks4 marks
A gap 1 filters network traffic by rules. A gap 2 intermediates requests. gap 3 protects data readability. Updated gap 4 can detect or remove known malicious code.
  • firewall
  • proxy
  • encryption
  • anti-malware
  • DNS
Written answer9 marks

A public library provides staff accounts, public Wi-Fi and an online catalogue. Propose three complementary controls. For each, name a threat, explain the mechanism and state one limitation.

Cover more than one route, for example traffic, credentials, malicious software, data in transit or unsafe requests.

Students type their answer here.

Apply the model independently

The remaining tasks change the context or reduce the support. Complete them without copying the worked model, then check that each explanation connects a mechanism to its consequence.

Written answer10 marks

A clinic sends confidential records between sites and exposes an appointment form. Recommend a layered defence addressing interception, unauthorised accounts, malicious software and unsafe form input. Explain why firewall-only and encryption-only plans are incomplete.

Use at least four controls. For SQL injection, discuss validation/parameterised handling at a safe conceptual level without exploit detail.

Students type their answer here.

Fill in the blanks4 marks
A firewall filters checkpoint gap 1. A proxy is an checkpoint gap 2. Encryption changes plaintext into checkpoint gap 3. Layered defence accepts that every control has a checkpoint gap 4.

Review your understanding

Before submitting, check that you can explain the main distinction in your own words, apply it in an unfamiliar context and justify each consequence rather than only naming a feature.