Community resourceWorksheet

J277 1.4.2 Preventing vulnerabilities

Part 2 of 3 · J277 1.4 · Network security

The seven controls in OCR J277 1.4.2, each linked to the risk it reduces and its limits.

Students will:

  • explain testing, anti-malware software and firewall filtering
  • distinguish passwords from account permissions
  • explain encryption and physical access controls
  • match a control to a stated vulnerability
  • explain why no single control removes every risk

Inside: 4 text sections, 1 multiple-choice activity, 2 completion activities, 7 written answers. 23 marks. Suggested teaching time: 45–65 minutes. 2 diagrams.

Includes a teacher guide with suggested sections, timings and common misconceptions.

Series: J277 1.4 · Network security, part 2 of 3.

Shared by Coding PathwayVerified teacher

  • 14 cells
  • About 60 minutes
  • CC BY-SA 4.0
  • Shared 17 Aug 2026
  • Updated 27 Oct 2026

Preview

The whole resource, exactly as a class sees it. Answers and marking are held back.

Reducing security risks

A control reduces a weakness, limits an attack or reduces its harm. Different controls address different risks. Choosing a control is useful only if it addresses the problem.

1. Find weaknesses, check software and filter traffic

ControlWhat it doesImportant limit
Penetration testingAn authorised simulated attack finds vulnerabilities and reports them.The organisation must act on the findings.
Anti-malwareScans files/programs, identifies malicious behaviour or known signatures, then may block, quarantine or delete malware.New threats may not be recognised; definitions need updating.
FirewallChecks incoming/outgoing network traffic against configured rules and blocks disallowed traffic.Permitted traffic can still contain a harmful file.
Finding a weakness is not fixing it An organisation authorises a simulated attack. The tester finds and reports a weakness. The organisation then fixes it. Penetration testing does not automatically remove every weakness. Authorised test Simulate an attack with permission. Find and report Identify an exploitable weakness. Act on the findings The organisation fixes the weakness. A report alone does not block attacks.
Fill in the blanks3 marks
An authorised simulated attack is Answer 1. Answer 2 scans for malicious software. A Answer 3 applies rules to network traffic.
  • anti-malware software
  • firewall
  • penetration testing
  • encryption
  • password
Written answer3 marks

A school receives downloaded files from outside its network. Describe how anti-malware software could reduce the risk from these files.

Students type their answer here.

Written answer3 marks

Describe how a firewall can reduce unauthorised network access.

Students type their answer here.

Written answer3 marks

An online shop arranges penetration testing before launching its website. Explain how this can improve security.

Students type their answer here.

2. Sign-in checks and permissions

A password checks knowledge of a secret before sign-in. Long, unpredictable passwords increase the possible combinations an attacker may have to try. Limits on repeated failed attempts can also slow guessing. A strong password can still be disclosed through phishing.

User access levels control what a signed-in account may view or change. Give each role only the permissions it needs. For example, read-only access lets students view a policy but not edit it. This limits damage if the account is misused.

Signing in and file permissions do different jobs A password check controls signing in. After signing in, a read-only permission lets an account view a file but not edit it. Authentication and permissions are separate stages. Can this user sign in? The password is checked. An account can then be used. What can the account do? Read-only permission for this file: view allowed; editing denied.
Fill in the blanks2 marks
A Answer 1 checks a secret before sign-in. Answer 2 decide which resources the signed-in account may view or change.
Written answer2 marks

Explain how using a long, unpredictable password makes a brute-force attack harder.

Students type their answer here.

Written answer2 marks

Students need to view a school policy file but must not change it. Explain how user access levels can meet this requirement.

Students type their answer here.

3. Data and equipment

Encryption turns readable plaintext into ciphertext using a key and algorithm. Someone who intercepts the ciphertext should not understand it without the correct key. Encryption does not stop copying or deleting it.

Physical security restricts direct access to equipment. Locks, access-controlled doors, locked cabinets and supervised access can reduce theft or tampering. CCTV can deter or help staff detect and respond to an intruder; a camera does not physically lock a door.

An organisation combines controls because a locked room, for example, does not prevent a remote phishing message.

Multiple choice1 mark

A school has installed a firewall. Why should it still use other security controls?

  • AA firewall makes all passwords public
  • BA firewall guarantees that no data can be intercepted
  • CDifferent controls address risks such as phishing, malicious files and physical theft
  • DThe firewall automatically replaces all user permissions
Written answer2 marks

Recommend one physical security measure for a server room and explain how it reduces the risk of equipment theft.

Students type their answer here.

Written answer2 marks

A company encrypts confidential data before sending it between offices. Explain how this protects the data if an attacker intercepts it.

Students type their answer here.

Review

Check one answer for a control, an action it performs and a matching security effect. Replace a vague ending such as ‘makes it safe’ with the actual result.