S4 ICT: Network Security And Data Protection (Paper 1 (basics))

S4 ICT: Network Security and Data Protection (Paper 1 (basics))

2026-11-14

Tutor Prep Guide · network security and data protection: password entropy and key spaces, phishing and social engineering, malware, firewall rules, symmetric and asymmetric encryption, hashing, two-factor authentication, 3-2-1 backup and quantified risk

S4 ICT: Network Security and Data Protection (Paper 1 (basics))

Paper 1 (basics): ten questions on network security and data protection, with answers and notes.

Direct answers　Level: S4 ICT; format: password space and entropy, phishing and social engineering, malware, firewall rules, encryption and hashing, 2FA, 3-2-1 backup.

01　Paper details (check answers afterwards)

Item	Detail
Questions	10
Suggested time	20
Difficulty mix	Foundation 3 · Intermediate 3 · Challenge 3 · Error redo 1
Chapter	Chapter: S4 ICT: Network Security and Data Protection
Level	S4

02　Questions (10 items)

FoundationHow many combinations does an eight-character password have if it uses only the 26 lower-case letters?
FoundationWhat is the approximate entropy, in bits, of that eight-character lower-case password?
FoundationHow many combinations does a four-digit PIN have?
IntermediateUsing upper case, lower case and digits (62 characters) for eight positions, how many combinations are there?
IntermediateWhat is the entropy of that 62-character-set password of eight positions?
IntermediateHow many bits and bytes does a SHA-256 hash output?
ChallengeHow long is an AES-256 symmetric key in bytes?
ChallengeWhat are the default port numbers for HTTPS and SSH?
ChallengeWhat do the three digits of the 3-2-1 backup rule stand for?
Error redoA student says hashing is just encryption and any tool can reverse it. What is wrong?

03　Answers and one-line notes

#	Answer	One-line note
1	208,827,064,576	26 to the power of 8 gives 208,827,064,576, which is far too many to try one by one.
2	38 bits	Each character adds log2(26), about 4.70 bits, so eight characters give about 37.6 bits, rounded to 38.
3	10,000	10 to the power of 4 is 10,000, which is exhausted in 1,000 seconds at ten tries a second.
4	218,340,105,584,896	62 to the power of 8 is 218,340,105,584,896, roughly a thousand times the lower-case-only space.
5	48 bits	log2(62) is about 5.95, so eight positions give about 47.6 bits, roughly ten more bits and therefore a thousand times harder.
6	256 bits, that is 32 bytes	256 divided by 8 is 32 bytes; the same input always gives the same digest and any change alters it completely.
7	32 bytes, that is 256 bits	256 bits divided by 8 is 32 bytes, and both sides must hold the same 32-byte key.
8	HTTPS uses 443 and SSH uses 22	HTTPS runs on 443, SSH on 22 and HTTP on 80; opening only the ports actually needed narrows the attack surface.
9	3 copies, 2 media types, 1 offsite or offline	Three copies on two different kinds of media with one kept offsite or offline, so ransomware cannot encrypt everything at once.
10	Wrong: a hash is one-way and the original cannot be recovered from the digest	Encryption is reversible but hashing is not; sites store only password hashes, which is why a forgotten password is reset rather than retrieved.

04　What to do after marking

After marking, redo only the wrong items and write down which step went wrong (formula, unit, or misread number).
Repeat the same item two days later; move to the next paper only when both attempts are correct.
Parents only need the answer and note columns; there is no need to explain every item.

For password strength, fix the character set then multiply by length, since each extra bit doubles the work; for phishing check the domain first, and after ransomware disconnect the network before restoring from an offline backup instead of guessing.Tutor Registration →

Questions and answers are written originally by the TutorZone team and are not taken from any school, publisher or examination authority paper. Every value is checked by computer.