S4 ICT: Network Security And Data Protection (Paper 2 (intermediate))

S4 ICT: Network Security and Data Protection (Paper 2 (intermediate))

2026-11-14

Tutor Prep Guide · network security and data protection: password entropy and key spaces, phishing and social engineering, malware, firewall rules, symmetric and asymmetric encryption, hashing, two-factor authentication, 3-2-1 backup and quantified risk

S4 ICT: Network Security and Data Protection (Paper 2 (intermediate))

Paper 2 (intermediate): ten questions on network security and data protection, with answers and notes.

Direct answers　Level: S4 ICT; format: password space and entropy, phishing and social engineering, malware, firewall rules, encryption and hashing, 2FA, 3-2-1 backup.

01　Paper details (check answers afterwards)

Item	Detail
Questions	10
Suggested time	20
Difficulty mix	Foundation 3 · Intermediate 3 · Challenge 3 · Error redo 1
Chapter	Chapter: S4 ICT: Network Security and Data Protection
Level	S4

02　Questions (10 items)

FoundationHow many combinations does a twelve-character lower-case password have?
FoundationWhat is the entropy of that twelve-character password?
FoundationAt a billion guesses per second, about how many years are needed to exhaust every twelve-character lower-case password?
IntermediateWhat entropy does a twelve-character, 62-character-set password reach?
IntermediateWhat is the purpose of salting passwords stored in a database?
IntermediateWhich two factor categories must double authentication combine?
ChallengeCopying a 500 GB full backup at 100 MB/s takes about how many minutes?
ChallengeWhat is the standard way to produce a digital signature?
ChallengeUnder a default-deny firewall that only permits outbound HTTPS and SSH, how many allow rules are needed?
Error redoA student says a site with HTTPS is trustworthy and safe for entering a password. What is wrong?

03　Answers and one-line notes

#	Answer	One-line note
1	95,428,956,661,682,176	26 to the power of 12, larger than the eight-character version by 26 to the fourth, about 457,000 times.
2	56 bits	4.70 times 12 gives about 56.4 bits, and every extra bit doubles the work for an attacker.
3	About 1105 days, that is roughly 3.0 years	26 to the power of 12 divided by a billion is about 95,428,957 seconds, that is about 1,104.5 days or roughly 3 years.
4	About 71 bits	5.95 times 12 gives about 71.45 bits, some fifteen bits more than the lower-case version of the same length.
5	Each account gets a unique random value so rainbow tables and precomputed attacks fail	With a salt the same password hashes differently in different accounts, so an attacker cannot build one table to crack the whole site.
6	Something you know plus something you have, such as a password plus a one-time code	The two factors must come from different categories; a password plus another password is not two-factor authentication.
7	About 85 minutes, roughly 1 hour 25 minutes	500 times 1,024 is 512,000 MB, divided by 100 gives 5,120 seconds, about 85.3 minutes.
8	Hash the document first, then encrypt that digest with the sender private key	The receiver decrypts the digest with the sender public key and recomputes it; matching values prove integrity and origin.
9	2	One for 443 and one for 22, with everything else denied; fewer rules mean fewer accidental holes.
10	Wrong: phishing sites can also obtain certificates and serve HTTPS	HTTPS only proves the channel is encrypted and the certificate matches the domain, not that the owner is honest; the domain and the request still have to be checked.

04　What to do after marking

After marking, redo only the wrong items and write down which step went wrong (formula, unit, or misread number).
Repeat the same item two days later; move to the next paper only when both attempts are correct.
Parents only need the answer and note columns; there is no need to explain every item.

For password strength, fix the character set then multiply by length, since each extra bit doubles the work; for phishing check the domain first, and after ransomware disconnect the network before restoring from an offline backup instead of guessing.Tutor Registration →

Questions and answers are written originally by the TutorZone team and are not taken from any school, publisher or examination authority paper. Every value is checked by computer.