中文（繁體）
中文（简体）
English
S6 ICT | Network Security and Encryption Practice Paper 3 (Hashing, Attacks and Risk Management)
S6 ICT | Network Security and Encryption Practice Paper 3 (Hashing, Attacks and Risk Management)
Ten items from the 64 hexadecimal characters of SHA-256 through salting, MITM, DDoS and backup RPO, practising one full detect-defend-recover line of reasoning.
Attempt first, mark afterwards Allow thirty to thirty-five minutes; classify each item as confidentiality, integrity or availability before answering.
01 Paper details (check answers afterwards)
| Item | Detail |
|---|---|
| Questions | 10 items |
| Suggested time | About 35 minutes |
| Difficulty mix | Foundation 4 · Intermediate 3 · Challenge 2 · Error redo 1 |
| Chapter | Chapter: S6 ICT | Network Security and Encryption |
| Level | S6 (Secondary 6) ICT |
02 Questions (10 items)
- FoundationSHA-256 produces a 256-bit output. How many hexadecimal characters is that?
- FoundationWhat is the key difference between hashing and encryption?
- FoundationTwo documents differ by a single character. How do their SHA-256 values relate?
- FoundationWhich two guarantees does an HMAC provide?
- IntermediateStoring password hashes with a different salt per user imposes what extra cost on an attacker?
- IntermediateHow does a man-in-the-middle (MITM) attack typically work on open public Wi-Fi?
- IntermediateA fake bank email that tricks the recipient into typing a password belongs to which threat category?
- ChallengeA distributed denial of service (DDoS) attack mainly damages which element of the CIA triad?
- ChallengeBackup plan: one full backup of 100 GB then daily increments of 5 GB kept for 7 days. What is the total size, and what is the RPO with a single daily backup?
- Error redoError drill: a student says a top-grade firewall is enough and staff training can be skipped. Why is that wrong?
03 Answers and one-line notes
| # | Answer | One-line note |
|---|---|---|
| 1 | 64 characters | 256 / 4 = 64, since each hexadecimal character carries 4 bits. |
| 2 | A hash is a one-way function that cannot be reversed, while encryption can be undone with the key | That is why passwords are stored as hashes rather than ciphertext: the system compares hashes and never needs the original password. |
| 3 | They are completely different, with most bits changed (the avalanche effect) | A good hash spreads any tiny input change across the whole digest, so one altered character still fails an integrity check. |
| 4 | Message integrity, plus proof that the message came from a party holding the key (authentication) | An HMAC mixes a key into the hash, so without the key the same value cannot be produced, which blocks both tampering and impersonation. |
| 5 | One precomputed table can no longer cover all accounts; work must be redone per salt, so cost grows with the number of accounts | A shared salt lets a single table break everyone, while unique salts kill precomputation and force per-account effort. |
| 6 | The attacker poses as the hotspot or gateway, relaying traffic between both sides while reading or altering it | Both sides believe they talk directly; without encryption or certificate checks there is no way to notice the third party in between. |
| 7 | Phishing, a form of social engineering rather than malware | Phishing exploits trust and may involve no malicious code at all, so awareness and checking URLs matter more than antivirus. |
| 8 | Availability | A DDoS need not steal or alter data; making the service unresponsive is enough, which targets availability. |
| 9 | 135 GB, with an RPO of 24 hours | 100 + 5 x 7 = 135 GB; one backup a day means up to a full day of data can be lost, so the RPO is 24 hours. |
| 10 | Phishing and weak passwords bypass firewalls, and people are usually the weakest link, so least privilege and training are equally necessary | Technical controls only cover known channels; stolen credentials, USB drives and insider mistakes need policy and awareness to close. |
04 What to do after marking
- After marking, redo only the wrong items and write down which step went wrong (formula, unit, or misread number).
- Repeat the same item two days later; move to the next paper only when both attempts are correct.
- Parents only need the answer and note columns; there is no need to explain every item.
Need a tutor for this chapter? Register hereTutor Registration →
Questions and answers are written originally by the TutorZone team and are not taken from any school, publisher or examination authority paper. Every value is checked by computer.