📚 Exam-style Case Study Questions for Unit 6: Security, Privacy and Data Integrity | 单元6考试式案例研究问题：安全、隐私与数据完整性
This article provides a comprehensive exam-style case study for Cambridge A-Level Computer Science Unit 6: Security, Privacy and Data Integrity. It presents a realistic business scenario followed by a series of structured questions that mirror the format and depth of the Cambridge examinations. Each question is accompanied by detailed answers that model the level of explanation, technical vocabulary and analytical thinking required to achieve high marks. By working through the case, you will reinforce key concepts such as malware types, encryption, digital certificates, authentication, data integrity, disaster recovery and privacy legislation.
本文为剑桥A-Level计算机科学第六单元（安全、隐私与数据完整性）提供一套完整的考试式案例研究。文章呈现一个真实的商业场景，随后给出与剑桥考试题型和深度匹配的系列问题。每个问题都配有详细的答案，示范了获取高分所需的解释水平、技术术语和分析思维。通过研习该案例，你将巩固恶意软件类型、加密、数字证书、身份验证、数据完整性、灾难恢复和隐私法规等关键概念。
1. The Case Study Background | 案例背景
TechNova Ltd is a medium-sized cloud storage provider that serves thousands of corporate clients. One morning, an accounts clerk received an email that appeared to come from a trusted supplier, asking him to download an attached invoice. The clerk opened the attachment, which immediately launched a hidden script. Within hours, the company's customer database was accessed remotely, and several records were altered—some clients’ contract details were changed, and backup files were partially overwritten. The attacker also defaced the corporate website, causing the browser to display an invalid certificate warning for visitors. Shortly afterwards, TechNova received an anonymous message demanding a large cryptocurrency payment in exchange for not leaking the stolen data. The company also discovered that its internal file server had been locked with a note demanding a separate ransom.
TechNova Ltd 是一家中型云存储提供商，服务于数千家企业客户。一天早上，一名会计职员收到一封似乎来自可信供应商的电子邮件，要求他下载一份附带的发票。该职员打开了附件，随即启动了一个隐藏脚本。数小时内，公司的客户数据库被远程访问，多条记录被篡改——部分客户的合同细节被修改，备份文件被部分覆盖。攻击者还篡改了公司网站，导致访客浏览器显示无效证书警告。不久后，TechNova 收到一条匿名消息，要求支付大额加密货币以换取不泄露被盗数据。公司还发现其内部文件服务器被锁定，并附有另一份勒索通知。
2. Question 1: Types of Malware | 问题1：恶意软件类型
Based on the case study, identify and explain two types of malware that could have been involved in the attack on TechNova. [4 marks]
根据案例研究，识别并解释可能涉及 TechNova 攻击的两种恶意软件类型。[4分]
The first type is a Trojan horse. The malicious code arrived disguised as a legitimate invoice attachment. When the employee executed the file, the Trojan installed a backdoor that allowed the attacker to gain remote access to the internal network, leading to the exfiltration and alteration of customer data.
第一种是特洛伊木马。恶意代码伪装成合法的发票附件到达。当员工执行该文件时，木马安装了后门，使攻击者能够远程访问内部网络，导致客户数据被窃取和篡改。
The second type is ransomware. The attacker locked the file server and demanded a ransom, which is a classic behaviour of ransomware. Encrypting files and demanding payment for the decryption key is a direct attempt to extort money from the organisation.
第二种是勒索软件。攻击者锁定了文件服务器并索要赎金，这是勒索软件的典型行为。加密文件并要求支付解密密钥的费用是直接向组织勒索钱财的企图。
3. Question 2: User Training and Phishing Prevention | 问题2：用户培训与防钓鱼措施
Suggest two measures TechNova should implement to reduce the risk of employees falling victim to phishing attacks in the future. [4 marks]
建议 TechNova 应采取的两项措施，以降低员工日后遭受钓鱼攻击的风险。[4分]
TechNova should introduce regular security awareness training that includes simulated phishing exercises. Employees would learn to identify suspicious sender addresses, unexpected attachments, and urgent or threatening language. Simulation tests reinforce this by providing immediate feedback when a user clicks on a simulated malicious link.
TechNova 应引入定期安全意识培训，其中包括模拟钓鱼演练。员工将学会识别可疑的发件人地址、意外的附件以及紧急或威胁性语言。模拟测试通过在用户点击模拟恶意链接时提供即时反馈来强化这一点。
Additionally, the company should deploy advanced email filtering that uses heuristic and behavioural analysis to block phishing emails before they reach users' inboxes. The filters can quarantine emails containing suspicious macros or links, and flag external emails with a clear warning banner.
此外，公司应部署高级电子邮件过滤，使用启发式和行为分析在钓鱼邮件到达用户收件箱前进行拦截。过滤器可将包含可疑宏或链接的邮件隔离，并为外部邮件添加清晰的警告横幅。
4. Question 3: Role of a Firewall | 问题3：防火墙的作用
Explain how a firewall could have mitigated the impact of the attack, and state two limitations of a firewall. [4 marks]
解释防火墙本可以如何减轻此次攻击的影响，并说明防火墙的两个局限性。[4分]
A properly configured firewall could have blocked outbound traffic to the attacker's command-and-control server, preventing the exfiltration of data. It could also have inspected packets to detect and block unauthorised remote access attempts, thereby limiting the attacker's ability to pivot within the network.
配置得当的防火墙可以阻止出站流量到达攻击者的指挥与控制服务器，从而防止数据外泄。它还可以检查数据包以检测并阻止未经授权的远程访问尝试，从而限制攻击者在网络内横向移动的能力。
However, a firewall cannot prevent an attack that originates from inside the network, such as an employee opening a malicious attachment. It is also ineffective against encrypted traffic that cannot be inspected by a basic packet-filtering firewall, or against attacks that exploit zero-day vulnerabilities for which signatures are not yet available.
然而，防火墙无法阻止源自网络内部的攻击，比如员工打开恶意附件。它对于无法被基本数据包过滤防火墙检查的加密流量也无效，或者对于利用尚无签名的零日漏洞发起的攻击也无能为力。
5. Question 4: Encryption for Data Protection | 问题4：数据加密保护
Describe how both symmetric and asymmetric encryption could be used to protect customer data stored on TechNova's servers. [6 marks]
描述对称加密和非对称加密如何分别用于保护存储在 TechNova 服务器上的客户数据。[6分]
Symmetric encryption uses a single secret key to both encrypt and decrypt data. For stored customer records, a symmetric algorithm such as AES (Advanced Encryption Standard) would be efficient at encrypting large volumes of data. The key must be kept secure and shared only between authorised services; if the server is compromised but the key is not on the same system, the stolen data remains unreadable.
对称加密使用单一密钥进行加密和解密。对于存储的客户记录，像 AES（高级加密标准）这样的对称算法可以高效地加密大量数据。密钥必须安全保存，且仅在授权服务之间共享；如果服务器被攻破但密钥不在同一系统上，被盗数据将无法读取。
Asymmetric encryption employs a public/private key pair. It could be used to protect data in transit between clients and the cloud storage. A customer encrypts data with TechNova's public key, and only the private key held by TechNova can decrypt it. This ensures that even if an attacker intercepts the transmission, they cannot decipher the data without the private key.
非对称加密使用公钥/私钥对。它可以用于保护客户端与云存储之间传输的数据。客户使用 TechNova 的公钥加密数据，只有 TechNova 持有的私钥才能解密。这样即使攻击者拦截了传输，没有私钥也无法破译数据。
A hybrid approach is often used: a symmetric session key is exchanged via asymmetric encryption, combining the speed of symmetric encryption with the secure key exchange of asymmetric cryptography.
通常采用混合方式：通过非对称加密交换对称会话密钥，从而结合对称加密的速度和非对称加密的安全密钥交换优势。
6. Question 5: SSL/TLS and Digital Certificates | 问题5：SSL/TLS与数字证书
Explain the role of SSL/TLS and digital certificates in preventing website defacement or certificate spoofing, as experienced by TechNova. [6 marks]
解释 SSL/TLS 和数字证书在防止 TechNova 遭遇的网站篡改或证书欺骗中所起的作用。[6分]
SSL/TLS provides a secure encrypted channel between a web server and a browser. It uses a handshake process in which the server presents a digital certificate containing its public key and identity information. The browser verifies the certificate against a list of trusted Certificate Authorities (CAs). If the attacker replaced the certificate with a fake one, the browser would detect that it was not signed by a trusted CA and display a warning, alerting users.
SSL/TLS 在网络服务器与浏览器之间提供安全的加密通道。它采用握手过程，服务器出示包含其公钥和身份信息的数字证书。浏览器根据受信任的证书颁发机构 (CA) 列表验证该证书。如果攻击者用假证书替换了原证书，浏览器会检测到该证书未由受信任的 CA 签署，从而显示警告，提醒用户。
Digital certificates also enable authentication of the website's identity. Certificate pinning and Extended Validation (EV) certificates make it harder for an attacker to spoof the site. Furthermore, TLS ensures data integrity: any modification of the page content during transmission would be detected because the message authentication code (MAC) would not verify.
数字证书还能实现对网站身份的认证。证书固定和扩展验证 (EV) 证书使得攻击者更难冒充该网站。此外，TLS 确保数据完整性：传输过程中页面内容的任何篡改都会因为消息认证码 (MAC) 无法验证而被检测到。
7. Question 6: Ensuring Data Integrity | 问题6：确保数据完整性
Explain two methods TechNova could use to verify that customer records have not been tampered with during storage or transmission. [4 marks]
解释 TechNova 可用于验证客户记录在存储或传输过程中未被篡改的两种方法。[4分]
Hashing is a one-way function that produces a fixed-length hash value from data. TechNova could generate a hash—using a secure algorithm like SHA-256—of each customer record and store it separately. To verify integrity, the hash is recalculated and compared with the stored value; any difference indicates tampering.
哈希是一种单向函数，从数据生成固定长度的哈希值。TechNova 可以为每条客户记录生成一个哈希值（使用 SHA‑256 等安全算法），并单独存储。为验证完整性，重新计算哈希并与存储值比较；任何差异都表明数据被篡改。
Checksums or digital signatures can also be used for transmission. A checksum (e.g., CRC) is appended to a message block. The receiver recalculates it and compares it to the sent value. More robustly, a digital signature signed with the sender's private key provides both integrity and non-repudiation, as only the correct private key could have created it.
校验和或数字签名也可用于传输。校验和（如 CRC）附加在消息块后。接收方重新计算并与发送值比较。更稳健的方法是，使用发送方私钥签署的数字签名同时提供完整性和不可否认性，因为只有正确的私钥才能生成该签名。
8. Question 7: Authentication Methods | 问题7：身份验证方法
Recommend two authentication techniques TechNova can implement to prevent unauthorised access to its cloud storage platform, giving reasons for your choices. [5 marks]
推荐 TechNova 可采用的两项身份验证技术以防止对云存储平台的未授权访问，并说明理由。[5分]
Multi-factor authentication (MFA) should be mandated for all user accounts. It combines something the user knows (a password) with something the user has (a one-time code from an authenticator app) or something the user is (a fingerprint). This drastically reduces the risk of account compromise, even if a password is stolen, because the attacker would still need the second factor.
应强制所有用户账户使用多因素身份验证 (MFA)。它结合了用户知道的信息（密码）、用户拥有的物品（身份验证器应用生成的一次性代码）或用户本身的特征（指纹）。这极大地降低了账户被盗的风险，因为即使密码被窃取，攻击者仍需第二个因素。
Biometric authentication, such as fingerprint or facial recognition, could be implemented for high-privilege administrator accounts. Biometrics are difficult to replicate and cannot be forgotten, providing a strong level of assurance that only authorised personnel access sensitive configuration panels.
对于高权限管理员账户，可实现生物特征认证，如指纹或面部识别。生物特征难以复制且不会遗忘，能提供强有力的保障，确保只有授权人员访问敏感的配置面板。
9. Question 8: Backup and Disaster Recovery | 问题8：备份与灾难恢复
Design a backup strategy for TechNova to minimise data loss in a similar future attack, describing the type of backups and the recovery procedure. [6 marks]
为 TechNova 设计一个备份策略，以将未来类似攻击中的数据损失降至最低，描述备份类型和恢复流程。[6分]
TechNova should adopt the 3-2-1 backup rule: keep at least three copies of data, on two different media, with one copy stored off-site or in the cloud. A combination of full backups (weekly) and incremental backups (daily) would minimise both storage usage and recovery time.
TechNova 应采用3-2-1 备份原则：至少保留三份数据拷贝，使用两种不同介质，其中一份异地或云端存储。结合全量备份（每周）和增量备份（每日）可最大程度减少存储占用和恢复时间。
Daily incremental backups capture only changes since the last backup. In the event of a ransomware attack, the company would restore the most recent full backup and then apply all subsequent incremental backups up to the point just before the attack. The recovery process must be tested regularly, and backups must be stored on an immutable medium or with write-once-read-many (WORM) protection so that ransomware cannot encrypt the backup files.
每日增量备份仅捕获自上次备份以来的更改。一旦遭受勒索软件攻击，公司将恢复最新的全量备份，然后依次应用攻击之前的所有后续增量备份。恢复流程必须定期测试，备份应存储在不可变介质上或采用一次写入多次读取 (WORM) 保护，确保勒索软件无法加密备份文件。
10. Question 9: Privacy Legislation | 问题9：隐私法规
Discuss how privacy legislation such as the GDPR would influence TechNova's handling of the data breach and its obligations to customers. [6 marks]
讨论如 GDPR 等隐私法规将如何影响 TechNova 对此次数据泄露的处理及其对客户的义务。[6分]
Under the GDPR (General Data Protection Regulation), TechNova, as a data controller, must report the personal data breach to the relevant supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. It must also communicate the breach to affected customers without undue delay if there is a high risk to their rights.
根据《通用数据保护条例》(GDPR)，TechNova 作为数据控制者，必须在意识到个人数据泄露后 72 小时内向相关监管机构报告，除非该泄露不太可能对个人权利和自由构成风险。如果对客户的权利存在高风险，还必须无不当延误地将泄露情况告知受影响客户。
The company is obliged to explain the nature of the breach, the likely consequences, and the measures taken or proposed to mitigate it. Failure to comply can lead to fines of up to €20 million or 4% of annual global turnover. The regulation also reinforces data minimisation and purpose limitation: TechNova must review its data collection practices and ensure it only retains customer data that is necessary, thereby reducing the impact of future breaches. It must also implement privacy by design and conduct data protection impact assessments for high-risk processing activities.
公司有义务解释泄露的性质、可能的后果以及已采取或建议采取的缓解措施。不遵守可能导致高达 2000 万欧元或全球年营业额 4% 的罚款。该法规还强化了数据最小化和目的限制原则：TechNova 必须审查其数据收集实践，确保只保留必要的客户数据，从而降低未来泄露的影响。它还必须实施设计隐私保护，并对高风险处理活动进行数据保护影响评估。
Published by TutorHao | Computer Science Revision Series | aleveler.com
更多咨询请联系16621398022（同微信）
或截图后用「扫一扫 → 相册」选择本图