OCR AAQ Cyber Security F193 & F194 Revision Notes

Topic 1 - The cyber security landscape

1.1.1 Cyber security: definition and importance

Cyber security is the practice of protecting digital systems, networks, devices, data and information from unauthorised access, damage, theft and disruption.

Importance for individuals

Protects personal data and privacy. Prevents identity theft and financial loss. Keeps online accounts, photos and messages under the account holder's control. Protects personal safety from stalking, harassment and blackmail.

Importance for organisations

Protects customer data, financial records and intellectual property. Maintains business continuity and trading. Protects reputation and customer confidence. Required for legal compliance with UK GDPR and the DPA. Avoids fines, ransom payments and recovery costs.

Importance for society

Protects critical national infrastructure: power, water, healthcare, transport, banking and defence. Failures here risk public safety, not just money. Maintains trust in digital services and in online democracy.

Devices and everyday activities are more connected than ever, so more data is created, transmitted and stored. That increases the number of ways data can be accessed, destroyed or used without the owner knowing.

The unit is assessed through a scenario that develops through the paper. Whenever you define a term, add a sentence that ties it to the organisation in the scenario, because PO2 marks are for application, not recall.

1.1.2 The CIA triad

The CIA triad is the three-part model used to describe the goals of any security system: Confidentiality, Integrity and Availability.

Confidentiality

Only authorised people can access the data. Applied with encryption, access rights, passwords, 2FA, levels of privilege and secure disposal of media.

Integrity

Data is accurate, complete and unaltered except by authorised change. Applied with hashing and checksums, validation, version control, audit logs and digital signatures.

Availability

Data and systems are accessible to authorised users when they are needed. Applied with backups, redundancy, failover, load balancing, UPS and DDoS protection.

Why maintaining all three matters: losing confidentiality exposes personal or classified data; losing integrity means decisions are made on wrong data and records cannot be trusted as evidence; losing availability stops the organisation trading. The three also pull against each other, so security design is a balance. Heavy encryption strengthens confidentiality but harms availability if a key is lost, and wide open access improves availability while destroying confidentiality.

Do not just list the three words. Marks come from saying which element a control protects and how, for example "a daily offsite backup protects availability because data can be restored after ransomware encrypts the live copy".

1.1.3 IAAA principles

IAAA is the four-stage framework that controls and records who gets to do what on a system.

Identification

The user claims an identity, for example typing a username, presenting a swipe card or giving an employee ID. No proof is offered at this stage.

Authentication

The user proves the claimed identity using something they know (password, PIN), something they have (token, phone, smart card) or something they are (biometrics). Combining factors gives 2FA or MFA.

Authorisation

The system grants the authenticated user rights to specific resources and actions, based on their role and the principle of least privilege.

Accountability

Every action is logged and auditable so it can be traced back to an individual. Supports non-repudiation, investigations and digital forensics.

Purpose: to make sure only known users get in, that they only reach what their role needs, and that every action leaves a traceable record.

Benefits: blocks unauthorised access; limits the damage of a compromised account because privileges are restricted; deters insider misuse because users know actions are logged; provides the audit trail needed for an incident report or a legal case; supports compliance with UK GDPR and ISO 27001.

1.1.4 Risk management

Purpose of risk management: to identify what could go wrong, judge how bad it would be and how likely it is, then reduce that risk to a level the organisation is willing to accept, using a limited budget.

Threat

Anything with the potential to cause harm to a system, for example ransomware, a flood, a disgruntled employee or a nation state actor.

Vulnerability

A weakness that a threat can exploit, for example unpatched software, a weak password policy, a propped-open fire door or untrained staff.

Impact

The harm caused if the threat exploits the vulnerability: financial loss, data loss, downtime, reputational damage, fines, risk to safety.

Probability

How likely the event is, judged from past incidents, threat intelligence and how exposed the asset is. Risk is normally scored as impact multiplied by probability and plotted on a risk matrix.

Identifying threats and vulnerabilities: asset inventories, vulnerability scanning and penetration testing, audits of policies and of physical access, staff reporting, supplier assessments, threat intelligence feeds, and reviews of past incidents.

The risk management process:

Identify the assets that matter: data, devices, services and people.
Identify the threats to each asset and the vulnerabilities they could exploit.
Assess the impact and the probability of each risk and score it.
Prioritise, highest risk first, comparing the cost of the control against the cost of the incident.
Choose a response: treat (add mitigations), tolerate (accept), transfer (insure or outsource) or terminate (stop the activity).
Implement the mitigations and record them in a risk register.
Monitor, test and review regularly, because threats and systems keep changing.

Proactive mitigations

Put in place before an incident, to stop it happening or reduce its impact: patching, firewalls, anti-malware, staff training, access controls, backups, penetration testing, redundancy.

Reactive mitigations

Used after an event is detected: isolating infected devices, following incident response procedures, restoring from backup, disaster recovery, patching the exploited hole, notifying the ICO and affected customers.

Benefits: a limited budget is spent where risk is highest; the likelihood and impact of incidents fall; the organisation is prepared and recovers faster; compliance is evidenced and insurance can be cheaper; stakeholder confidence improves.

Limitations: it takes time, money and expertise; scores are estimates and can be wrong; it cannot predict every threat, including zero-day exploits; it is out of date as soon as the system changes, so it needs constant review; risk can be reduced but never removed.

1.2 Types of cyber security incidents

Destruction of data

Data is permanently deleted or corrupted so it cannot be recovered, through wiper malware, a formatted drive, a fire or flood, or a user deleting records. Done for sabotage, to cover tracks, or out of revenge. Attacks integrity and availability.

Environmental / physical

Damage from fire, flood, earthquake, storm, power loss or overheating, plus physical acts such as stolen or smashed hardware. Usually accidental, though it can be deliberate sabotage.

Inaccessibility of data

The data still exists but cannot be reached: ransomware encryption, a DoS or DDoS attack, a failed server, a lost encryption key or a locked account. Done for extortion or disruption. Attacks availability.

Information disclosure

Data is revealed to people who should not see it, through a breach, a misconfigured cloud store, an email sent to the wrong person or a lost laptop. Done for espionage, to resell the data, or to embarrass the target. Attacks confidentiality.

Modification of data

Data is altered without authorisation, for example changing bank details on an invoice, editing grades or tampering with logs. Done for fraud, sabotage, or to hide evidence. Attacks integrity.

Theft

Data, money or hardware is taken. The spec names four targets of theft: finance (card details, fraudulent transfers), identity (personal data used to impersonate), industrial secrets (designs, formulas, source code, client lists) and military secrets (defence plans, weapons and deployment data).

Unauthorised access / hacking

Someone gains entry to a system, account or area they have no right to use, by exploiting a vulnerability, using stolen credentials or walking through an unlocked door. Often the first step that enables every other incident type.

Accidental incidents have no malicious intent: an email sent to the wrong recipient, a spilled drink, a deleted folder, a lost USB stick, a misconfigured permission, a builder cutting a fibre line.

Deliberate incidents are intentional acts: ransomware, phishing campaigns, insider data theft, DDoS attacks, sabotage of hardware. Both types are reportable incidents and both can breach UK GDPR.

Examiners often ask you to categorise an incident from the scenario. Name the incident type, say whether it was accidental or deliberate, and state which part of the CIA triad it damaged.

1.3.1 Targets: human

Target	How they are targeted	Why they are targeted
Individuals	Phishing and smishing messages, fake websites and shopping scams, social engineering phone calls, malware on personal devices, weak or reused passwords, public Wi-Fi, oversharing on social media.	Bank and card details, personal data for identity theft, account credentials to resell, and devices to add to a botnet. Individuals usually have the weakest defences and the least training, and an employee is also a route into their employer.
Organisations	Spear phishing of named staff, ransomware, DDoS, exploiting unpatched public-facing servers, insiders, third party and supplier access, stolen credentials.	Money and ransom payments, large volumes of customer data, intellectual property and industrial secrets, competitive advantage, disruption of a rival or a disliked company, and use as a stepping stone into their customers.
Nation states	Long-running, well-funded campaigns against government and critical national infrastructure, espionage against defence and research, disinformation, supply chain compromise, zero-day exploits.	Military and political advantage, intelligence gathering, economic gain and theft of research, destabilising an opponent, retaliation for sanctions or earlier attacks, and the ability to disrupt power, water or transport during a conflict.

The spec says this section "does not include details of methods of attack". Answer at the level of who is targeted and why, and save the technical detail for Topic 2.

1.3.2 Targets: system

Data and information is targeted by classification and by state:

Business data

Contracts, plans, pricing, client lists. Valuable to competitors and to anyone wanting leverage over the organisation.

Classified data

Government, defence or otherwise restricted material. Targeted by nation states and cyber terrorists for espionage.

Financial data

Card details, payroll, bank records, invoices. Directly convertible into money or fraud.

Personal data

Names, addresses, dates of birth, medical records. Used for identity theft and resale, and its loss triggers UK GDPR duties.

Public data

Already published, so it is not a confidentiality target, but it is a target for modification such as website defacement, and a source of OSINT that supports a later attack.

Data at rest

Stored on drives, servers, backups and mobile devices. Attacked through theft of hardware, unauthorised access and ransomware. Protected by encryption at rest and access controls.

Data in transit

Moving across a network or the internet. Attacked by interception, packet sniffing and man in the middle. Protected by HTTPS, TLS/SSL and VPNs.

Infrastructure: devices. Consoles, desktops, laptops, smartphones and tablets or hybrids are targeted because they hold credentials and data, are often used off-site, and are the easiest place to trick a user. Portable devices add the risk of loss and theft.

Infrastructure: servers. Servers are high value because one machine serves many users:

Database server

Holds the bulk of structured personal and financial records. Prime target for data theft and modification.

File server

Central store of documents. One compromise reaches every shared file, which is why ransomware targets it.

Hypervisor

Runs many virtual machines. Compromising it exposes every guest VM at once.

Mail server

The gateway for phishing coming in and data going out, and a rich source of contacts and message content.

Network server

Controls authentication, DHCP and DNS. Control here gives control of the whole network.

Web server

Public-facing, so it is reachable by everyone. Targeted for defacement, DDoS and as an entry point into the internal network.

Networking and communications. Wired links can be tapped, but that needs physical access to cable, patch panels or switches. Wireless links can be reached from outside the building, so they are attacked through weak encryption, rogue access points and evil twin networks. Routers, switches and access points are themselves targets because they carry all traffic.

Data storage location. Onsite storage is under the organisation's own physical and logical control, but it carries the full cost of protection and is exposed to local disasters. Cloud storage moves some responsibility to the provider, but adds an internet-facing account that can be misconfigured or have its credentials stolen.

Private cloud

Dedicated to one organisation. Most control and strongest isolation, highest cost.

Public cloud

Shared, multi-tenant infrastructure. Cheap and scalable, least control, shared attack surface.

Hybrid cloud

Sensitive data kept private, bulk or bursty workloads in the public cloud. Complexity is the weak point.

Community cloud

Shared by organisations with common needs, such as NHS trusts or councils. Shared cost and standards, but trust depends on every member.

1.4.1 Actors

Competitor

A rival business seeking industrial secrets, pricing, designs or customer lists, or wanting to disrupt trading. Well funded, and may hire others so the attack cannot be traced back.

Cyber criminal

Organised and financially motivated. Runs ransomware, fraud and data theft at scale, often as a business with support staff and affiliates. Skilled and persistent.

Cyber terrorist

Attacks to cause fear, harm or disruption in support of an ideological or religious cause. Targets critical national infrastructure and public services, and wants visible impact.

Hacker: white hat

Ethical. Tests systems with permission and reports weaknesses so they can be fixed, for example a penetration tester.

Hacker: grey hat

Breaks in without permission but usually without malicious intent, then discloses the flaw, sometimes asking for a fee. Still illegal under the Computer Misuse Act.

Hacker: black hat

Breaks in illegally for personal gain or to cause damage. Steals, destroys or sells data and access.

Hacktivist

Politically or socially motivated. Uses defacement, DDoS and leaks to publicise a cause and embarrass the target, rather than to make money.

Insider

A current or former employee, contractor or supplier with legitimate access. Dangerous because they already have credentials and know where the valuable data is. Can be malicious or simply negligent.

Nation state

Government-backed group with very large resources, patience and skill. Runs long-term espionage and infrastructure attacks, often using zero-day exploits, and is hard to attribute.

Phisher

Sends deceptive emails, texts or messages impersonating a trusted sender to harvest credentials or payment details. Relies on volume and on urgency in the wording.

Scammer

Uses deception and social engineering to trick victims into handing over money or data directly, for example fake support calls, romance scams and investment scams.

Script kiddie

Low skill. Uses ready-made tools and scripts written by others, usually for thrill, status or curiosity rather than a plan. Unpredictable, and can still cause real damage.

1.4.2 Motivations

Accidental: there is no intent to cause harm. Caused by human error, lack of training or ignoring a procedure, for example emailing a spreadsheet to the wrong address or losing an unencrypted USB stick. It is still a reportable incident with real impact.

Intentional motivations named in the spec:

Espionage

Stealing secrets for advantage: industrial designs and research, or state and military intelligence. Long-term, quiet, and successful only if it stays undetected.

Revenge: right a perceived wrong

The attacker believes the target has behaved unfairly or unethically and acts to punish it. Common with hacktivists and dismissed employees.

Revenge: score settling

A personal grudge against an individual or an employer. Often an insider, and often aimed at data or systems the attacker knows are valuable.

Publicity

The attack is meant to be seen. Defacement, leaks and boasting online raise the profile of a cause or the reputation of the attacker.

Fraud

Deceiving people or systems for financial gain: invoice fraud, fake payments, account takeover and identity theft.

Thrill

Excitement, curiosity, or proving it can be done. Typical of script kiddies. Damage is often incidental rather than planned.

Income generation

The attack is a business: ransomware payments, selling stolen data on dark web markets, cryptomining, and selling access to compromised systems as a service.

Political gain

Influencing elections, policy or public opinion, discrediting opponents, or weakening another state through disruption and disinformation.

Questions frequently pair an actor with a motivation. Justify the link, for example "a hacktivist defaced the site rather than stealing the data because the motivation is publicity for the cause, not income generation".

Topic 2 - Cyber security vulnerabilities

2.1 Vulnerability vectors

A vulnerability vector is the route an attacker uses to reach data or a system. The spec expects you to explain how access can be gained through each one, and to weigh its advantages and disadvantages for the organisation that uses it.

Vector	How access is gained	Advantages and disadvantages
Cloud	Stolen or reused account credentials, misconfigured storage left public, weak or missing MFA, insecure APIs, and attacks on the shared platform itself.	Advantages: provider handles patching and physical security, data is available anywhere, backups and scaling are built in. Disadvantages: internet-facing by design, control is handed to a third party, one credential leak exposes everything, and a provider outage takes the data with it.
Direct access to the network	Plugging a device into a live wall port or switch, using an unlocked and unattended workstation, connecting a rogue device, or accessing server rooms and comms cabinets.	Advantages: fast and reliable for staff, easy to monitor because it needs presence on site. Disadvantages: bypasses perimeter defences completely, and often gives trusted internal access straight away.
Email and social media	Phishing and spear phishing, malicious attachments and links, spoofed senders, and profile information used to research and impersonate staff.	Advantages: essential for communication and marketing, cheap and instant. Disadvantages: the single most common entry route, relies entirely on user judgement, and oversharing hands attackers free reconnaissance.
Removable media	Infected USB sticks and external drives, deliberately dropped devices, and data copied out by an insider.	Advantages: cheap, portable, works with no network. Disadvantages: easily lost or stolen, can carry malware straight past the firewall, and is hard to track once data leaves the building.
Third party access (suppliers and vendors)	Compromise of a supplier that already has legitimate access, malicious updates in the supply chain, and remote support links left open.	Advantages: gives access to expertise and support the organisation does not have in-house. Disadvantages: the organisation inherits the supplier's weaknesses and has little control over their security.
Third party access (workers)	Contractors, agency staff and cleaners with physical or account access, often with weaker screening and no training.	Advantages: flexible staffing and specialist skills at short notice. Disadvantages: temporary accounts are often over-privileged and left active after the contract ends.
Wireless networks	Cracking weak encryption such as WEP or WPA, default router passwords, rogue access points and evil twin hotspots, and interception on public Wi-Fi.	Advantages: mobility, low cabling cost, easy to add devices and guests. Disadvantages: the signal leaves the building so it can be attacked without entering it, and it is easier to intercept than cable.

2.2.1 Physical vulnerabilities: human based

People are the most exploited weakness in any system. The spec splits human vulnerabilities into mistakes, manipulation and deliberate acts.

Not following policies

Staff ignore rules they find inconvenient: sharing logins, writing passwords down, using personal cloud storage, propping fire doors open. The control exists but is not applied, so the organisation believes it is protected when it is not.

Competency levels

Staff lack the knowledge or training to spot a phishing email, configure a firewall correctly or handle data safely. Mistakes are made in good faith and often go unnoticed.

Poor policies

Policies are missing, vague, out of date or unenforced, for example no BYOD rules and no password standard. Staff then make their own decisions, inconsistently.

Poor screening

Weak vetting, references and DBS or background checks let unsuitable people into trusted roles, including people planted deliberately to gain access.

Poor data habits

Leaving screens unlocked, printing sensitive documents and leaving them on the printer, discussing work in public, emailing files to personal accounts, failing to shred or wipe media.

Malicious employees

An insider deliberately steals, leaks, deletes or alters data, or lets an outsider in. They already hold valid credentials, so their activity looks legitimate and is hard to detect.

Disguised criminals

Attackers pose as cleaners, delivery drivers, engineers or new staff to walk into a building, then tailgate through doors and access unattended machines or comms rooms.

State sponsored

Government-backed operatives place or recruit insiders and run long-term, patient campaigns with large budgets, aiming at espionage rather than quick gain.

Targeted attack

A named person is researched using social media and public sources, then approached with a convincing, personalised message. Senior staff with wide access are the usual choice.

Social engineering

Manipulating people into giving up information or access, using authority, urgency, fear or helpfulness. Includes phishing, vishing, pretexting, baiting, tailgating and shoulder surfing.

Access control weaknesses are the physical side of the same problem:

Poor door access control

Doors left unlocked or propped open, no barrier between public and restricted areas, and no way to stop tailgating.

Recycled codes

Keypad codes shared between staff and never changed, so former employees and visitors keep working access, and worn keys reveal the digits used.

Poor monitoring of access and areas

No CCTV, no visitor log, no review of door or system logs, so intrusions are never noticed and there is no evidence afterwards.

Unnecessary access rights

Users hold privileges beyond their role, or keep rights after moving jobs or leaving. Breaches the principle of least privilege and widens the damage any one compromised account can do.

For each human vulnerability, be ready to say how it increases risk, for example "recycled door codes mean an ex-employee still has physical access to the server room, so an insider attack cannot be ruled out and there is no audit trail of who entered".

2.2.2 Physical vulnerabilities: natural disasters

Earthquakes

Structural damage destroys servers, racks and cabling, and cuts power and communication links. Recovery can take weeks because the whole site is unusable.

Fire

Destroys hardware and any onsite backups. Water and smoke from firefighting damage equipment that the flames did not reach.

Severe weather events

Flooding, storms, lightning strikes and extreme heat cause power cuts, water damage, cooling failure and loss of connectivity.

Impact on cyber security: natural disasters attack availability above all, and can destroy data permanently if backups are held on the same site. They also create confidentiality risk, because damaged or displaced hardware can be lost or looted, and pressure to restore service quickly leads to controls being skipped.

Why they must be planned for: the organisation cannot prevent them, only prepare. Planning covers offsite and cloud backups, a disaster recovery and business continuity plan, geographic separation of sites, UPS and generators, fire suppression, raised flooring, and siting equipment above known flood levels.

2.3 System vulnerabilities: digital methods

Botnets

Gives an attacker a large pool of remotely controlled machines. A network of infected devices ("zombies") is controlled from a command and control server, usually without the owners knowing. Used to launch DDoS attacks, send spam, mine cryptocurrency and spread malware. Vector: any device that can be infected, including IoT devices with default passwords.

Malware

Runs the attacker's code on the victim's machine. Covers viruses, worms, trojans, ransomware, spyware, keyloggers, adware and rootkits. Arrives through email attachments, downloads, removable media and drive-by websites, and can steal, encrypt, alter or destroy data.

Denial of Service (DoS)

Makes a service unavailable. A single source floods a server with more requests than it can handle, so legitimate users are refused. Attacks availability. Easier to block than DDoS because the traffic comes from one address.

Distributed Denial of Service (DDoS)

The same attack, but from thousands of sources at once using a botnet. Far harder to filter because the traffic looks like it comes from ordinary users worldwide, and the volume can be enormous.

Hacking

Gains unauthorised access. Exploits weak passwords, unpatched software, misconfigurations, open ports and SQL injection to reach data, escalate privileges and create hidden accounts for later.

Lack of supplier support

Not an attack in itself, but a vulnerability attackers rely on. When software or hardware reaches end of life the vendor stops issuing security patches, so newly discovered flaws are never fixed and the system stays permanently exploitable.

Malicious spam

Reaches as many users as possible, cheaply. Bulk unsolicited email carrying infected attachments, malicious links or phishing content. Relies on a small percentage of recipients clicking, and clogs mail systems even when it fails.

Man in the middle

Intercepts and possibly alters data in transit. The attacker secretly sits between two parties, typically on public or rogue Wi-Fi, and can read credentials, session tokens and messages, or change them before passing them on. Attacks confidentiality and integrity.

Out of date software

Missing patches leave known and published exploits open. Attackers scan for unpatched versions because the exploit code is already available.

Out of date hardware

Older devices lack modern security features, cannot run current software, fail more often, and may no longer receive vendor fixes at all.

Out of date firmware

Routers, switches, printers and IoT devices ship with firmware that is rarely updated. Default credentials and unpatched flaws make them an easy foothold inside the network.

Link each digital method to the vector it attacks, as the spec requires. For example, malicious spam and phishing attack the email vector; man in the middle attacks the wireless vector; a malicious update attacks the third party vector.

Topic 3 - Impact of cyber security events

3.1 Disruption

Financial disruption

Payments, payroll and card processing stop. Orders cannot be taken or invoiced, cash flow is interrupted, and emergency IT contractors, overtime and ransom demands add unplanned cost.

Information disruption

Data is encrypted, corrupted or locked away, so staff cannot access records they need. Decisions are delayed or made on incomplete information, and reporting duties cannot be met.

Operational disruption

Day-to-day work stops: production lines halt, deliveries cannot be scheduled, staff sit idle, and manual workarounds slow everything down. Effects spread to suppliers and partners.

Service disruption

Customer-facing services go down: websites, apps, phone lines, online banking, patient systems. Customers cannot buy or get help, and public services may stop entirely.

Effects across different targets: an individual loses access to their accounts and personal files; a business loses trading time and customers; a public service such as a hospital or school cannot deliver care or teaching; and disruption to national infrastructure affects an entire region.

3.2 Loss

Type of loss	Short term	Long term
Data availability	Files, systems and records cannot be reached, so work stops and orders are lost.	Data destroyed with no clean backup is gone permanently, taking historic records, research and evidence with it.
Financial	Stolen funds, fraudulent transactions, ransom payments, lost sales during downtime, incident response and recovery costs.	ICO fines, legal claims and compensation, higher insurance premiums, lost contracts, and investment diverted from growth into security.
Identity	Stolen personal data is used to open accounts, take out credit or impersonate the victim.	Damaged credit rating, years of disputes, and continued resale of the same data on criminal markets.
Integrity	Records have been altered, so nothing in the system can be trusted until it is verified.	Decisions and published figures based on corrupted data must be revisited, audits fail, and evidence may be inadmissible.
Reputation / customer confidence	Negative press and social media, customers cancelling, staff and partners losing trust.	Long-term loss of market share, difficulty winning contracts and recruiting, and a brand that is linked to the breach for years.

Extended response questions on impact are usually levels of response. Cover more than money: separate short term from long term, and cover at least two different stakeholders, such as the organisation and its customers.

3.3 Safety

Financial safety

People lose savings, cannot access their money, or fall into debt after fraud. Businesses can fail, taking jobs with them, and financial insecurity carries real health and wellbeing consequences.

Personal safety

Leaked addresses, routines or medical data enable stalking, harassment and blackmail. Attacks on hospital systems delay treatment and put patients directly at risk, and leaked data can put vulnerable people or protected witnesses in danger.

Society

Loss of trust in digital services and institutions, disinformation influencing elections, panic buying during outages, and pressure on emergency services when systems fail.

Transport systems

Attacks on rail signalling, air traffic control, traffic light systems, shipping or connected vehicles can cause collisions, strand travellers and stop the movement of goods including fuel and medicine.

Utilities and services

Power, water, gas and telecoms are controlled by industrial systems. An attack can cut electricity to homes and hospitals, interfere with water treatment, or take down the phone network so emergency calls fail.

Safety impacts are why critical national infrastructure is regulated and treated differently from ordinary commercial systems: the worst case is not lost money, it is loss of life.

Topic 4 - Cyber security mitigations

4.1 Endpoint mitigation: data and software measures

Endpoint mitigation means the controls placed on the devices and entry points at the edge of a system, the laptops, desktops, phones, servers and connections where users and attackers actually meet the network. Each measure counters a specific risk, and each has a cost.

Air gap

Blocks remote attack and malware spread. The system is physically isolated with no connection to any other network or the internet. Advantages: cannot be reached remotely, so it is the strongest isolation available and is used for classified and industrial control systems. Disadvantages: no updates or remote access, data must be moved by removable media which reintroduces risk, and it is inconvenient and expensive.

Anomaly based system

Catches new and unknown attacks. Learns a baseline of normal behaviour and flags anything that deviates, such as a login at 3am from another country. Advantages: can detect zero-day and insider activity that signature-based tools miss. Disadvantages: high false positive rate, needs a training period, and unusual but legitimate behaviour gets blocked.

Anti-malware

Removes the full range of malicious software, including trojans, spyware, ransomware and rootkits. Scans, quarantines and removes threats, and monitors behaviour in real time. Advantages: broad protection, largely automatic. Disadvantages: uses system resources, needs constant updating, and cannot stop what it does not recognise.

Anti-virus

Stops viruses and worms, mainly by matching known signatures. Advantages: cheap, mature and effective against known threats. Disadvantages: signature-based detection is useless against brand new variants until the definition file is updated, so it must be paired with other controls.

Backup

Protects against data loss, destruction, ransomware and disaster. Copies of data held separately, ideally offsite or in the cloud, and tested by restoring them. Advantages: the single most reliable recovery control and it removes the incentive to pay a ransom. Disadvantages: costs storage and time, data created since the last backup is still lost, and a backup left connected to the network gets encrypted with everything else.

Cryptography

Defends against interception and tampering. The science of protecting information by encoding it, covering encryption, hashing and digital signatures. Advantages: protects confidentiality and integrity even if data is stolen. Disadvantages: only as strong as the key management around it, and it adds processing overhead.

Encryption at rest

Defeats theft of a device, drive or backup. Stored data is scrambled and unreadable without the key, for example full disk encryption on a laptop. Advantages: a stolen laptop is not a data breach if the disk is encrypted. Disadvantages: losing the key loses the data, and it does not protect data once a logged-in user has opened it.

Encryption in transit

Defeats interception, packet sniffing and man in the middle. Data is encrypted while it crosses a network, using HTTPS, TLS/SSL or a VPN tunnel. Advantages: intercepted traffic is meaningless to the attacker. Disadvantages: adds latency, and encrypted traffic can also hide an attacker's own activity from monitoring tools.

Machine Learning and AI systems

Targets fast-moving and previously unseen attacks. Models trained on large volumes of traffic and log data spot patterns and respond faster than a human analyst. Advantages: scales to huge data volumes, improves over time, and reduces detection time. Disadvantages: expensive, needs quality training data, can be fooled or poisoned, and its decisions can be hard to explain or challenge.

Quantum cryptography

Addresses interception of key exchange, and the future risk that quantum computers break current encryption. Uses the properties of quantum physics so that any attempt to observe the key changes it and is detected. Advantages: interception is detectable rather than silent. Disadvantages: very expensive, limited distance, specialist hardware, and not yet practical for ordinary organisations.

Whitelist / blacklist

Shuts out unauthorised software, sites and senders. A whitelist permits only approved items and blocks everything else; a blacklist blocks known-bad items and permits everything else. Advantages: whitelisting is far stronger because unknown threats are denied by default. Disadvantages: whitelisting is restrictive and high maintenance, while blacklisting always lags behind new threats.

4.1 Endpoint mitigation: access, network and physical measures

Firewalls: hardware

Filters unauthorised traffic entering or leaving the network. A dedicated appliance filtering at the network perimeter using rules on address, port and protocol. Advantages: protects every device behind it, does not use host resources, harder for an attacker to disable. Disadvantages: costly, needs expert configuration, and does nothing about traffic already inside the network.

Firewalls: software

Filters unauthorised traffic to and from one device. Runs on the host and can filter per application. Advantages: cheap, portable with the laptop, protects the device off-site. Disadvantages: uses the host's resources, must be managed on every machine, and can be turned off by the user or by malware.

Access rights

Prevents unauthorised viewing or editing of data. Permissions set per user or group on files, folders and systems, typically read, write, modify or full control. Advantages: enforces need-to-know and limits the blast radius of a stolen account. Disadvantages: needs constant maintenance as people change roles, and rights tend to accumulate.

Levels of privilege

Limits privilege escalation and insider misuse. Users get the minimum rights their role requires, with administrator accounts kept separate and used only when needed. Advantages: malware runs with the user's limited rights, so damage is contained. Disadvantages: extra admin overhead and staff complaints when a task needs elevation.

Password

Guards against unauthorised access. Strength depends on length, complexity, uniqueness and not being reused. Supported by a password policy, lockout after failed attempts, and a password manager. Advantages: cheap, universally understood, no extra hardware. Disadvantages: guessed, phished, cracked, reused and written down. A password alone is now considered weak protection.

Separation of duties

Guards against fraud and insider abuse. No one person can complete a sensitive process alone, for example the person who raises a payment cannot also approve it. Advantages: collusion is required for fraud, and errors are caught by the second person. Disadvantages: needs enough staff, and slows processes down.

Two-Factor Authentication (2FA)

Defeats stolen or guessed passwords. Requires a second factor from a different category, such as a code from an app, a hardware token or a fingerprint. Advantages: a leaked password alone is no longer enough, so it blocks the majority of account takeovers. Disadvantages: adds friction, depends on the user having the device, and codes sent by SMS can be intercepted or SIM-swapped.

Virtual Private Network (VPN)

Prevents interception of remote traffic and exposure of internal services. Creates an encrypted tunnel across a public network so remote workers reach internal systems securely. Advantages: safe use of home and public Wi-Fi, hides traffic from the local network. Disadvantages: reduces speed, costs licences, and a compromised remote device now has a trusted tunnel straight into the network.

Network segregation: VLAN

Restricts lateral movement across the network. Splits one physical network into separate logical networks, so guest, finance and production traffic cannot see each other. Advantages: containment without new cabling, plus better performance. Disadvantages: needs managed switches and correct configuration; a misconfigured VLAN gives false confidence.

Network segregation: physical separation

Restricts the same risk, using separate hardware and cabling for sensitive systems. Advantages: stronger than logical separation because there is no shared switch to misconfigure. Disadvantages: expensive, duplicated equipment, harder to manage.

Network segregation: offline network

Removes the route for internet-borne attack on critical systems. The segment has no internet route at all, which is the practical form of an air gap for industrial control and research systems. Disadvantages: no remote support, patching is manual, and removable media becomes the main threat.

Physical controls

Deter theft, tampering and unauthorised entry. Alarms detect and deter intrusion out of hours. Biometrics tie entry to a person and cannot be shared or lent. Cable locks stop opportunist theft of laptops. CCTV deters and provides evidence, but does not prevent entry. Locks are the basic barrier to rooms and racks. RFID and swipe cards control and log door access, but can be cloned, lost or lent. Safes protect backup media, keys and documents.

Physical location

Reduces exposure to environmental damage and physical access. On site keeps equipment under direct control but exposes it to local disaster. Remote or data centre hosting adds professional physical security and resilience, at the cost of direct control. Siting equipment above floor level protects it from flooding and leaks.

Nine mark questions usually ask you to recommend and justify mitigations for the scenario. Choose two or three, say which risk each one counters, give a limitation of each, and finish with a judgement about which matters most for that organisation.

4.2 Detection measures

Mitigation stops attacks; detection finds the ones that get through, and finds them quickly enough to limit the damage.

Behavioural analytics

Detects compromised accounts and insider threat. Builds a profile of how each user normally behaves and alerts when behaviour changes, such as mass file downloads or access at unusual hours. Advantages: catches misuse by a valid account, which no signature can spot. Disadvantages: false positives, privacy concerns, and it needs time to learn.

Emerging technologies

Detects attacks that outpace traditional tools. Covers AI-driven detection, threat intelligence platforms and automated response. Advantages: faster and broader detection than manual monitoring. Disadvantages: immature, expensive, and attackers use the same technology.

Honeypot

Detects reconnaissance and intrusion. A deliberately vulnerable decoy system, isolated from the real network, that has no legitimate use, so any interaction with it is suspicious. Advantages: near zero false positives, reveals attacker techniques, and wastes the attacker's time. Disadvantages: detects only attackers who touch it, and if it is poorly isolated it becomes a real foothold.

IDS (Intrusion Detection System)

Monitors traffic or system activity and alerts a human when it sees suspicious patterns. It reports, it does not block. Advantages: visibility with no risk of blocking legitimate traffic. Disadvantages: passive, so the attack continues until someone acts, and alert fatigue is common.

NIDS

A network based IDS placed at a key point such as the perimeter, inspecting traffic for many devices at once. Advantages: wide coverage from one sensor. Disadvantages: cannot see inside encrypted traffic, and misses activity local to a host.

HIDS

A host based IDS installed on one machine, watching its logs, files and processes. Advantages: sees what actually happened on the device, including after decryption. Disadvantages: must be deployed and maintained on every host, and uses that host's resources.

DIDS

A decentralised IDS: multiple sensors across the network reporting to a central analysis point, so events can be correlated. Advantages: full picture across sites and better detection of coordinated attacks. Disadvantages: complex, costly, and generates very large volumes of data.

Intrusion prevention systems (IPS)

Detects like an IDS, then acts automatically by dropping packets, blocking an address or closing a session. Advantages: stops the attack in real time without waiting for a human. Disadvantages: a false positive blocks genuine users and can cause an outage, and it sits inline so it becomes a single point of failure.

Network monitoring

Continuous observation of traffic, bandwidth, device health and logs, usually with dashboards and alert thresholds. Advantages: spots outages, unusual data transfers and failing hardware early, and provides the evidence used in incident reports. Disadvantages: produces huge volumes of data that need skilled staff to interpret.

Vulnerability testing

Scanning and penetration testing to find weaknesses before an attacker does, including missing patches, weak configurations and open ports. Advantages: finds real, exploitable holes and evidences due diligence for ISO 27001. Disadvantages: a snapshot in time that is out of date as soon as the system changes, costly if done by an external tester, and testing can disrupt live systems.

The classic exam contrast is IDS against IPS: an IDS detects and alerts, an IPS detects and blocks. State the trade-off, which is that automatic blocking risks stopping legitimate traffic.

4.3 Intelligence assessment

Human intelligence (HUMINT)

Information gathered from people, through interviews, informants, staff reports, industry contacts, security forums and law enforcement briefings. It gives context and intent that tools cannot see, such as a rumour that a group is targeting the sector, or an employee reporting a suspicious phone call. In mitigation it shapes staff training, informs risk assessments and provides early warning of targeted attacks. It is slow to collect, subjective, and only as reliable as the source.

Open-source intelligence (OSINT)

Information collected from publicly available sources, including websites, social media, company filings, job adverts, DNS and WHOIS records, breach databases and news. It is free or cheap, legal, and available to both sides. In mitigation, an organisation runs OSINT against itself to see what an attacker would see, such as staff names and roles on social media, leaked credentials, or exposed services, and then reduces that footprint. The volume is huge, accuracy is unverified, and attackers use exactly the same sources for reconnaissance.

Both forms feed the same cycle: collect information, assess how credible and relevant it is, turn it into a judgement about threat, and then change controls, training or monitoring in response.

Topic 5 - Policies, procedures and event handling

5.1 Policies and procedures

A policy is a formal written document that states the rules, expectations and responsibilities for a particular area of the organisation. The procedures inside it say how those rules are carried out step by step.

Why policies are required: they set one consistent standard so staff are not left to decide for themselves; they make expectations enforceable, which supports disciplinary action; they evidence compliance with UK GDPR, the DPA and ISO 27001; they support training and induction; and they reduce human error, which is the largest single cause of incidents.

AUP (Acceptable Use Policy)

Defines what staff may and may not do with company systems, devices, internet and email. The procedures cover permitted personal use, banned sites and software, rules on downloads and removable media, monitoring of activity, and consequences of misuse. It improves security by reducing risky behaviour, blocking unapproved software, and giving legal grounds to act when a rule is broken.

BYOD (Bring Your Own Device) policy

Controls the use of personally owned phones, tablets and laptops for work. The procedures cover which devices are allowed, minimum OS and patch level, mandatory passcode and encryption, mobile device management enrolment, separation of work and personal data, and remote wipe on loss or when the person leaves. It improves security by applying company standards to devices the company does not own.

Credential management policy

Governs how accounts and passwords are created, used and removed. The procedures cover password length and complexity, no reuse or sharing, use of a password manager, mandatory MFA, account lockout, privileged account handling, and prompt removal of leavers' accounts. It improves security by closing the most common route in, which is a weak, shared or forgotten account.

Information security policy

The overarching policy that states how the organisation protects the confidentiality, integrity and availability of its information. The procedures cover data classification and handling, access control, encryption, backup, incident reporting, roles and responsibilities, and review cycles. It improves security by setting the framework every other policy sits under, and demonstrating management commitment for ISO 27001.

Remote working policy

Sets the rules for working away from the office. The procedures cover mandatory VPN use, banning public Wi-Fi for sensitive work, physical security of devices and printouts, screen privacy in public places, secure home network requirements, and reporting lost devices. It improves security by extending the perimeter's controls to homes, cafes and client sites.

Staff training

Makes sure staff can recognise and respond to threats. The procedures cover induction training, annual refreshers, phishing simulations, role-specific training for IT and finance staff, and records of who has completed what. It improves security by turning the weakest link into a detection layer, since a trained employee reports the phishing email instead of clicking it.

The spec states this section "does not include details of each policy's contents". You need the purpose of each policy, the kinds of procedure it covers, and how it improves security. You do not need to reproduce a full policy document.

5.2 Event handling

Responding to a cyber security event follows a set sequence so that evidence is preserved and the damage is contained:

Identify the event and confirm it is genuine, not a false positive.
Report it immediately through the agreed channel, no matter who noticed it.
Contain it: isolate affected devices, disable compromised accounts, block the source.
Preserve evidence: capture logs and images before wiping anything, and record actions and times.
Eradicate the cause: remove malware, close the vulnerability, apply patches.
Recover: restore from clean backups, verify integrity, and monitor closely for reinfection.
Notify stakeholders, and the ICO within 72 hours where personal data is involved.
Review: hold a post-incident review, write the incident report and update controls, policies and training.

Roles and responsibilities during a response:

All staff

Report anything suspicious immediately, stop using the affected device, and follow instructions. They must not attempt their own fix, because that destroys evidence.

IT and security team

Investigate, contain and eradicate, preserve evidence and logs, restore services from backup, and advise on the technical cause.

Incident manager / cyber security officer

Owns the response, makes the decisions on containment and escalation, coordinates the team, and signs off recovery.

Data protection officer / legal

Judges whether personal data was involved, handles the ICO notification within 72 hours, and manages legal and regulatory duties.

Management and communications

Approve resources, handle press and customer communications, and keep internal and external stakeholders informed.

Forensic specialist

Recovers and analyses evidence to a legal standard, maintaining chain of custody so it is admissible.

Components of a cyber security incident report:

Title and date of incident

Short identifying title plus the date and time it occurred and was discovered. The gap between the two matters.

Target

The system, data, department or individual affected.

5.3 Legislation, regulations and standards

Computer Misuse Act (CMA) 1990, as amended

Latest version: the 1990 Act as amended by the Police and Justice Act 2006 and the Serious Crime Act 2015.
Main purpose: to make unauthorised access to and interference with computer systems a criminal offence.
Offences: unauthorised access to computer material; unauthorised access with intent to commit a further offence; unauthorised acts with intent to impair operation, including deleting data and running DoS attacks; unauthorised acts causing serious damage; and making, supplying or obtaining tools for use in these offences.
Impact on cyber security: hacking is illegal even where no damage is done and no data is taken, so penetration testing must have written permission first. This is what separates a white hat from a grey hat.
Compliance steps: authorise testing in writing and define its scope, control and log access rights, make the AUP explicit about what is unauthorised, and report offences to the police.
Non-compliance: criminal prosecution, fines and imprisonment, ranging from up to two years for basic unauthorised access to life imprisonment where an act causes serious damage to human welfare or national security.

Data Protection Act (DPA) 2018

Latest version: the DPA 2018, which sits alongside and supplements the UK GDPR, and which has since been amended by the Data (Use and Access) Act 2025.
Main purpose: to control how personal data is collected, processed, stored and shared, and to give individuals rights over their own data. It also covers areas UK GDPR does not, including law enforcement and intelligence processing.
Impact on cyber security: security is a legal duty, not just good practice. Personal data must be protected by appropriate technical and organisational measures, which means encryption, access control, backup and staff training.
Compliance steps: identify what personal data is held and why, keep it accurate and no longer than needed, apply security controls, honour subject access requests, appoint a Data Protection Officer where required, and report qualifying breaches to the ICO within 72 hours.
Non-compliance: ICO enforcement notices, audits, fines, compensation claims and reputational damage.

UK GDPR

Latest version: the retained EU GDPR as it applies in UK law from 1 January 2021, as amended.
Main purpose: to set the principles and rights governing the processing of personal data.
Seven principles: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (the security principle); and accountability.
Individual rights include: to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object, and rights relating to automated decision making.
Impact on cyber security: the security principle and accountability principle require documented, tested controls and the ability to prove they exist.
Compliance steps: have a lawful basis for processing, minimise what is collected, secure it, keep records of processing, run data protection impact assessments for high-risk processing, and report a personal data breach to the ICO within 72 hours, telling affected individuals without undue delay where the risk to them is high.
Non-compliance: fines of up to £17.5 million or 4% of global annual turnover, whichever is higher, plus enforcement action and civil claims.

ISO 27001 Information security management

What it is: the international standard for an Information Security Management System (ISMS), currently ISO/IEC 27001:2022. It is voluntary, not a law.
Main purpose: to provide a recognised framework for managing information security risk systematically, rather than control by control.
Impact on cyber security: it forces a risk-based approach, defined responsibilities, documented policies and continual improvement, rather than a one-off fix.
Compliance steps: define the scope of the ISMS, gain management commitment, carry out a risk assessment, select controls and record them in a Statement of Applicability, write the policies and procedures, train staff, run internal audits and management reviews, then pass a certification audit by an accredited body, followed by regular surveillance audits.
Benefits of meeting the standard: fewer and less severe incidents, evidence of due diligence that supports UK GDPR compliance, credibility with customers, and access to contracts and tenders that require certification.

The spec says you do not need to know the detailed contents of each Act, regulation or standard. You do need the latest version, the main purpose, the effect on cyber security, the steps to comply and the consequences of not complying. Learn the two headline numbers: 72 hours to report a breach, and £17.5m or 4% of global turnover.

Topic 6 - Job roles and responsibilities

6.1 General cyber security roles

Computer forensic engineer

Recovers, preserves and analyses digital evidence after an incident. Takes forensic images so the original is untouched, maintains the chain of custody, reconstructs what the attacker did, and writes reports that stand up in court. Works mostly after the event.

Cyber security analyst

Monitors systems, traffic and alerts day to day. Triages and investigates suspicious activity, responds to incidents, runs vulnerability scans, and reports on threats and trends. The front line of detection and response.

Cyber security officer

Owns security at an organisational level. Writes and reviews policies, sets the security strategy and budget, manages risk, oversees awareness training, and leads the response to major incidents. Management focused rather than hands-on.

IT security compliance analyst

Checks that the organisation meets its legal and standards obligations such as UK GDPR, the DPA and ISO 27001. Audits controls, maintains documentation and records of processing, prepares for external audits, and reports gaps and non-compliance to management.

Network security engineer

Designs, builds and maintains secure network infrastructure. Configures firewalls, VPNs, VLANs and segregation, hardens routers and switches, applies patches and firmware updates, and keeps monitoring in place. Prevention focused.

Penetration tester

Carries out authorised simulated attacks to find exploitable weaknesses before a real attacker does. Works to an agreed scope with written permission under the Computer Misuse Act, then reports the vulnerabilities found with prioritised recommendations.

The spec says this "does not include a detailed job description for each job role and qualifications required". Learn the main responsibilities and, above all, be able to say which role you would give a task from the scenario to, and why.

6.2 Communication skills

Verbal

Spoken communication: briefings, handovers, phone support and meetings. Depends on clarity, tone, pace and active listening.

Written

Emails, incident reports, policies, risk registers and user guidance. Must be accurate, unambiguous and dated, because it becomes the permanent record and the evidence.

Non-verbal

Body language, eye contact, posture and facial expression. Conveys calm and competence during an incident, and helps read whether a user is uncomfortable or hiding something.

Appropriate language for the audience

Technical detail for engineers, plain English and business impact for directors and customers. Jargon aimed at the wrong audience loses the message.

Questioning techniques

Used to elicit specific information: open questions to get the story, closed questions to confirm facts, probing questions for detail such as exact times and wording, and clarifying questions to check understanding.

How communication skills increase cyber security risk: staff discussing systems in public or on social media hand attackers free reconnaissance; over-sharing on a support call gives away credentials or internal names; vague or jargon-heavy instructions mean controls are applied wrongly; unreported incidents stay hidden because nobody knew who to tell; and persuasive communication is the attacker's main tool, since social engineering, phishing and vishing all succeed through communication rather than code.

How communication skills contribute to mitigation development: interviewing staff and stakeholders surfaces the real working practices behind a vulnerability; clear written policies mean rules are actually followed; awareness training only works if delivered in language the audience understands; and persuading management to fund a control depends on explaining risk in terms of business impact, not technical detail.

How communication skills are used in incident response: taking a clear initial report from the person who noticed the event, using probing questions to establish exactly what happened and when; coordinating the response team calmly; keeping management updated with accurate, non-alarming summaries; notifying customers and the ICO in precise, factual terms; and writing the incident report so that others can act on it later.

Topic 1 - Network types, models, topologies and services

1.1 Network types

Type	Purpose, use and characteristics	Advantages and disadvantages
PAN Personal Area Network	Connects one person's devices over a few metres, typically by Bluetooth, for example a phone to earbuds, a smartwatch or a car.	Advantages: cheap, no infrastructure, low power, quick to pair. Disadvantages: very short range, low data rates, few devices, and pairing can be abused if left discoverable.
LAN Local Area Network	Connects devices across one site such as an office, school or home. Owned and managed by the organisation, usually Ethernet cabled with switches.	Advantages: high speed, low latency, full control, easy resource and file sharing. Disadvantages: limited to one geographic site, cabling and hardware cost, and malware spreads quickly once inside.
Intranet	A private network of internal websites and services, available only to staff inside the organisation, used for policies, forms and internal news.	Advantages: central, controlled internal information, not reachable from the internet. Disadvantages: needs maintaining and quickly goes stale, and offers no access for external partners.
Extranet	A controlled extension of the intranet that lets named external parties such as suppliers, clients or partners access specific resources, normally over a login and a VPN.	Advantages: collaboration with partners without giving full network access. Disadvantages: extends the attack surface to third parties, and needs careful authentication and access rights.
WLAN Wireless LAN	A LAN where devices connect over Wi-Fi through wireless access points, using IEEE 802.11 standards.	Advantages: mobility, easy to add devices, little cabling. Disadvantages: slower and less reliable than cable, affected by interference and distance, and the signal leaves the building so it is easier to attack.
MAN Metropolitan Area Network	Connects sites across a town or city, for example a council's offices or a university's campuses, often over fibre.	Advantages: high speed across a city, links multiple LANs under one organisation. Disadvantages: expensive to build and maintain, and often depends on a third party provider's infrastructure.
WAN Wide Area Network	Connects sites over large distances, between cities or countries, using leased lines and public infrastructure. The internet is the largest WAN.	Advantages: connects an organisation nationally or globally and supports remote sites. Disadvantages: highest cost, higher latency, lower speeds than a LAN, and relies on third party links.
SAN Storage Area Network	A dedicated high-speed network that presents pooled block storage to servers, so the storage appears local to them. Used in data centres and virtualisation.	Advantages: very fast, highly scalable, centralised backup, no load on the main LAN. Disadvantages: expensive, complex, and needs specialist skills and hardware.
VPN Virtual Private Network	Creates an encrypted tunnel across a public network so a remote user or site behaves as though it is on the private network.	Advantages: secure remote access, cheaper than leased lines, protects traffic on public Wi-Fi. Disadvantages: reduces speed, adds latency and licensing cost, and a compromised remote device gains a trusted route in.

1.2 Network models

Client-server

Central servers provide resources and services to client devices that request them. It gives centralised authentication, storage, backup and updates, with clients doing the local processing. Advantages: central control and security, easier backup and management, scales well. Disadvantages: expensive servers and specialist staff, and the server is a single point of failure and a prime target.

Peer-to-peer

Every device acts as both client and server, sharing resources directly. There is no central server, and permissions are set per machine. Advantages: cheap and simple to set up, no single point of failure, fine for very small networks. Disadvantages: no central security or backup, data scattered across machines, poor scalability, and each device must be on for its files to be available.

Thin client

Lightweight terminals with minimal local processing and storage, running everything from a central server. Applications and data live server-side, and the terminal handles input and display. Advantages: cheap endpoints with a long life, central patching and security, and data never leaves the server so a stolen terminal holds nothing. Disadvantages: completely dependent on the server and the network, so an outage stops all users, and it needs a powerful, well-specified server.

1.3 Network topologies

A physical topology is how the devices and cables are actually laid out. A logical topology is how the data actually flows between them, which is often different: a wireless network is physically a set of independent radio links but logically behaves as a star centred on the access point.

Star

The standard layout for modern wired LANs. Every device has its own cable to a central switch. Advantages: one cable failure affects only one device, easy to add or remove devices, easy to fault-find, good performance. Disadvantages: the central switch is a single point of failure, and it uses the most cable of the simple layouts.

Distributed star

Several star networks joined through linked central switches, which is how a multi-floor or multi-building site is wired. Advantages: scales a star design across a large site while keeping local traffic local. Disadvantages: more hardware and configuration, and losing a linking switch isolates a whole branch.

Partial mesh

Important devices have multiple redundant links, but not every device connects to every other. Advantages: resilient, since traffic reroutes around a failed link, and cheaper than a full mesh. Disadvantages: more cabling and complex routing, and resilience only exists where the extra links were built.

Point-to-point

A single dedicated link between exactly two devices or sites, such as a leased line or a microwave link between buildings. Advantages: simple, dedicated bandwidth, easy to secure and monitor. Disadvantages: connects only two endpoints, and if the link fails there is no alternative path.

Tree

A hierarchy of stars branching from a root, used in campus and large corporate networks. Advantages: organised, scalable, and easy to segment by branch or department. Disadvantages: heavily dependent on the root and the upper branches, so a failure high in the tree cuts off everything below it.

Hybrid

Any deliberate combination, for example a tree backbone with a partial mesh between core switches and wireless at the edge. Almost all real networks are hybrid. Advantages: each area gets the layout that suits it, and it is flexible and scalable. Disadvantages: most complex to design, document, secure and troubleshoot.

Wireless

Devices connect by radio to access points rather than by cable. Advantages: mobility, no cabling cost, quick to deploy in older buildings. Disadvantages: shared bandwidth so performance falls as devices are added, affected by distance, interference and walls, and the signal is available to anyone in range.

The spec explicitly excludes bus and ring topologies from F194. Do not spend revision time on them, and do not offer them as an answer.

1.4 Network services

Domain controller

Authenticates users and computers on a domain, holds the directory of accounts and groups, applies policies centrally, and enforces access rights. One login then works across the whole network.

DNS (Domain Name System)

Resolves human-readable domain names into IP addresses so users do not need to know numeric addresses. Used by every internet request, which also makes it a target for spoofing and poisoning.

Sends, receives and stores messages using SMTP to send and POP or IMAP to retrieve. Provides mailboxes, address lists, spam filtering and archiving.

Firewall

Filters traffic entering and leaving the network against a rule set based on address, port and protocol, forming the boundary between trusted and untrusted networks.

Internet access

Provides the shared route out to the wider internet through a router and the ISP connection, usually with NAT, DNS and content filtering applied on the way.

Intrusion detection system (IDS)

Monitors traffic and activity for suspicious patterns and raises alerts for a human to investigate. It reports rather than blocks.

Intrusion prevention system (IPS)

Sits inline, detects suspicious traffic and blocks it automatically by dropping packets or closing the session.

Proxy

Acts as an intermediary between clients and the internet. Forwards requests on the user's behalf, caches popular content to save bandwidth, filters and logs sites, and hides internal addresses.

Routing

Chooses the best path for packets between networks, using routing tables and protocols, and connects the LAN to other networks and to the internet.

Voice

Carries telephone calls over the data network using VOIP, converting speech to packets. Needs quality of service, because voice suffers badly from latency and jitter.

VPN termination

The endpoint, normally a firewall, router or VPN concentrator, where incoming VPN tunnels are authenticated and decrypted so remote users can be placed onto the internal network.

Topic 2 - Network layers, protocols and addressing

2.1 Network layers: the TCP/IP model

The TCP/IP layer model divides communication into four layers. Each layer has one job and provides a service to the layer above it, so protocols and hardware can be changed at one layer without rewriting the others.

Layer	Function	Examples	Data unit
Application	Provides network services directly to the user's software, and formats the data being sent.	HTTP, HTTPS, FTP, SMTP, IMAP, POP, DNS, DHCP, NTP	Data
Transport	Splits data into segments, controls the end-to-end conversation, and adds port numbers so the data reaches the right application. Handles reliability, ordering and flow control where TCP is used.	TCP, UDP	Segment (TCP) or datagram (UDP)
Internet	Adds logical (IP) addressing and routes packets across networks between source and destination.	IP, ICMP, ARP	Packet
Network access	Puts data onto the physical medium and delivers it on the local link using physical (MAC) addresses. Covers the cabling, signalling and network card.	Ethernet, Wi-Fi (802.11)	Frame, then bits

Encapsulation happens as data travels down the layers on the sending device. Each layer wraps the data from the layer above in its own header, so the application layer hands its data down, the transport layer adds port numbers, the internet layer adds source and destination IP addresses, and the network access layer adds MAC addresses and a trailer for error checking.

Decapsulation is the reverse on the receiving device. Data moves up the layers and each layer strips off and reads its own header, then passes the payload upward, until the original data reaches the correct application.

F194 uses the four-layer TCP/IP model only. The spec states it "does not include the OSI model", so do not answer with seven layers.

2.2 Network protocols

A protocol is an agreed set of rules that governs how devices format, transmit and receive data, so that equipment from different manufacturers can communicate.

DHCP

Dynamic Host Configuration Protocol. Automatically issues an IP address, subnet mask, default gateway and DNS server to a device joining the network, from a pool, for a fixed lease time. Removes manual configuration and prevents duplicate addresses. Ports 67 and 68.

FTP

File Transfer Protocol. Transfers files between a client and a server, with separate control and data connections. Ports 20 and 21. Sends credentials in plain text, so SFTP or FTPS is used where security matters.

HTTP

Hypertext Transfer Protocol. Requests and delivers web pages between browser and web server, using methods such as GET and POST. Port 80. Unencrypted, so anything sent can be read in transit.

HTTPS

HTTP secured with TLS (historically SSL). Encrypts the session, authenticates the server through its certificate, and protects integrity. Port 443. The padlock indicates the certificate is valid, not that the site is trustworthy.

IMAP

Internet Message Access Protocol. Retrieves email while leaving it stored on the server, keeping multiple devices in sync with folders and read status. Port 143, or 993 over TLS.

POP

Post Office Protocol. Retrieves email and by default downloads then deletes it from the server, so mail lives on one device. Port 110, or 995 over TLS. Simpler than IMAP but poor for multi-device use.

SMTP

Simple Mail Transfer Protocol. Sends outgoing mail and relays it between mail servers. Port 25, with 587 used for authenticated submission by clients.

Internet Protocol. Provides logical addressing and routes packets between networks. It is connectionless and best effort: it does not guarantee delivery, order or error-free arrival, which is why it is paired with TCP.

TCP

Transmission Control Protocol. Connection-oriented and reliable. Establishes a session with a three-way handshake, numbers segments so they can be reassembled in order, acknowledges receipt and retransmits anything lost, and applies flow and congestion control. Used for web, email and file transfer.

UDP

User Datagram Protocol. Connectionless and unreliable, with no handshake, acknowledgements or retransmission. Much lower overhead and latency, so it is used for voice, video streaming, online gaming and DNS lookups, where speed matters more than perfect delivery.

NTP

Network Time Protocol. Synchronises the clocks of devices across a network to a reference time source. Port 123. Essential for security, because authentication, certificates and log correlation all depend on accurate timestamps.

SSL

Secure Socket Layer. The original protocol for encrypting data in transit, using certificates and a handshake to agree keys. Now deprecated and superseded by TLS, although the term SSL is still used loosely, including for SSL certificates and SSL VPNs.

VOIP

Voice Over Internet Protocol. Carries voice calls as packets over an IP network, digitising and compressing speech with a codec. Uses SIP for call setup and RTP to carry the media, normally over UDP. Cheap and flexible, but very sensitive to latency, jitter and packet loss.

Ethernet

The dominant wired LAN standard, defined by IEEE 802.3. Operates at the network access layer, defines frames and MAC addressing, and uses twisted pair or fibre with switches. Speeds run from 100 Mbps to 10 Gbps and above.

The TCP against UDP comparison is a near-certain question. Answer with the three points that earn marks: connection-oriented against connectionless, reliable with acknowledgements and retransmission against no guarantee of delivery, and higher overhead and latency against lower overhead and speed. Then give a suitable use for each.

2.3 Network addressing

MAC address

Media Access Control. A physical 48-bit address burned into the network interface card, written as six pairs of hex digits such as 00:1A:2B:3C:4D:5E. The first half identifies the manufacturer. It is globally unique, does not change when the device moves network, and is used to deliver frames on the local link only. Can be spoofed, so MAC filtering is weak security.

IPv4

A logical 32-bit address written as four decimal octets, such as 192.168.1.15. Around 4.3 billion possible addresses, which have run out, hence NAT and IPv6. Assigned by the network, so it changes when the device moves.

IPv6

A 128-bit address written as eight groups of four hex digits, such as 2001:0db8:85a3::8a2e:0370:7334, with leading zeros and one run of zero groups compressible to "::". Gives a practically unlimited address space, removes the need for NAT, has autoconfiguration and IPsec built in, and simplifies the header. Adoption is slow because of legacy equipment.

Network classes

Class A: first octet 1 to 126, default mask 255.0.0.0 (/8), huge networks. Class B: 128 to 191, default mask 255.255.0.0 (/16), medium networks. Class C: 192 to 223, default mask 255.255.255.0 (/24), small networks. Class D: 224 to 239, reserved for multicast. Class E: 240 to 255, reserved for experimental use. Neither D nor E is assigned to hosts.

Classless (CIDR)

Classless Inter-Domain Routing removes the fixed class boundaries and lets the mask fall anywhere, written as a prefix such as /26. Address space is allocated in the size actually needed, which reduces waste and shrinks routing tables.

Private and public

Private ranges are usable inside any organisation and are not routed on the internet: 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255. Public addresses are globally unique, allocated by an ISP or registry, and reachable from the internet.

NAT

Network Address Translation. A router rewrites private source addresses to its single public address, tracking sessions so replies return to the right internal device. Conserves scarce IPv4 addresses and hides the internal structure of the network, which is a security benefit, but it complicates hosting inbound services and peer-to-peer applications.

Dynamic and static

Dynamic: DHCP leases an address automatically, so configuration is easy and addresses are reused, but the address can change. Static: the address is set manually and never changes, which suits servers, printers and network hardware, but it needs documenting and risks duplicate addresses if it is done carelessly.

Reservations

A DHCP reservation ties a specific IP address to a specific MAC address, so the device always receives the same address while still being configured centrally. Gives the stability of a static address with the manageability of DHCP.

APIPA

Automatic Private IP Addressing. If a client cannot reach a DHCP server it self-assigns an address in 169.254.0.0 to 169.254.255.255. It can then only talk to other APIPA devices on the same link, with no gateway and no internet. Seeing a 169.254 address is a diagnostic sign that DHCP has failed.

Loopback

127.0.0.1 (the whole 127.0.0.0/8 range) refers to the device itself, and ::1 in IPv6. Traffic never leaves the network card, so pinging it tests that the local TCP/IP stack is working.

Subnet and subnet mask

A subnet is a logical subdivision of a larger network. The subnet mask or netmask marks which bits of an address identify the network and which identify the host, for example 255.255.255.0 means the first three octets are the network. Subnetting reduces broadcast traffic, improves performance, and allows departments to be separated and secured independently.

Default gateway

The IP address of the router interface a device sends traffic to when the destination is on a different network. Without it, a device can reach its own subnet but nothing beyond it.

How devices obtain an IP address. Either it is entered manually as a static address, or DHCP assigns one through the four-step DORA exchange: Discover, the client broadcasts a request for a server; Offer, a DHCP server offers a free address; Request, the client asks to take that address; Acknowledge, the server confirms and issues the lease with the mask, gateway and DNS details. If no server replies, the client falls back to APIPA.

Worked subnet calculation. A company has 192.168.1.0/24 and needs four subnets.

Borrow 2 host bits, because 2^2 = 4 subnets New prefix = /24 + 2 = /26 Subnet mask = 255.255.255.192 Block size = 256 - 192 = 64 Subnets = 192.168.1.0, .64, .128, .192 Hosts each = 2^6 - 2 = 62 usable For 192.168.1.64/26: network = .64 first host = .65 last host = .126 broadcast = .127

Two addresses are always lost per subnet: the network address (all host bits 0) and the broadcast address (all host bits 1), which is why usable hosts are 2^h minus 2, where h is the number of host bits.

Show your working for subnet questions, since method marks are available even if the final figure is wrong. Write down the number of borrowed bits, the mask, the block size, and then the ranges.

Topic 3 - Wired network components

3.1 Communications media

Transmission media fall into two categories in F194: copper media, which carry data as electrical signals, and optical media, which carry it as pulses of light.

Coaxial

Built from a solid copper core, a plastic insulator, a braided metal shield and an outer jacket. Used for cable television and broadband drops, CCTV, and legacy network segments. Advantages: better shielded against interference than unshielded twisted pair, and carries a signal further. Disadvantages: thick and inflexible, more expensive per metre than UTP, harder to install and terminate, and largely replaced by twisted pair and fibre in LANs.

Twisted pair (general)

Pairs of copper wires twisted together along their length. The twisting makes the interference picked up by each wire in a pair cancel out, which reduces crosstalk. Categories such as Cat5e, Cat6 and Cat6a determine the supported speed. Maximum run for Ethernet is 100 metres.

UTP (Unshielded Twisted Pair)

The standard cable for office and home LANs. Advantages: cheapest, thin and flexible, easy to install and terminate, widely supported. Disadvantages: no shielding, so it is the most vulnerable to electromagnetic interference, and it is easier to tap than fibre.

STP (Shielded Twisted Pair)

Used in electrically noisy environments such as factories, plant rooms and areas with heavy machinery. Advantages: the foil or braided shield blocks external interference and reduces the signal it emits. Disadvantages: more expensive, thicker and less flexible, and it must be correctly earthed or the shield makes performance worse.

Fibre optics

Built from a glass or plastic core carrying light, surrounded by cladding that reflects it back in. Single-mode has a narrow core and one light path for very long distances; multi-mode has a wider core and several paths, which is cheaper but limited to shorter runs. Used for backbones, links between buildings, and ISP infrastructure. Advantages: the highest bandwidth, very long distances with low attenuation, complete immunity to electromagnetic interference, and it is difficult to tap without detection, which makes it the most secure medium. Disadvantages: the most expensive, fragile and easily broken by tight bends, and it needs specialist tools and training to splice and terminate.

Justify a choice of medium against the scenario: fibre for a long run between buildings or where interference is a problem, STP for a factory floor, UTP for ordinary office desks, and note the 100 metre limit on copper if the distance in the question is greater.

3.2 Network connection devices

Bridge

Joins two network segments and filters traffic between them using MAC addresses, so frames only cross when they need to. Advantages: reduces unnecessary traffic and collisions, and extends a network cheaply. Disadvantages: only two segments, adds a small delay, and it has largely been replaced by switches, which are effectively multi-port bridges.

Bridge: transparent

The bridge learns which MAC addresses sit on each side by watching traffic, then forwards or filters automatically. It is invisible to the sending devices, which need no knowledge of it. This is the method used on Ethernet networks.

Bridge: source routing

The sending device discovers and specifies the route, and writes it into the frame; the bridge simply follows those instructions. Associated with Token Ring rather than Ethernet, and it puts the routing workload on the hosts.

Brouter (bridging router)

A hybrid device that routes protocols it can route, and bridges the rest. Advantages: one device covers mixed networks, saving hardware. Disadvantages: complex to configure and a specialist device, rarely needed on modern all-IP networks.

Gateway

Connects networks that use different protocols or architectures and translates between them, for example a VOIP gateway linking IP telephony to the traditional phone network, or an email gateway between systems. The router interface a device uses to leave its own subnet is called the default gateway. Advantages: allows otherwise incompatible systems to communicate. Disadvantages: translation is processing-heavy, which makes it slower, and it is a single point of failure.

NIC (Network Interface Card)

The hardware that physically connects a device to the network, converting data into signals for the medium. Holds the device's unique MAC address. Available as wired, wireless and fibre versions. Advantages: essential and usually built in. Disadvantages: a faulty NIC takes one device offline, and its speed caps that device's throughput.

Repeater

Receives a weakened signal, regenerates it and retransmits it to extend the distance a network can cover. Advantages: cheap and simple way to exceed cable length limits. Disadvantages: it makes no forwarding decisions and cannot filter traffic, it amplifies noise along with the signal, and it adds latency.

Router

Connects different networks and forwards packets between them by IP address, choosing the best path from its routing table. Home and small office routers also provide NAT, DHCP, a firewall and often wireless. Advantages: connects the LAN to the internet, separates broadcast domains, and provides security functions. Disadvantages: more expensive and slower than a switch because it inspects packets, and it needs configuration.

Switch: Layer 2

Connects devices within a network and forwards frames only to the port where the destination MAC address sits, learned from traffic. Advantages: each port is its own collision domain, giving full duplex operation and much better performance than a hub, and it supports VLANs. Disadvantages: cannot route between networks, and broadcast traffic still reaches every port in the same VLAN.

Switch: Layer 3

Switches within a VLAN and also routes between VLANs using IP, in hardware. Advantages: routing at close to wire speed, so it removes the bottleneck of sending inter-VLAN traffic to a router. Disadvantages: more expensive, and it lacks the wide area interfaces and advanced features of a full router.

The classic comparison is router against switch: a switch connects devices inside one network using MAC addresses, a router connects separate networks using IP addresses. Say which layer each works at, and give a use for each in the scenario.

3.3 Host devices

A host is any end device that uses the network to send or receive data, as opposed to the infrastructure that moves the data.

Laptops

Portable, battery powered, usually connecting by Wi-Fi with a wired option through a dock. Chosen for flexibility and hot-desking, at the cost of higher loss and theft risk, so full disk encryption matters.

Mobile handheld devices

Smartphones, tablets and rugged scanners. Always wireless, over Wi-Fi or cellular, and frequently personally owned, which is why BYOD and mobile device management policies exist.

PCs

Fixed desktop machines, normally wired for reliable speed. More powerful and upgradeable per pound than a laptop, easier to physically secure, but not portable.

Printers

Shared network devices with their own IP address, often given a DHCP reservation. Frequently overlooked in security terms, despite storing print jobs, holding scanned documents, and shipping with default administrative passwords.

VOIP phones

Handsets that connect to the data network rather than a phone line, often powered over Ethernet. Usually placed on their own VLAN with quality of service applied, because voice traffic suffers from latency and jitter.

Application server

Runs shared business applications centrally, so clients do not each need a local installation. Simplifies licensing, updates and access control.

Database server

Stores and manages structured data, handling queries, transactions, concurrency and backups. Usually the most valuable machine on the network.

Email server

Sends, receives and stores messages using SMTP, POP and IMAP, and applies spam and malware filtering.

File server

Central shared storage for documents, with folder permissions, quotas and version history, and a single point for backup.

Hypervisor (virtual machine monitor)

Software or firmware that creates and runs virtual machines, allocating physical CPU, memory and storage between them and keeping them isolated. Lets one physical server host many logical servers.

Print server

Manages print queues and drivers for shared printers, so jobs are spooled centrally and users do not need direct printer configuration.

Web server

Stores and delivers web pages and web applications over HTTP and HTTPS, to the internet or to an intranet. Public-facing, so it is the most exposed server on the network.

Topic 4 - Mobile and wireless networks

4.1 Wireless transmission media

Microwave transmission

Used for high-capacity point-to-point links between buildings, masts and satellites, where cabling is impractical. It uses a high frequency, needs a clear line of sight between dish antennas, and can span many kilometres. Advantages: no cabling or wayleaves needed, fast to deploy across obstacles such as roads and rivers, and high bandwidth. Disadvantages: blocked by buildings and terrain, degraded by heavy rain and fog, and it can be intercepted or jammed.

Radio

The basis of Wi-Fi, cellular networks and two-way radio. It is omni-directional, passes through walls and around obstacles, and does not need line of sight. Advantages: mobility, wide coverage, many devices at once. Disadvantages: shared and congested spectrum, interference from other equipment, and the signal travels beyond the building, so it can be intercepted.

Bluetooth

Used for short-range personal area networks such as headsets, keyboards, wearables and car systems. It runs at 2.4 GHz on low power, pairing devices into a piconet, typically up to about 10 metres for common devices. Advantages: very low power, cheap, simple pairing, no infrastructure. Disadvantages: short range, low data rate, and it can be attacked when devices are left discoverable or paired with default PINs.

Infra-red

Used for remote controls and some short-range device links. It needs a direct line of sight and has a very short range, and is blocked by any solid object. Advantages: cheap, no radio interference, and hard to intercept because the signal will not pass through walls. Disadvantages: line of sight only, very short range, low speed, and it is disrupted by strong sunlight.

Laser

Used for free-space optical links between two fixed points, such as neighbouring rooftops. It is a tightly focused beam of light, needing precise alignment and clear line of sight. Advantages: very high bandwidth, no radio licence needed, and extremely hard to intercept because the beam is narrow. Disadvantages: blocked by fog, rain, snow and birds, disturbed by building movement, and strictly point-to-point.

4.2 Connectivity: cellular technologies and hardware

4.2.1 Technologies used in connecting cellular and mobile networks. All of these are ways of letting many users share the same limited radio spectrum.

AMPS

Advanced Mobile Phone Service. The original 1G analogue cellular system, giving each call its own frequency channel. Voice only, no encryption, easily intercepted and cloned, and now obsolete.

TDMA

Time-Division Multiple Access. Several users share one frequency by each being given a repeating time slot. More capacity than analogue channels, and it underpins GSM.

CDMA

Code-Division Multiple Access. All users transmit on the same frequency at the same time, each with a unique spreading code that the receiver uses to pick out its own signal. Higher capacity, resistant to interference, and harder to intercept.

GSM

Global System for Mobile Communications. The 2G digital standard built on TDMA. Introduced the SIM card, digital encryption of the air interface, SMS and international roaming, and made handsets and networks interchangeable worldwide.

LTE

Long Term Evolution, the 4G standard. Entirely packet switched and all-IP, including for voice through VoLTE. Uses OFDM-based access to deliver much higher data rates and far lower latency than 3G, which is what makes HD streaming and video calling practical.

4.2.2 Hardware used in connecting mobile and wireless networks.

WAP (Wireless Access Point)

Provides the radio link between wireless clients and the wired network, acting as the bridge between the two. It broadcasts one or more SSIDs, operates on a chosen band and channel, enforces the wireless security protocol, and supports roaming between multiple access points on the same SSID. Often powered over Ethernet, so only one cable is needed.

WNIC (Wireless Network Interface Controller)

The client-side adapter that lets a device transmit and receive over radio. It holds the device's MAC address, supports particular 802.11 standards and bands, and may be built in or added by USB or card. Its capability limits the speed the device can achieve, however good the access point is.

4.3.1 Mobile and wireless network concepts

Access Points (APs / WAP)

The connection point between wireless devices and the wired network. Several access points sharing one SSID give continuous coverage across a site and allow devices to roam between them. Advantages: extends coverage and capacity. Disadvantages: overlapping APs on the same channel interfere with each other, and a rogue AP is a serious security risk.

Bands and channels

A band is the block of spectrum used, principally 2.4 GHz and 5 GHz. Each band is divided into channels. On 2.4 GHz the channels overlap, so only 1, 6 and 11 can be used together without interference; 5 GHz has far more non-overlapping channels. 2.4 GHz: longer range, better wall penetration, but crowded and slower. 5 GHz: much faster and cleaner, but shorter range and poorer penetration.

Frequencies

The number of wave cycles per second, measured in hertz. Higher frequencies carry more data but travel less far and are absorbed more easily by walls; lower frequencies travel further and penetrate better but carry less. This single trade-off explains most wireless design decisions.

SSID (Service Set Identifier)

The network name broadcast by an access point, up to 32 characters, which clients use to identify and select the network. Hiding the SSID stops it appearing in the list of available networks, but it is still visible in captured traffic, so it is obscurity rather than security. Guest and staff networks are normally separate SSIDs mapped to different VLANs.

Wireless security: protocols

The encryption used to protect traffic over the air. WEP is broken and must never be used; WPA is legacy; WPA2 uses AES and is the practical minimum; WPA3 is current best practice.

WPA/WPA2 Personal (WPA-PSK)

Authentication with a single pre-shared key that everyone types in. Advantages: simple, no server, ideal for homes and small offices. Disadvantages: everyone shares one secret, so it must be changed for all users whenever anyone leaves, there is no per-user accountability, and a weak passphrase can be cracked offline.

WPA/WPA2 Enterprise (RADIUS)

Authentication through 802.1X against a RADIUS server, so every user or device has individual credentials or a certificate. Advantages: per-user accountability, easy revocation of one account, unique encryption keys per session, and it integrates with the domain. Disadvantages: needs a RADIUS server and certificates, so it is more complex and costly to set up.

WPA3

The current standard. Replaces the pre-shared key handshake with SAE (Simultaneous Authentication of Equals), which defeats offline dictionary attacks on the passphrase, adds forward secrecy so previously captured traffic cannot be decrypted later, uses stronger encryption, and encrypts open public networks individually. Disadvantages: needs modern hardware on both ends, and mixed-mode networks weaken the benefit.

Authentication and authorisation

Authentication proves who or what is connecting, through a passphrase, credentials or a certificate. Authorisation then decides what that connection may reach, for example placing guests on a VLAN with internet access only, while staff devices reach internal servers. Authentication alone is not enough, because a guest that is authenticated but not restricted has full access.

4.3.2 Radio Frequency (RF) concepts

Amplitude

The height or strength of the wave, which corresponds to signal power. A larger amplitude gives a stronger signal that carries further and resists noise better, but transmit power is limited by regulation and by battery life.

Attenuation

The gradual loss of signal strength as the wave travels, and as it passes through walls, floors, glass, water and people. It is the main reason coverage falls with distance, and why higher frequencies have shorter usable range.

Bandwidth

The range of frequencies a channel occupies, measured in hertz, for example a 20 MHz or 80 MHz Wi-Fi channel. A wider channel carries more data per second, but occupies more spectrum, so fewer non-overlapping channels remain and interference becomes more likely.

Modulation

Varying a property of a carrier wave, its amplitude, frequency or phase, in order to encode data onto it. More advanced schemes pack more bits into each symbol, giving higher speeds, but they need a cleaner signal, which is why data rates drop as you move away from an access point.

Phase

The position of the wave within its cycle, measured in degrees. Shifting the phase in a controlled way carries data (phase modulation), while uncontrolled phase differences from signals arriving by different paths cause multipath interference and cancellation.

Wavelength

The physical distance between two successive peaks. Wavelength is inversely proportional to frequency: 2.4 GHz has a longer wavelength than 5 GHz, which is why it travels further and penetrates walls better while carrying less data. Antenna size is also related to wavelength.

4.3.3 Mobile network antennas

Omni-directional

Radiates roughly equally in all horizontal directions, in a 360 degree pattern. Used on standard access points and mobile masts giving general coverage of an area. Advantages: covers devices anywhere around it, simple to position, ideal for open-plan offices. Disadvantages: low gain, so the shortest range of the three, and it wastes signal in directions where nobody is, which also spreads it outside the building.

Semi-directional

Focuses the signal into one sector, typically through a patch or panel antenna. Used for covering a corridor, a lecture theatre or one side of a building, and short to medium point-to-point links. Advantages: higher gain and range than omni-directional in the chosen direction, and it reduces coverage leaking where it is not wanted. Disadvantages: leaves gaps outside the sector, and must be aimed correctly.

Bi-directional

Radiates in two opposite directions with little signal to the sides. Used in long narrow spaces such as corridors, tunnels, aisles in a warehouse, or a link that must serve points on either side of the antenna. Advantages: efficient coverage of a linear space using one antenna, better range along that axis than omni-directional. Disadvantages: poor coverage to the sides, and it must be aligned with the axis of the space.

Antenna choice is a favourite application question. Match the pattern to the shape of the space: omni-directional for an open office, bi-directional for a corridor or warehouse aisle, semi-directional to cover one area or to aim a link at a nearby building.

4.4 Networking standards

4.4.1 Mobile networking standards: broadband cellular generations.

Generation	Key properties	What it enabled
1G	Analogue voice, no encryption, low capacity.	Mobile phone calls only.
2G	Digital, GSM based on TDMA, SIM cards, encrypted air interface.	Clearer calls, SMS, basic data, roaming.
3G	Higher data rates, packet data alongside circuit-switched voice.	Mobile internet, email and video calling.
4G / LTE	All-IP and fully packet switched, OFDM-based, much lower latency.	HD streaming, video conferencing and app-driven services.
5G	Very high data rates, very low latency, and support for a huge density of connected devices, using both sub-6 GHz and millimetre wave spectrum.	IoT at scale, remote control of machinery, AR and VR, and fixed wireless broadband. Millimetre wave has very short range, so many small cells are needed.

Wideband wireless digital communication systems.

CDMA

Spreads each user's signal across a wide band using a unique code, so many users occupy the same frequency at the same time. It has high capacity, resists narrowband interference and jamming, and difficult to intercept without the code. It separates users by code, where TDMA separates them by time.

OFDM

Orthogonal Frequency Division Multiplexing. Splits one wide channel into many closely spaced, mathematically orthogonal subcarriers, each carrying part of the data slowly and in parallel. It is highly resistant to multipath interference, efficient use of spectrum, and it scales to wide channels. Used by 4G, 5G and modern Wi-Fi. It separates data across many frequencies at once, rather than by code or time slot.

4.4.2 Wireless networking standards.

Bluetooth

Short-range personal area networking between paired devices. It uses 2.4 GHz with frequency hopping, low power and small piconets, typical range around 10 metres for consumer devices, with Bluetooth Low Energy used for wearables and sensors. Difference from Wi-Fi: much lower power and data rate, device-to-device rather than device-to-network, and no infrastructure required.

IEEE 802.11 (Wi-Fi)

Wireless local area networking to an access point. Main amendments: a 5 GHz and 54 Mbps; b 2.4 GHz and 11 Mbps; g 2.4 GHz and 54 Mbps; n both bands with MIMO and much higher throughput; ac 5 GHz with wide channels and gigabit speeds; ax (Wi-Fi 6) both bands, using OFDMA to serve many devices efficiently in dense environments. Difference from Bluetooth: far higher speed and range, and it connects devices to a network rather than to each other.

4.5 Global Positioning System (GPS)

Purpose: to provide position, velocity and precise time anywhere on Earth, using a constellation of satellites in orbit.

How it works: each satellite continuously broadcasts its position and a very accurate timestamp. The receiver measures how long each signal took to arrive and calculates its distance from that satellite. With signals from at least four satellites it can fix latitude, longitude and altitude by trilateration, the fourth being needed to correct the receiver's own clock error.

Features and properties: the receiver is passive, meaning it only listens and transmits nothing, so an unlimited number of users can be served at once. The service is free at the point of use, works worldwide, and provides the accurate timing that many networks and financial systems depend on.

Uses: navigation and mapping, vehicle and asset tracking, fleet management, geofencing and location-based apps, emergency service dispatch, surveying, and time synchronisation of network equipment.

Advantages

Free to use, global coverage, accurate to within a few metres and better with augmentation, no subscription or infrastructure needed, and it supplies precise time as well as position.

Disadvantages

Needs a clear view of the sky, so it works poorly indoors, underground and among tall buildings; the signal is weak and can be jammed or spoofed; it drains battery; accuracy degrades in poor conditions; and continuous location tracking raises real privacy concerns.

Topic 5 - Network performance

5.1 Network performance indicators

Bandwidth

States the maximum theoretical capacity of a link, measured in bits per second. It is the size of the pipe, not the amount of water flowing through it. Used when specifying a connection or a medium.

Data Transfer Rate (DTR)

The rate at which data is actually moved from one point to another, in bits per second. Used to work out how long a transfer will take and whether a link is fit for purpose.

Throughput

The amount of useful data successfully delivered in a period of time. Always lower than bandwidth, because protocol headers, retransmissions, errors and contention with other users all consume capacity. Throughput is what the user experiences.

Latency

The delay before data begins to arrive, measured in milliseconds, often as round trip time. Caused by distance, the number of hops, queuing and processing in devices. Critical for voice, video calls and gaming, where a high-bandwidth but high-latency link still feels unusable.

Do not treat bandwidth and throughput as the same thing. Bandwidth is the theoretical maximum, throughput is what is really achieved, and latency is the delay, which is independent of both. A satellite link can have high bandwidth and terrible latency.

5.2.1 Units of data transfer rate measurement

Data transfer rate is the amount of data moved per unit of time, normally quoted in bits per second (bps), and scaled as kbps, Mbps, Gbps. File sizes, by contrast, are quoted in bytes, so almost every calculation needs a conversion.

Bit

A single binary digit, 0 or 1. The smallest unit of data.

Nibble

4 bits, which is exactly one hexadecimal digit.

Byte

8 bits, enough for one character of ASCII text.

Binary and metric units are not the same thing, and mixing them is a common source of lost marks:

Binary (powers of 1024)	Value	Metric / decimal (powers of 1000)	Value
Kibibyte (KiB)	1024 bytes	Kilobyte (KB)	1000 bytes
Mebibyte (MiB)	1024 KiB	Megabyte (MB)	1000 KB
Gibibyte (GiB)	1024 MiB	Gigabyte (GB)	1000 MB
Tebibyte (TiB)	1024 GiB	Terabyte (TB)	1000 GB
Pebibyte (PiB)	1024 TiB	Petabyte (PB)	1000 TB
Exbibyte (EiB)	1024 PiB	Exabyte (EB)	1000 PB

Converting between units: multiply by 8 to go from bytes to bits, and divide by 8 to go from bits to bytes. Then scale by 1000 for metric units or 1024 for binary units.

2 GB file = 2 x 1000 x 1000 x 1000 = 2,000,000,000 bytes = 2,000,000,000 x 8 = 16,000,000,000 bits = 16,000 Mb (megabits) 1 GiB = 1024 x 1024 x 1024 = 1,073,741,824 bytes

What counts as a good data transfer rate depends entirely on what the network has to carry. A VOIP call needs roughly 100 kbps, standard definition video around 3 Mbps, HD video 5 to 10 Mbps and 4K video around 25 Mbps, so a good rate is one that covers the peak demand of all simultaneous users with headroom to spare.

Typical rates by network type and medium:

Medium or network	Typical data transfer rate
Bluetooth (PAN)	1 to 3 Mbps, and lower for Bluetooth Low Energy
Wi-Fi (WLAN)	Tens of Mbps to over 1 Gbps depending on the 802.11 standard, band and distance
Ethernet over twisted pair (LAN)	100 Mbps, 1 Gbps or 10 Gbps
Fibre optic backbone	10 Gbps and above
4G cellular	Tens of Mbps
5G cellular	Hundreds of Mbps, up to around 1 Gbps in good conditions
WAN and leased lines	Whatever is purchased, and normally the slowest link in the chain

5.2.2 Network performance calculations

Three formulae are named in the spec and must be learned:

Bandwidth requirements For each application: application requirement x simultaneous users Then add every application together Data transfer speed = size of data / transfer time Duration of transfer = data size / speed

Worked example 1: bandwidth requirements. An office runs three applications at the same time.

Video conferencing 2 Mbps x 20 users = 40 Mbps Web browsing 0.5 Mbps x 50 users = 25 Mbps File transfer 10 Mbps x 5 users = 50 Mbps Total = 115 Mbps A 100 Mbps link is not sufficient. Specify at least 150 Mbps to cover the peak with headroom.

Worked example 2: duration of a transfer. A 2 GB backup is sent over a 50 Mbps link.

2 GB = 16,000 Mb (x 1000 x 1000 x 1000, then x 8) Time = 16,000 / 50 = 320 seconds = 5 minutes 20 seconds

Worked example 3: data transfer speed. A 500 MB file arrives in 40 seconds.

500 MB = 4,000 Mb Speed = 4,000 / 40 = 100 Mbps

Best case against typical calculations. A best case calculation uses the full advertised bandwidth of the link, assuming no overheads, no other users and perfect conditions. A typical calculation uses the throughput realistically achieved, which is lower because of protocol overheads, contention with other users, interference and retransmissions. The typical figure is the honest one to give a client.

Best case (50 Mbps): 16,000 / 50 = 320 s = 5 min 20 s Typical (60% of 50 = 30): 16,000 / 30 = 533.3 s = 8 min 53 s

Set every calculation out in steps, and state the units at each stage. The two errors that cost marks are forgetting to convert bytes to bits by multiplying by 8, and mixing binary units with metric units in the same calculation.

5.3 Factors affecting network performance

Factor	Effect on performance	How it is resolved
Bandwidth	If the capacity of the link is lower than demand, traffic queues and everything slows during busy periods.	Upgrade the connection, apply quality of service to prioritise voice and video, schedule backups and large transfers out of hours.
Data Transfer Rate	A low rate makes transfers take longer and delays access to files and services.	Faster media and hardware, compression, caching, and removing the slowest link in the path.
Distance	Signals attenuate over distance, causing errors, retransmission and a drop in speed, and copper is limited to 100 metres.	Repeaters or switches within the run, fibre for long distances, and additional access points for wireless coverage.
Environmental	Heat, damp, dust and unstable power cause devices to throttle, fail or restart.	Air conditioning and ventilation in comms rooms, clean filtered power with a UPS, and proper enclosures.
Interference	Electromagnetic interference from motors, lighting and other radio equipment corrupts data, forcing retransmission. Neighbouring Wi-Fi on the same channel does the same.	STP or fibre in noisy areas, route cables away from power lines, change the Wi-Fi channel or move to 5 GHz, and run a site survey.
Intervening objects	Walls, floors, metal shelving, lift shafts and water absorb or reflect wireless signals, creating dead spots.	Reposition access points, add more of them, use appropriate antennas, or cable the area instead.
Jitter	Variation in packet arrival times, which breaks up voice and video even when average speed is fine.	Quality of service prioritisation, jitter buffers, reducing congestion, and using wired links for voice.
Latency	Delay before data starts to arrive, making interactive applications feel unresponsive.	Fewer hops, local caching or content delivery networks, faster hardware, and hosting services closer to users.
Medium	The cable or radio technology sets the ceiling: Cat5e cannot match Cat6a, and copper cannot match fibre.	Upgrade the cabling category or move to fibre for backbones and long runs.
Reliability	Faulty hardware, damaged cable and dropped connections cause errors, retransmission and outages.	Replace failing components, use redundant links and devices, monitor proactively, and keep firmware patched.
Signal strength	A weak wireless signal forces devices onto slower, more robust modulation schemes, so throughput falls with distance.	Move closer or add access points, use higher-gain or directional antennas, and remove obstructions.
Throughput	Actual delivered data can be far below the headline bandwidth because of overheads and contention, which is what users notice.	Reduce congestion, segment the network with VLANs to cut broadcast traffic, upgrade switches, and use full duplex links.

Topic 6 - Cloud networks

6.1.1 Cloud types

Public

Services owned and run by a provider and shared by many unrelated customers over the internet, paid for as they are used. It is multi-tenant and on demand, at effectively unlimited scale. Advantages: no capital outlay, rapid scaling, provider handles maintenance and resilience. Disadvantages: least control, shared infrastructure, data held by a third party, and possible questions about where data is stored.

Private

Cloud infrastructure dedicated to a single organisation, hosted on its own premises or by a provider. It is single tenant, customisable and isolated. Advantages: maximum control and security, easier regulatory compliance, tailored configuration. Disadvantages: the most expensive option, needs in-house expertise, and scaling is limited by the hardware that has been bought.

Hybrid

A combination, keeping sensitive data and core systems private while using the public cloud for bulk, temporary or seasonal workloads. The two environments are integrated so workloads and data can move between them. Advantages: balances control with scalability and cost, and supports cloud bursting for peaks. Disadvantages: the most complex to design, secure and manage, and integration between the environments is itself a risk.

Community

Shared by several organisations with common requirements, such as NHS trusts, councils or universities, and run by them or by a provider. Standards, governance and cost are shared, across a limited and known set of tenants. Advantages: cheaper than private, built for the sector's specific compliance needs, supports collaboration. Disadvantages: security depends on every member organisation, governance decisions must be agreed jointly, and it is less flexible than public cloud.

6.1.2 Cloud service models

The models differ in how much the provider manages and how much the customer manages. Moving from IaaS to SaaS means less control and less responsibility.

IaaS (Infrastructure-as-a-Service)

Provides virtual machines, storage and networking. The customer installs and maintains the operating system, software and data. Used for replacing physical servers, test environments and variable workloads. It gives the most control and the most customer responsibility, including patching.

PaaS (Platform-as-a-Service)

Provides a ready-made platform with operating system, runtime, database and development tools. The customer supplies only the application and its data. Used for developing and deploying applications without managing servers. It sits between IaaS and SaaS, removing infrastructure work but restricting the environment to what the provider supports.

SaaS (Software-as-a-Service)

Provides complete applications delivered over the internet, usually in a browser, with the provider managing everything beneath. Used for email, office suites, CRM and collaboration tools. It takes the least effort and gives the least control, with customisation limited to configuration options.

CaaS (Communication-as-a-Service)

Provides hosted communication services such as VOIP telephony, video conferencing, instant messaging and contact centre features. Used for replacing an on-site phone system. It is a specialised service model focused solely on communications, charged per user.

XaaS (Anything-as-a-Service)

The umbrella term for the growing range of services delivered on demand over a network, including storage, security, desktops, databases and disaster recovery. It is not a single product but the general model of consuming IT as a metered service rather than owning it.

6.1.3 Cloud computing techniques

Cloud automation

Carries out repeatable cloud tasks without manual work, such as provisioning a server, applying patches, taking backups or scaling a service. It is driven by scripts, templates and policies. Reduces human error, speeds delivery and makes environments reproducible.

Cloud orchestration

Coordinates many automated tasks into one managed workflow across systems, for example deploying an entire application stack with its network, storage, security rules and monitoring. Automation performs a single task, while orchestration arranges many tasks in the right order across services.

Cloud elasticity

Adds and removes resources automatically as demand rises and falls, so capacity matches load in near real time. You pay only for what is used, with no idle hardware and no manual intervention. Ideal for workloads with peaks such as results day or a sale.

Cloud bursting

Runs normally in a private cloud and overflows into the public cloud only when local capacity runs out. A hybrid technique that gives control day to day and extra capacity for short peaks, without buying hardware that sits idle for most of the year.

Clustering

Groups multiple servers so they work as one logical system. It provides high availability, since another node takes over when one fails, plus load balancing and better performance. Removes single points of failure.

Multi-tenancy

Lets a single instance of infrastructure or software serve many separate customers, with each tenant's data logically isolated from the others. It is what makes public cloud economical, since costs are shared, though it means customers share underlying hardware, which has security implications.

Resource pooling

Gathers physical resources into shared pools that are allocated dynamically to whoever needs them. Pools cover compute (CPU and memory), networks (bandwidth and addresses) and storage. Hardware utilisation is high and reallocation is rapid, with the customer generally unaware of the exact physical location of their resources.

Ubiquitous network access

Makes services reachable from anywhere, on any device with a connection, over standard protocols. It supports remote and hybrid working across multiple device types. It also means availability depends entirely on the internet connection, and that the service is exposed to the whole internet, so authentication matters more than ever.

6.2 Network virtualisation

Virtualisation creates a software-based version of a physical resource, so that one set of hardware can be divided into many logical resources, or many resources can be presented as one.

Server virtualisation

A hypervisor divides one physical server into several isolated virtual machines, each with its own operating system. Advantages: far better hardware utilisation, lower power and space costs, fast provisioning, snapshots and easy migration for disaster recovery. Disadvantages: one physical failure affects every VM on it, the hypervisor is a high-value target, and licensing and resource contention need managing.

Desktop virtualisation

User desktops run centrally on servers and are streamed to thin clients or any device. Advantages: central patching and security, no data stored on the endpoint, users get the same desktop anywhere, and cheap endpoints last longer. Disadvantages: needs a powerful server and a reliable network, and an outage stops everyone working at once.

Application virtualisation

An application runs in an isolated container and is delivered to the user without being installed locally. Advantages: no conflicts between applications, one central update reaches everyone, and legacy software can run on modern systems. Disadvantages: not every application supports it, and it depends on the delivery infrastructure.

Storage virtualisation

Pools physical drives from multiple devices and presents them as a single logical store. Advantages: simpler management, better utilisation, easy expansion, and migration between physical devices without downtime. Disadvantages: adds a layer of complexity and abstraction, which can make troubleshooting and performance tuning harder.

Data virtualisation

Presents data from many different sources as a single logical view, without physically copying or moving it. Advantages: faster reporting and analysis across systems, no duplication, and source systems stay unchanged. Disadvantages: performance depends on the underlying sources, and access control has to be handled carefully across all of them.

Network virtualisation

Creates logical networks that are independent of the physical cabling and hardware. Internal network virtualisation works inside a single system, giving virtual machines on one host their own virtual switches and adapters. External network virtualisation combines or divides physical networks across devices, for example using VLANs to make one physical network behave as several separate ones. Advantages: segmentation and isolation without new cabling, rapid reconfiguration, and better security through separation. Disadvantages: complex configuration, and a mistake in software can expose networks that were meant to be isolated.

Link virtualisation back to cyber security in F193: segmentation and isolation limit lateral movement, snapshots speed up recovery, and desktop virtualisation keeps data off endpoints. The trade-off to mention is that the hypervisor becomes a single high-value target.