Methods to identify and prevent vulnerabilities: penetration testing, anti-malware software, firewalls, user access levels, passwords, encryption, physical security and network policies.

Firewall (2 marks): a firewall monitors and controls the traffic entering and leaving a network, allowing through only data that meets its rules and blocking anything that does not, helping to keep out unauthorised access and attacks.

User access levels (2 marks): different users are given different permissions, so each person can only access the files and functions they need for their role. This limits the damage if an account is compromised and stops ordinary users from changing or seeing data they should not, for example only managers can access payroll.

Markers reward "controls/filters traffic in and out by rules" for the firewall and "restricting what each user can access according to their role" for access levels.

Award up to two marks per method (named plus how it helps), to a maximum of six. Any three of:

Penetration testing: deliberately attacking the system (as a hacker would) to find weaknesses before a real attacker does, so they can be fixed.

Anti-malware software: scans for, detects and removes malware, and prevents known malware from running, protecting the system from viruses and similar threats.

Firewall: monitors and filters traffic in and out of the network by rules, blocking unauthorised access.

Encryption: scrambles data so that if it is intercepted or stolen it cannot be read without the key.

User access levels and strong passwords: limit what each user can access and make accounts harder to break into.

Physical security and network policies: lock server rooms and set rules (for example password rules, regular updates and staff training) to reduce risk.

Markers reward three distinct methods each with a clear explanation of how it reduces the risk.