Series 4 - Networks - Exam practice
Networks exam questions
Ten multiple choice questions covering all six lessons, followed by five written questions. Work through the MCQ first, then write full answers to the written questions before revealing the mark scheme.
Lesson 1
What is a Network?
Lesson 2
Network Topologies
Lesson 3
Wired & Wireless Networks
Lesson 4
IP Addressing & Packets
Lesson 5
Protocols & Layers
Lesson 6
Network Security
Section 1: Multiple choice
Select one answer per question. Instant feedback and an explanation appear when you choose.
Lesson 1
Question 1 of 10
A device connects to a network and sends data. Which component in the device allows it to physically connect to the network and provides a unique hardware address?
A NIC (Network Interface Card) is a hardware component inside a device that allows it to connect to a network. Each NIC has a unique MAC address assigned at manufacture. A router routes packets between networks. A switch connects devices within a LAN. A firewall filters network traffic.
Lesson 1
Question 2 of 10
Which of the following correctly distinguishes a LAN from a WAN?
The key distinction is geographic scale and ownership. A LAN (Local Area Network) covers a limited area such as a building or campus and is typically owned and managed by one organisation. A WAN (Wide Area Network) spans large geographic areas and usually relies on public or leased telecommunications infrastructure. Connection type (wired or wireless) and device count are not the defining differences.
Lesson 2
Question 3 of 10
A network uses full mesh topology with 5 devices. How many direct connections are required?
Use the formula n(n-1)/2, where n is the number of devices. 5 x 4 / 2 = 10 connections. Each of the 5 devices connects directly to all 4 others, but each connection is shared (counted from both ends), so divide by 2.
Lesson 2
Question 4 of 10
In a star topology, a single cable between one workstation and the central switch is broken. What is the effect on the network?
In star topology, each device has its own dedicated cable connecting it to the central switch. A single cable failure disconnects only the device at the end of that cable. All other devices remain connected through their own cables. This is one of the key advantages of star topology over bus topology, where a single backbone failure disconnects all devices.
Lesson 3
Question 5 of 10
A factory installs a new network. The factory floor contains heavy industrial machinery that generates strong electromagnetic fields. Which transmission medium is most appropriate for connections on the factory floor?
Fibre optic cable transmits data as pulses of light rather than electrical signals. Light is immune to electromagnetic interference (EMI), making fibre optic the correct choice for environments with strong electrical or magnetic fields. Cat6 Ethernet and Bluetooth both use signals susceptible to EMI. Wi-Fi uses radio waves that are also vulnerable to interference from industrial equipment.
Lesson 4
Question 6 of 10
Which of the following IPv4 addresses is invalid?
172.256.0.1 is invalid because the second octet is 256. Each octet in an IPv4 address must be between 0 and 255. This is because each octet is exactly 8 bits, and the maximum 8-bit value is 11111111 in binary, which equals 255 in denary. The value 256 cannot be represented in 8 bits.
Lesson 4
Question 7 of 10
A user types a website address into their browser. Before the browser can request the webpage, which of the following must happen first?
Before any HTTP request can be sent, the browser must know the IP address of the server. The DNS (Domain Name System) translates the human-readable domain name (e.g. bbc.co.uk) into an IP address that routers can use to route packets. Only once this translation is complete can the browser form and send the HTTP/HTTPS request to the correct IP address.
Lesson 5
Question 8 of 10
A student uses their phone, laptop and tablet and wants the same emails to appear on all three devices, with actions like reading and deleting synchronised. Which protocol should they configure for receiving email?
IMAP (Internet Message Access Protocol) stores emails on the server and synchronises the inbox across all devices. Any action (reading, deleting, moving) is reflected on every device. POP3 downloads emails to one device and removes them from the server, so other devices cannot see them. SMTP is for sending emails only. FTP is for file transfer and has nothing to do with email retrieval.
Lesson 6
Question 9 of 10
Which type of malware disguises itself as legitimate software to trick users into installing it, but contains hidden malicious code?
A Trojan (Trojan horse) disguises itself as legitimate, useful software to convince users to install it. Once installed, it executes its hidden malicious payload. Unlike a virus, a Trojan does not replicate itself. Unlike a worm, it cannot spread automatically across a network. Ransomware is a separate category that encrypts files and demands payment, though ransomware is sometimes delivered via a Trojan.
Lesson 6
Question 10 of 10
A company's web server is flooded with requests from thousands of different IP addresses simultaneously, causing it to become unavailable. This attack is best described as:
A DDoS (Distributed Denial of Service) attack uses many different devices (often a botnet of compromised computers) to flood a server with requests simultaneously. The "distributed" aspect is key: because the traffic comes from thousands of different IP addresses, simply blocking one IP is ineffective. A standard DoS attack uses a single source. A brute force attack tries password combinations. Phishing is social engineering to steal credentials.
Section 2: Written questions
Write a full answer in your notebook or on paper before revealing the mark scheme. Marks are awarded for specific points - aim to make each point clearly.
Lesson 1
Written question 1
Describe two differences between a LAN and a WAN. For each difference, give an example that illustrates your point.
4 marks
Geographic scale: a LAN covers a small area such as one building or campus - e.g. a school network connecting all computers in the building. A WAN spans large distances, often across countries or continents - e.g. the internet, or a bank connecting its branches in different cities. [1 mark per difference, 1 mark per valid example, max 4]
Ownership and infrastructure: a LAN is typically owned and managed by one organisation using its own hardware - e.g. a school IT department managing its own switches and cables. A WAN usually relies on public or leased telecommunications infrastructure owned by third parties - e.g. a company connecting two offices via a leased line from an ISP.
Speed and reliability: LANs typically offer higher speeds and lower latency within the site (e.g. Gigabit Ethernet) because the infrastructure is dedicated and local. WANs are often slower and more subject to latency due to the distances involved.
Award 1 mark for each clearly stated difference and 1 mark for each valid, specific example. Maximum 4 marks total (2 differences x 2 marks each).
Lesson 2
Written question 2
A school network uses star topology. Describe what would happen if the central switch failed completely. Despite this risk, explain two reasons why a school IT manager would choose star topology over bus topology.
4 marks
Effect of switch failure: if the central switch fails, all devices on the network lose their connection - because every device connects only through the switch, there is no alternative path. [1 mark]
Reason 1 for choosing star over bus - any of: fault isolation - a single cable failure in star only disconnects one device, whereas in bus a backbone failure disconnects all devices. [1 mark]
Reason 2 for choosing star over bus - any of: easier fault diagnosis - the cable to each device is dedicated so a fault can be isolated to a single run; performance - each device has a dedicated connection to the switch so devices do not compete for shared bandwidth as in bus; security - data does not travel to every device on the cable as it does in bus. [1 mark]
Award 1 mark for the correct description of the switch failure effect and 1 mark per valid, distinct reason for preferring star. Maximum 4 marks.
Lessons 4 & 5
Written question 3
Describe the sequence of steps that occurs from a user typing "www.codebash.co.uk" into their browser and pressing Enter, to the web page beginning to load. Your answer must include reference to DNS, IP addresses, packet switching, and the role of TCP.
6 marks
The browser checks its local DNS cache for the IP address of the domain. If not found, a DNS query is sent to a DNS resolver. [1]
The DNS resolver queries root servers, then TLD name servers, then the authoritative name server for codebash.co.uk, which returns the IP address of the server. [1]
The browser sends an HTTP/HTTPS request to the server's IP address. The data is broken into packets, each containing a header (source IP, destination IP, sequence number) and a payload. [1]
Packets may take different routes across the internet via routers, which forward each packet based on its destination IP address. [1]
TCP ensures reliable delivery: it establishes a connection (three-way handshake), numbers packets, requests retransmission of any lost packets, and reassembles packets in the correct order at the destination. [1]
Once the server's response packets arrive and are reassembled, the browser renders the HTML and the page begins to display. [1]
Award 1 mark per clearly stated, accurate step. Accept answers in a different order if logically consistent. Maximum 6 marks.
Lesson 5
Written question 4
Explain the difference between IMAP and POP3. State the default port number for each protocol, and describe one specific situation where each protocol would be the better choice.
4 marks
IMAP (port 143): stores emails on the server and synchronises them across all devices. Reading, deleting or organising emails is reflected on every device that accesses the same account. Best for users with multiple devices who need a consistent inbox (e.g. a professional using a phone, laptop and tablet). [1 mark for port, 1 mark for use case / explanation]
POP3 (port 110): downloads emails to a single device and (by default) removes them from the server. Once downloaded, the emails are only on that one device. Best for users with only one device, or where minimising server storage usage is important, or where the user wants to access emails offline permanently (e.g. a user with limited server storage who accesses email only from their home desktop). [1 mark for port, 1 mark for use case / explanation]
Maximum 4 marks. Accept port 995 (POP3S) and 993 (IMAPS) as alternatives if the student notes these are the secure/encrypted versions.
Lesson 6
Written question 5
A charity organisation stores sensitive donor records on a network used by 50 staff, all of whom currently have administrator-level access. Evaluate four different security measures the charity should implement to protect these records. For each measure, explain what specific threat it addresses and how it provides protection.
6 marks
Access control / principle of least privilege: staff should only have access to the data they need for their role. This limits the damage if an account is compromised - an attacker using stolen credentials cannot access the full database if that account has restricted permissions. [1]
Two-factor authentication (2FA): requires a second factor (e.g. a one-time code sent to a registered phone) in addition to the password. Even if a password is stolen via phishing or brute force, the attacker cannot log in without the second factor. [1]
Encryption: donor records should be encrypted both at rest (on the server) and in transit (over the network). If data is intercepted or physically stolen, it cannot be read without the decryption key. [1]
Firewall: a firewall filters incoming and outgoing traffic based on rules (IP addresses, ports, protocols). It can block unauthorised external access to the server containing donor records, and prevent malware from communicating back to external servers. [1]
Regular software updates and anti-malware: patching operating systems and applications closes known vulnerabilities that ransomware and other malware exploit. Anti-malware software detects known malicious code before it can execute. [1]
Staff training / phishing awareness: most breaches begin with a phishing email. Training staff to recognise suspicious emails, avoid clicking unverified links and report suspicious messages addresses the human element that technical controls cannot fully prevent. [1]
Award 1 mark per measure that includes both a named measure and a clear explanation of the threat it counters. Maximum 6 marks (any 6 from the above or other valid security measures).