Ethics, and Security
What the exam tests
This domain covers responsible use of ICT and protection of systems and data. It tests privacy, intellectual property, cyberbullying, data protection principles, malware, social engineering, authentication, encryption, firewalls and backup.
Core rules
- Security aims at confidentiality, integrity and availability (CIA). A threat exploits a vulnerability; a control reduces risk.
- Malware includes viruses, worms, trojans, ransomware and spyware. Phishing is social engineering that tricks users into revealing credentials or installing malware.
- Authentication verifies identity using something you know, have or are; multi-factor authentication combines types.
- Encryption protects confidentiality in transit and at rest. A firewall filters network traffic; antivirus software detects known malicious patterns. Backups support availability and recovery.
- Ethical use includes respecting privacy, citing sources, avoiding plagiarism and obtaining consent for personal data.
Worked example
An email claims to be from a bank and asks the user to click a link and confirm a password. The link leads to a fake login page. This is phishing: a confidentiality threat using social engineering, bypassing technical controls by targeting the user. The correct response is not to click, verify the bank’s official domain independently, report the message and enable multi-factor authentication. Reasoning: the weakness is human trust, not encryption failure.
Traps that cost marks
Do not say a firewall removes viruses. Encryption does not stop data deletion or guarantee availability. HTTPS secures the connection but does not prove the site is honest. A backup is not the same as an archive. Do not call authorised penetration testing “hacking” in a security-policy question; intent and permission matter.
Exam focus
Expect CIA classification, threat–control matching and ethical scenario responses.