CCEA Computer Science – Network Security Exam Essentials | CCEA 计算机

📚 CCEA Computer Science – Network Security Exam Essentials | CCEA 计算机 – 网络安全考点精讲

Network security is a core topic in the CCEA AS and A2 Computer Science specification, focusing on the threats, vulnerabilities, and countermeasures required to protect data and systems across interconnected networks. This article distils key examinable content, from malware classification to cryptographic protocols, ensuring you can confidently address definition, explanation, and scenario-based questions. Every concept is aligned with the CCEA assessment objectives for knowledge, application, and evaluation.

网络安全是 CCEA AS 和 A2 计算机科学考试中的核心主题，重点关注保护互联网络中数据和系统所需的威胁、漏洞与防护措施。本文梳理了必考内容，从恶意软件分类到加密协议，确保你能从容应对定义、解释和情景分析题。每个概念均与 CCEA 在知识、应用和评估方面的考核目标保持一致。

1. Threat Landscape: Malware and Attack Vectors | 威胁图景：恶意软件与攻击途径

A threat is any action that could compromise the confidentiality, integrity, or availability of a system. Common malware types include viruses (self-replicating, need a host file), worms (self-spreading without user action), Trojan horses (disguised as legitimate software), ransomware (encrypts files and demands payment), spyware (covertly gathers user information), and adware (displays unwanted advertisements). Attack vectors range from phishing emails and social engineering to drive-by downloads and malicious USB drops.

威胁是指任何可能破坏系统机密性、完整性或可用性的行为。常见恶意软件类型包括：病毒（自我复制，需要宿主文件）、蠕虫（无需用户操作即可自我传播）、特洛伊木马（伪装成合法软件）、勒索软件（加密文件并索要赎金）、间谍软件（暗中收集用户信息）和广告软件（显示不必要的广告）。攻击途径涵盖网络钓鱼邮件、社会工程学攻击、路过式下载和恶意 USB 投放等。

Exam questions often ask you to distinguish between a virus and a worm. A virus requires a host program and user interaction (e.g., opening an infected attachment), whereas a worm exploits network vulnerabilities to propagate automatically, making it faster and more dangerous. Ransomware attacks like WannaCry combined worm-like spread with encryption for extortion.

考试中常要求区分病毒与蠕虫。病毒需要宿主程序和用户交互（如打开受感染的附件），而蠕虫则利用网络漏洞自动传播，速度更快、危害更大。诸如 WannaCry 等勒索软件攻击则将类似蠕虫的传播方式与文件加密勒索结合在一起。

2. Social Engineering and Phishing | 社会工程学与网络钓鱼

Social engineering exploits human psychology rather than technical vulnerabilities. Attackers manipulate individuals into divulging confidential information or performing actions that compromise security. Common techniques include pretexting (inventing a scenario), baiting (offering something enticing), tailgating (following authorised personnel into secure areas), and shoulder surfing (observing keystrokes or screens).

社会工程学利用的是人的心理而非技术漏洞。攻击者通过操纵个人来泄露机密信息或执行危害安全的操作。常见手法包括伪造借口、利诱、尾随进入安全区域以及偷窥键盘输入或屏幕内容。

Phishing is a specific type of social engineering that uses deceptive emails, messages, or websites impersonating trusted entities to steal credentials. Spear phishing targets specific individuals or organisations with personalised content. CCEA markers expect you to describe the typical indicators of a phishing attempt: generic greetings, urgent language, spoofed sender addresses, suspicious links, and requests for personal data.

网络钓鱼是一种特殊的社会工程学攻击，利用欺骗性邮件、消息或网站冒充可信实体，窃取凭证。鱼叉式钓鱼针对特定个人或组织，内容更为个性化。CCEA 考官期望你描述钓鱼企图的典型特征：通用问候语、紧急措辞、伪造的发件人地址、可疑链接及索要个人信息。

3. Denial of Service and Distributed Denial of Service | 拒绝服务与分布式拒绝服务攻击

A Denial of Service (DoS) attack aims to make a network service or resource unavailable by overwhelming it with traffic or requests. In a Distributed Denial of Service (DDoS) attack, the attacker uses a botnet — a network of compromised devices — to flood the target simultaneously, making mitigation much harder.

拒绝服务（DoS）攻击旨在通过耗尽网络服务或资源的流量或请求，使其无法使用。在分布式拒绝服务（DDoS）攻击中，攻击者利用僵尸网络——即被控制的设备组成的网络——同时对目标发起洪水攻击，使得防御难度大大增加。

Common DDoS techniques include SYN flood (exploiting the TCP three-way handshake), HTTP flood (targeting web servers with legitimate-looking GET/POST requests), and DNS amplification (sending small queries with spoofed source IP to generate large responses toward the victim). The CCEA specification requires understanding the impact on availability and the role of firewalls or intrusion prevention systems (IPS) in mitigation.

常见的 DDoS 技术包括 SYN 洪水（利用 TCP 三次握手）、HTTP 洪水（以看似合法的 GET/POST 请求攻击 Web 服务器）以及 DNS 放大攻击（发送伪造源 IP 的小查询，产生大量响应涌向受害者）。CCEA 考纲要求理解对可用性的影响，以及防火墙或入侵防御系统（IPS）在缓解攻击方面的作用。

4. Man-in-the-Middle and Eavesdropping | 中间人攻击与窃听

A Man-in-the-Middle (MITM) attack occurs when an attacker secretly intercepts and possibly alters the communication between two parties who believe they are directly communicating. Common MITM scenarios include rogue Wi-Fi access points, ARP spoofing on local networks, and DNS spoofing. Eavesdropping (packet sniffing) is the passive monitoring of network traffic, often a precursor to MITM.

中间人（MITM）攻击是指攻击者秘密拦截并可能篡改两方之间原本以为直接通信的过程。常见的 MITM 场景包括恶意的 Wi-Fi 接入点、局域网上的 ARP 欺骗以及 DNS 欺骗。窃听（数据包嗅探）则是被动监控网络流量，通常是 MITM 攻击的前奏。

Encryption is the primary countermeasure. Protocols such as TLS (Transport Layer Security) establish an encrypted tunnel between client and server, preventing eavesdropping and tampering. CCEA exam answers should reference the use of HTTPS, certificate validation, and perfect forward secrecy where appropriate.

加密是主要的防护措施。诸如 TLS（传输层安全）等协议可在客户端与服务器之间建立加密隧道，防止窃听和篡改。CCEA 考试答案应适当引用 HTTPS 的使用、证书验证以及前向保密等概念。

5. Authentication Techniques | 认证技术

Authentication verifies the identity of a user or system. Methods are categorised into three factors: something you know (password, PIN), something you have (security token, smart card), and something you are (biometric—fingerprint, iris scan). Multi-factor authentication (MFA) combines at least two different factors, significantly raising the security bar.

认证用于验证用户或系统的身份。方法分为三类因子：你知道的东西（密码、PIN）、你拥有的东西（安全令牌、智能卡）以及你自身具备的特征（生物识别——指纹、虹膜扫描）。多因子认证（MFA）至少结合两种不同因子，显著提高安全级别。

CCEA questions may ask you to evaluate password policies. Strong passwords are long, complex, and changed regularly. Alternatives such as certificate-based authentication and biometrics eliminate the need to remember passwords but introduce issues like cost and privacy. You should be able to discuss advantages and disadvantages of each method in context.

CCEA 题目可能要求你评估密码策略。强密码应足够长、复杂并定期更换。如基于证书的认证和生物识别可避免记忆密码，但会带来成本和隐私等问题。你需要能结合具体情境讨论各种方法的优缺点。

6. Encryption: Symmetric and Asymmetric | 加密：对称加密与非对称加密

Symmetric encryption uses a single shared key for both encryption and decryption. It is fast and suited for bulk data encryption. Examples include AES (Advanced Encryption Standard) and the older DES. The key distribution problem is its major weakness: the shared key must be securely delivered to both parties without interception.

对称加密使用同一把共享密钥进行加密和解密。其速度快，适合大量数据加密。示例包括 AES（高级加密标准）和较旧的 DES。密钥分发问题是其主要弱点：共享密钥必须安全地送达双方而不被拦截。

Asymmetric encryption uses a key pair: a public key (freely distributed) and a private key (kept secret). RSA and ECC are common algorithms. It solves the key distribution problem but is computationally slower. In practice, hybrid systems use asymmetric encryption to exchange a symmetric session key, which then encrypts the actual data. CCEA expects you to explain this hybrid approach, often illustrated with HTTPS/TLS.

非对称加密使用一对密钥：公钥（可自由分发）和私钥（秘密保存）。常见算法有 RSA 和 ECC。它解决了密钥分发问题，但计算速度较慢。实践中，混合系统用非对称加密交换对称会话密钥，再用后者加密实际数据。CCEA 期待你解释这种混合方法，通常以 HTTPS/TLS 为例进行说明。

7. Digital Signatures and Certificates | 数字签名与证书

A digital signature provides authentication, non-repudiation, and integrity. The sender creates a hash of the message, encrypts it with their private key; the recipient decrypts the signature with the sender’s public key and compares it to a freshly computed hash of the received message. If they match, the message is both authentic and unchanged.

数字签名提供认证、不可否认性和完整性。发送方生成消息的哈希值，用自己的私钥加密；接收方用发送方公钥解密签名，并与自己对收到的消息重新计算的哈希值进行比较。若匹配，则消息既真实又未被篡改。

Digital certificates bind a public key to an identity, issued by a trusted Certificate Authority (CA). The CA verifies the owner’s identity and signs the certificate. Web browsers and operating systems trust a set of root CAs. In an exam, you may be asked to describe how the chain of trust works and why expired or self-signed certificates trigger security warnings.

数字证书将公钥与身份绑定，由受信任的证书颁发机构（CA）签发。CA 验证所有者身份并对证书签名。网络浏览器和操作系统信任一组根 CA。考试中可能要求你描述信任链的工作原理，以及为什么过期或自签名证书会触发安全警告。

8. Firewalls and Network Segmentation | 防火墙与网络分段

A firewall is a hardware or software system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. Types include packet-filtering firewalls (examine IP headers), stateful inspection firewalls (track active connections), and application-layer firewalls (inspect HTTP, FTP payloads). A firewall can be implemented as a dedicated appliance or as host-based software.

防火墙是一种硬件或软件系统，根据预设的安全规则监控和控制进出网络的流量。类型包括包过滤防火墙（检查 IP 报头）、状态检测防火墙（跟踪活动连接）以及应用层防火墙（检查 HTTP、FTP 等负载）。防火墙可实现为专用设备或基于主机的软件。

Network segmentation divides a network into smaller subnetworks, limiting the spread of an attack and protecting sensitive data. A demilitarised zone (DMZ) places public-facing servers (web, email) in an isolated segment with restricted access to the internal LAN. VLANs and proper router ACLs (Access Control Lists) are practical implementations frequently referenced in CCEA scenario questions.

网络分段将网络划分为更小的子网，限制攻击的扩散并保护敏感数据。隔离区（DMZ）将面向公众的服务器（Web、邮件）置于隔离网段，并限制其对内部局域网的访问。VLAN 和合适的路由器访问控制列表（ACL）是 CCEA 情景题中经常引用的实际实现方式。

9. Intrusion Detection and Prevention Systems | 入侵检测与防御系统

An Intrusion Detection System (IDS) monitors network or system activities for malicious actions or policy violations, generating alerts when potential threats are found. An Intrusion Prevention System (IPS) goes a step further by actively blocking or dropping malicious traffic in real time. Both can be signature-based (matching known attack patterns) or anomaly-based (detecting deviations from a baseline).

入侵检测系统（IDS）监视网络或系统活动中的恶意行为或违规策略，一旦发现潜在威胁就生成警报。入侵防御系统（IPS）则更进一步，实时主动阻断或丢弃恶意流量。两者均可基于特征（匹配已知攻击模式）或基于异常（检测偏离基线的行为）。

In CCEA answers, you need to distinguish between IDS and IPS clearly. IDS is passive (detect and alert) and placed out-of-band, whereas IPS is inline and can block attacks automatically, but introduces latency and a potential single point of failure. Know that honeypots are decoy systems used to attract and analyse attackers, often complementing IDS.

在 CCEA 答案中，你需要清晰区分 IDS 和 IPS。IDS 是被动式的（检测并报警），以旁路方式部署；而 IPS 是串联在线的，可自动阻断攻击，但会引入延迟和潜在的单点故障。还需了解蜜罐是用于引诱和分析攻击者的诱饵系统，常与 IDS 互补使用。

10. Secure Protocols and VPNs | 安全协议与虚拟专用网络

Secure network protocols replace or enhance insecure legacy protocols. Key examples include HTTPS (HTTP over TLS), SSH (Secure Shell, replacing Telnet and FTP), SFTP/FTPS (secure file transfer), and DNSSEC (authenticating DNS responses). Exam candidates should know the default port numbers (e.g., HTTPS 443, SSH 22) and the purpose each protocol serves in defending against eavesdropping and spoofing.

安全网络协议用于取代或增强不安全的旧协议。关键示例包括 HTTPS（基于 TLS 的 HTTP）、SSH（安全外壳，取代 Telnet 和 FTP）、SFTP/FTPS（安全文件传输）以及 DNSSEC（对 DNS 响应进行认证）。考生应了解默认端口号（如 HTTPS 443、SSH 22）以及每种协议在防范窃听和欺骗方面的作用。

A Virtual Private Network (VPN) creates an encrypted tunnel across an untrusted network, such as the public internet. It allows remote users to securely access an organisation’s internal network. VPNs may use protocols like IPsec, SSL/TLS, or WireGuard. CCEA questions often link VPNs to teleworking scenarios and ask you to explain how data confidentiality and integrity are maintained.

虚拟专用网络（VPN）在不可信网络（如公共互联网）上建立加密隧道，使远程用户能够安全访问组织的内部网络。VPN 可使用 IPsec、SSL/TLS 或 WireGuard 等协议。CCEA 题目常将 VPN 与远程办公场景结合，要求你解释如何保持数据的机密性和完整性。

11. Security Policies and Access Control | 安全策略与访问控制

Organisational security policies define the rules, procedures, and responsibilities governing the protection of information assets. They cover areas such as acceptable use, password management, incident response, and data handling. Access control models (MAC, DAC, RBAC) determine how permissions are granted. RBAC (Role-Based Access Control) assigns permissions to roles rather than individuals, simplifying administration.

组织的安全策略定义了信息资产保护所依据的规则、流程与责任。它们涵盖可接受使用、密码管理、事件响应和数据处置等领域。访问控制模型（强制访问控制 MAC、自主访问控制 DAC、基于角色的访问控制 RBAC）决定了如何授予权限。RBAC 将权限赋予角色而非个人，简化了管理。

AA monitoring and logging provide accountability. Audit trails record who accessed what and when, supporting forensic analysis. CCEA assessment may involve evaluating the effectiveness of specific policies or identifying weaknesses in a given scenario. Always link policy components to the CIA triad: confidentiality, integrity, and availability.

监控和日志记录提供了可问责性。审计追踪记录了谁在何时访问了什么，为取证分析提供支持。CCEA 的考核可能涉及评估特定策略的有效性或识别特定场景中的弱点。始终将策略要素与 CIA 三元组（机密性、完整性、可用性）联系起来。

12. Data Validation, Verification, and Backups | 数据验证、核验与备份

Although often covered under software development, data validation and verification are critical security controls for maintaining data integrity. Validation (e.g., range, type, presence checks) ensures input falls within acceptable limits, mitigating attacks like SQL injection and buffer overflows. Verification (e.g., double entry, parity checks) confirms data correctness after transfer or storage.

尽管通常在软件开发中涉及，数据验证与核验是维护数据完整性的关键安全控制。验证（如范围检查、类型检查、存在性检查）确保输入在可接受范围内，从而缓解 SQL 注入和缓冲区溢出等攻击。核验（如双重录入、奇偶校验）则确认数据在传输或存储后的正确性。

Backups are a fundamental availability safeguard against ransomware, hardware failure, and accidental deletion. The 3-2-1 backup strategy (three copies, two different media, one offsite) is a widely recommended practice. CCEA questions may ask about the difference between full, incremental, and differential backups and their respective trade-offs in time and storage.

备份是针对勒索软件、硬件故障和意外删除的基本可用性保障。3-2-1 备份策略（三份副本，两种不同介质，一份异地存放）是广受推荐的做法。CCEA 题目可能问到完整备份、增量备份和差异备份之间的区别，以及它们在时间与存储方面的权衡。

Published by TutorHao | CCEA Computer Science Revision Series | aleveler.com

更多咨询请联系16621398022（同微信）

CCEA Computer Science – Network Security Exam Essentials | CCEA 计算机 – 网络安全考点精讲