How the Paper Is Set, and How to Answer It
Chapter One Hundred One
Syllabus topic Module 2, the examination itself
Pages 668 to 672 of 678
In one line
Thirty marks in sixty minutes, six answers of five marks each, chosen two from four in each of three questions, where the third question deliberately crosses both modules: which means short, complete, well-labelled answers, and breadth of preparation rather than depth in a few favourites.
The pattern
| Type | Theory. 2 credits, 30 hours, 50 marks in all |
| External | Semester End Theory Examination, 1 hour, 30 marks |
| Q.1 | on Module 1, answer any 2 of 4, 10 marks |
| Q.2 | on Module 2, answer any 2 of 4, 10 marks |
| Q.3 | on Modules 1 and 2 together, answer any 2 of 4, 10 marks |
| Internal | 20 marks: Class Test 1 on Module 1 for 10 and Class Test 2 on Module 2 for 10, averaged to 10; an assignment on each module for 5 each, 10 in all |
Q.3 is the one students are least ready for, because it is drawn from both modules together, which means comparisons: symmetric against public-key, a MAC against a digital signature, IPsec against SSL. The next and last chapter of this book exists for that question alone.
The run: what an hour buys
# The paper, in numbers: what one hour buys, and what "any two of four" is worth to a student
# who has prepared part of the syllabus. The pattern is MU's own; the arithmetic is here.
from math import comb
MINUTES, EXTERNAL = 60, 30
QUESTIONS, CHOOSE, OF = 3, 2, 4
PER_ANSWER = EXTERNAL // (QUESTIONS * CHOOSE)
print('1. THE PAPER')
print(' %d marks in %d minutes: %d questions, any %d of %d in each, %d marks an answer'
% (EXTERNAL, MINUTES, QUESTIONS, CHOOSE, OF, PER_ANSWER))
print(' Q.1 Module 1 Q.2 Module 2 Q.3 both modules together')
print(' answers to write: %d' % (QUESTIONS * CHOOSE))
print(' minutes an answer, if none are spent choosing: %.1f'
% (MINUTES / (QUESTIONS * CHOOSE)))
for reading in (5, 8):
left = MINUTES - reading
print(' after %d minutes reading the paper and choosing: %.1f minutes an answer'
% (reading, left / (QUESTIONS * CHOOSE)))
print(' at a considered 20 words a minute, that is about %d words: a page and a half'
% round((MINUTES - 8) / (QUESTIONS * CHOOSE) * 20, -1))
# ---- 2. the internal 20 --------------------------------------------------------------------
print()
print('2. THE INTERNAL 20')
tests = [('Class Test 1, on Module 1', 10), ('Class Test 2, on Module 2', 10)]
average = sum(m for _, m in tests) / len(tests)
assignments = [('an assignment on Module 1', 5), ('an assignment on Module 2', 5)]
print(' %s and %s, averaged to %.0f' % (tests[0][0], tests[1][0], average))
print(' %s and %s, %d in all' % (assignments[0][0], assignments[1][0],
sum(m for _, m in assignments)))
print(' internal total %.0f, external %d, paper total %.0f'
% (average + sum(m for _, m in assignments), EXTERNAL,
average + sum(m for _, m in assignments) + EXTERNAL))
# ---- 3. what "any two of four" is worth -----------------------------------------------------
def at_least_two_of_four(p):
"""If each of the four parts is one you can answer with probability p, and they are
independent, this is the chance that at least two of them are. An idealisation: real
papers are not drawn at random. It still shows the shape."""
return sum(comb(OF, k) * p ** k * (1 - p) ** (OF - k) for k in range(CHOOSE, OF + 1))
print()
print('3. WHY BREADTH BEATS DEPTH IN THIS PATTERN')
print(' share of the can answer 2 of 4 can do it in all')
print(' syllabus you in one question three questions')
print(' have prepared')
for prepared in (0.4, 0.5, 0.6, 0.7, 0.8, 0.9):
one = at_least_two_of_four(prepared)
print(' %13.0f%% %16.1f%% %16.1f%%'
% (prepared * 100, one * 100, one ** QUESTIONS * 100))
print(' the third column falls much faster than the first, because all three questions')
print(' must be attempted. Preparing 90 per cent of the syllabus is not 1.8 times as')
print(' good as preparing 50 per cent of it: it is about three times as good.')
# ---- 4. eight minutes, spent -----------------------------------------------------------------
print()
print('4. HOW TO SPEND THE EIGHT MINUTES OF ONE ANSWER')
PLAN = [('write the definition', 1), ('name the parts, numbered', 2),
('draw the small figure', 2), ('give the distinction or example', 2),
('one closing line', 1)]
spent = 0
for what, minutes in PLAN:
spent += minutes
print(' %-32s %d minute(s), %d gone' % (what, minutes, spent))
print(' the marks are in the NAMED PARTS and the FIGURE, not in the opening sentence')How the Paper Is Set, and How to Answer It
1. THE PAPER
30 marks in 60 minutes: 3 questions, any 2 of 4 in each, 5 marks an answer
Q.1 Module 1 Q.2 Module 2 Q.3 both modules together
answers to write: 6
minutes an answer, if none are spent choosing: 10.0
after 5 minutes reading the paper and choosing: 9.2 minutes an answer
after 8 minutes reading the paper and choosing: 8.7 minutes an answer
at a considered 20 words a minute, that is about 170 words: a page and a half
2. THE INTERNAL 20
Class Test 1, on Module 1 and Class Test 2, on Module 2, averaged to 10
an assignment on Module 1 and an assignment on Module 2, 10 in all
internal total 20, external 30, paper total 50
3. WHY BREADTH BEATS DEPTH IN THIS PATTERN
share of the can answer 2 of 4 can do it in all
syllabus you in one question three questions
have prepared
40% 52.5% 14.5%
50% 68.8% 32.5%
60% 82.1% 55.3%
70% 91.6% 76.9%
80% 97.3% 92.1%
90% 99.6% 98.9%
the third column falls much faster than the first, because all three questions
must be attempted. Preparing 90 per cent of the syllabus is not 1.8 times as
good as preparing 50 per cent of it: it is about three times as good.
4. HOW TO SPEND THE EIGHT MINUTES OF ONE ANSWER
write the definition 1 minute(s), 1 gone
name the parts, numbered 2 minute(s), 3 gone
draw the small figure 2 minute(s), 5 gone
give the distinction or example 2 minute(s), 7 gone
one closing line 1 minute(s), 8 gone
the marks are in the NAMED PARTS and the FIGURE, not in the opening sentenceHow the Paper Is Set, and How to Answer It
What the run establishes, in order.
Under nine minutes an answer. Six answers in sixty minutes is ten minutes each, and reading the paper and choosing takes the first five to eight. At a considered twenty words a minute that is about 170 words: a page and a half in an ordinary hand. An answer three pages long is not a better answer; it is two answers' worth of time spent on one.
The internal is not an afterthought. Two class tests averaged to ten, plus two assignments of five, are 20 of the 50 marks, and they are the marks over which a student has the most control.
Breadth beats depth, and the numbers are stark. Preparing half the syllabus gives about a 69 per cent chance of finding two answerable parts in one question, but only about 33 per cent of managing it in all three. Preparing 80 per cent gives 92 per cent. The reason is that all three questions must be attempted, so the per-question chance is multiplied by itself three times.
Eight minutes has a shape. A definition, the named parts numbered, a small figure, a distinction or example, and one closing line. The marks are in the named parts and the figure.
What a 5-mark answer looks like
Two examples, written to the length the arithmetic allows.
Q.2 (b) Explain the SYN flooding attack and two defences against it.
When a client opens a TCP connection it sends a SYN, and the server replies with a SYN-ACK and keeps state for the half-open connection until the handshake completes or times out. In a SYN flood the attacker sends many SYNs with source addresses that will never answer, so the entries remain until they expire; when the backlog of half-open connections is full, genuine connections are refused. The attack needs very little bandwidth: a backlog of 128 entries held for 120 seconds is kept full by about one packet a second.
How the Paper Is Set, and How to Answer It
Two defences. SYN cookies: the server keeps no state at all on receiving a SYN, encoding what it needs into the sequence number it sends and recovering it from the client's reply, so there is no table left to exhaust. Reducing the SYN-RECEIVED timer, or recycling the oldest half-open entry, which frees space sooner, at the cost of dropping some genuine clients on slow connections.
Q.1 (c) Distinguish a message authentication code from a digital signature.
Both prove that a message has not been altered, and both are computed over the whole message, but they differ in the key used and therefore in what they prove.
A MAC is computed with a secret key shared between sender and receiver, for example HMAC-SHA-256. Either party can compute it, so the receiver knows the message came from someone holding the key, but cannot prove to anyone else which of them sent it. It gives integrity and authentication, not non-repudiation.
A digital signature is computed with the sender's private key and checked with the matching public key. Only the holder of the private key can produce it, and anyone at all can check it, so it gives integrity, authentication and non-repudiation, and can be shown to a third party as evidence. A signature is larger and much slower to compute than a MAC, which is why MACs protect bulk traffic and signatures protect keys, certificates and documents.
How to answer, in seven rules
- Read all twelve parts first and choose six. Five minutes here saves more than it costs.
- Answer the question that was asked. "Distinguish" wants a comparison, not two descriptions.
- Define first, in one sentence, before anything else.
- Number the parts. Examiners award marks against named items, and a numbered list makes them findable.
- Draw the small figure where the topic has one: the IPsec modes, the firewall configurations, the malware map. It is quick and it is worth marks.
- Give one concrete example or figure, such as the 8.5-second doubling, the 166-day patch gap, or the six-hour reporting duty. Specifics separate a good answer from a vague one.
- Stop at a page and a half and go to the next answer. An unanswered part scores zero, and no answer scores more than five.
What loses marks
- Writing everything you know about the topic instead of what was asked.
- No definition, so the first mark is missing.
- A wall of prose with no numbering and no figure.
- Running out of time and leaving the sixth answer blank: that is five marks of the thirty.
- Answering three parts of one question when only two are counted.
- Vagueness: "very secure", "it is fast". Which algorithm, how many bits, what date.
How the Paper Is Set, and How to Answer It
Quick revision
- External: 1 hour, 30 marks; Q.1 Module 1, Q.2 Module 2, Q.3 both; any 2 of 4, 5 marks each.
- Internal: 20 = two class tests averaged to 10, plus two assignments of 5.
- About 8.7 minutes and 170 words an answer after choosing.
- Shape: definition, numbered parts, figure, distinction or example, closing line.
- Q.3 is comparisons across both modules: prepare them deliberately.
- Prepare breadth: half the syllabus gives about a third chance of a full attempt; 80 per cent gives about 92 per cent.
Test yourself
1. State the pattern of the external examination. One hour, thirty marks, in three questions. Question 1 is set on Module 1, question 2 on Module 2, and question 3 on both modules together. Each question has four parts of which any two are to be answered, so six answers are written in all, each worth five marks.
2. How are the internal twenty marks made up? By two class tests, one on each module, each marked out of ten and the two averaged to give ten marks, together with one assignment on each module, each worth five marks, giving ten more: twenty in all, which with the thirty of the external examination makes the subject's fifty.
3. How long is an answer, and what should it contain? About eight to nine minutes of writing, which is roughly 170 words or a page and a half. It should open with a one-sentence definition, then give the parts of the answer as a numbered list, include the small figure if the topic has one, give a distinction or a concrete example with real figures, and close with a single sentence. Length beyond that takes time from another answer, which is worth five marks.
4. Why does the pattern reward breadth of preparation? Because all three questions must be attempted and each requires two answerable parts out of four. The chance of managing that in one question is high even with partial preparation, but it must be achieved three times over, so the chance of a full attempt is that figure multiplied by itself three times. Preparing half the syllabus gives roughly a two-in-three chance per question but only about one in three overall, while preparing 80 per cent gives about 92 per cent.
5. What kind of question is question 3, and how do you prepare for it? It is drawn from Modules 1 and 2 together, which in practice means comparisons that span the two: symmetric against public-key cryptography, a message authentication code against a digital signature, a hash against a MAC, IPsec against SSL or TLS, PGP against S/MIME, and a firewall against an intrusion detection system. You prepare by learning each as a table of differences with the one sentence that decides between them, which is the subject of the last chapter of this book.
The rest of this subject
These notes are cut from the University's printed syllabus. Open the syllabus itself for the same subject.