Loading…

Worked solutions

IB Computer Science HL · Paper 3

Computer Science, Higher Level

Session: May 2015
Marks: 30
Duration: 1 hour
Calculator: Not allowed
Questions: 4

Keep your copy of the paper open alongside. We don't reproduce the questions: each part below is labelled to match the May 2015 Global paper, which your school or the IB can provide.

Practice mode

Hide our working until you've had a go.

Questions

Questions 1–4 · 30 marks

Question 1

4 marks

Brute-force decryption and Device Description Repositories in mobile banking

Networks
Web science

(a)

2 marks

Define the concept of brute-force decryption:
Brute-force decryption is an algorithmic cryptanalysis method that systematically attempts every possible permutation in a cryptographic keyspace until the correct secret key is discovered.
Its feasibility depends directly on the bit length of the cipher key and available computational hardware resources.

Mentor tip

Explain that it methodically tests all possible key permutations rather than exploiting algorithmic design flaws in the cipher.

(b)

2 marks

Outline the role of a Device Description Repository (DDR) in mobile banking:
A Device Description Repository maintains an extensive database of hardware profiles, screen resolutions, browser rendering capabilities, and supported operating system features for mobile devices.
Banking servers read the incoming HTTP User-Agent header, query the DDR, and tailor web content and interface styling to match the specific handset's screen and processing limits.

Mentor tip

Describe how the repository matches the User-Agent header to deliver an optimized interface layout tailored to the handset.

Question 2

8 marks

Balancing security with usability and dual encryption mechanics in SSL

System fundamentals
Networks

(a)

4 marks

Explain the trade-off between security and usability using a real-world banking scenario:
1) Context of interaction: Consider point-of-sale micro-transactions, such as purchasing a quick refreshment at a crowded retail coffee shop using a mobile banking application.
2) Enforcing high security controls: Requiring complex alphanumeric passphrases, multi-factor biometric checks, and out-of-band SMS verification tokens maximizes defense against unauthorized account access and device theft.
3) Impact on usability: Introducing multi-step authentication creates significant friction, delays transaction queues, and frustrates customers who demand instant payment clearance on the go.
4) User behavior consequence: Faced with cumbersome security barriers, consumers may abandon the digital banking app altogether and revert to physical cash or contactless cards, defeating the bank's digital adoption strategy.

Mentor tip

Use a concrete example (like quick in-store payments) to show how increasing defensive rigor degrades the speed and simplicity of the user experience.

(b)

4 marks

Describe how the SSL/TLS protocol combines asymmetric and symmetric encryption:
1) Initial asymmetric authentication and key exchange: During the SSL handshake, the web server transmits its digital certificate containing its asymmetric public key. The client verifies the certificate against trusted authorities, generates a random symmetric session key, and encrypts it using the server's public key.
2) Secure decryption by the server: Only the server possessing the corresponding private key can decrypt this transmission, successfully establishing a shared secret over an insecure channel.
3) Symmetric bulk data encryption: Once both endpoints share the identical session key, all subsequent HTTP request and response payloads are encrypted and decrypted using symmetric ciphers (such as AES).
4) Computational efficiency justification: Asymmetric cryptography requires heavy mathematical processing unsuitable for continuous high-throughput data streams, whereas symmetric encryption provides high computational speed and minimal CPU overhead for bulk transaction handling.

Mentor tip

Explain that asymmetric encryption solves the initial key distribution challenge, after which symmetric encryption handles bulk data exchange for optimal speed.

Question 3

6 marks

Mechanics and authentication countermeasures for Man-in-the-Browser attacks

Networks

(a)

2 marks

Outline the execution sequence of a Man-in-the-Browser (MitB) attack:
A Man-in-the-Browser attack employs a Trojan payload that installs itself inside the client's web browser as an extension, helper object, or malicious script.
While the customer interacts with a genuine online banking portal, the malware intercepts and covertly alters outgoing transaction details (such as recipient account numbers or transfer amounts) in memory immediately before encryption, leaving the user interface showing the user's intended values.

Mentor tip

State that the malware resides directly in the browser software and alters transaction parameters in memory prior to network encryption.

(b)

4 marks

Explain why only specific authentication methods can neutralize Man-in-the-Browser attacks:
1) Failure of standard in-band authentication: Conventional passwords, hardware token one-time codes entered into the browser, and SSL/TLS encryption fail against MitB. Because the Trojan operates inside the browser session after valid user authentication, the corrupted transaction data is submitted through the authenticated channel without raising browser alarms.
2) Success of out-of-band verification: Out-of-band authentication leverages an isolated, separate communication network and device, such as sending an SMS summary or dedicated push notification to the customer's mobile handset.
3) Contextual transaction signing: The out-of-band message explicitly displays the destination account number and financial sum received by the bank's central server.
4) Human detection and authorization: If the Trojan altered the destination account on the PC browser, the customer immediately spots the altered recipient details on their mobile handset display and declines the authorization code, preventing fraudulent fund diversion.

Mentor tip

Emphasize that in-band credentials cannot catch data modified after entry, whereas out-of-band transaction signing displays server-received details on a separate device.

Question 4

12 marks

Comparative strategic evaluation of QR codes versus NFC for mobile banking transactions

Networks

12 marks

Evaluate the adoption of QR codes compared to Near Field Communication (NFC) for TransEuropa's mobile payments and ATM withdrawals:
Technical operational principles:
- Near Field Communication (NFC): Operates via high-frequency short-range radio waves (typically 13.56 MHz) across distances under four centimeters. It supports active mode (powered by handset battery for bidirectional data exchange) and passive mode (handset powered via RF induction from POS terminals). Transactions often interact with a tamper-resistant Secure Element embedded in hardware or SIM cards.
- Quick Response (QR) codes: Operates via two-dimensional matrix optical barcodes encoding encrypted account identifiers, tokenized transaction strings, or dynamic URLs. Either the customer's mobile app displays a dynamic QR code scanned by an optical retail reader / ATM camera, or the phone camera scans a merchant-generated dynamic payment code.
Infrastructure accessibility and device ubiquity:
- QR code advantages: Extremely cost-effective and universally accessible. Almost every basic smartphone features a digital camera capable of processing QR barcodes, requiring no specialized hardware upgrades. Retailers and ATMs can deploy software updates and optical scanners without expensive terminal overhaul.
- NFC limitations: Requires dedicated NFC controller chips, secure hardware elements, and specialized POS contactless terminals. In 2015, widespread NFC adoption faced platform fragmentation, carrier disputes over SIM Secure Element control, and restricted vendor ecosystems.
Transaction speed, ergonomics, and usability:
- NFC contactless interaction: Enables rapid, zero-friction payments; users simply tap their smartphone against the terminal without needing to unlock device displays or align optical lenses, making it ideal for high-throughput transit and retail checkouts.
- QR code workflow: Demands explicit manual intervention: the user must unlock their handset, launch the banking wallet application, navigate to the QR scanner interface, and align the camera view over the code, introducing slight latency at checkout counters.
Security architectures and vulnerability vectors:
- Countering traditional cloning: Both technologies eliminate physical magstripe skimming and ATM card cloning by replacing static account numbers with dynamic, one-time payment tokens.
- QR security considerations: Vulnerable to optical eavesdropping in crowded public spaces, and static merchant QR codes can be physically pasted over with fraudulent redirect links (QRishing). However, dynamic, encrypted tokens generated in-app with tight time-to-live expirations mitigate visual harvesting.
- NFC security considerations: Mitigates eavesdropping via strict physical proximity constraints (under 4 cm), but remains theoretically exposed to relay attacks unless strict timeout metrics and secure element cryptography are strictly enforced.
Strategic synthesis and conclusion:
For TransEuropa, choosing QR code technology provides immediate operational scalability across both developed European branches and emerging developing markets with legacy POS terminals. Its zero-barrier smartphone compatibility outweighs the slight speed advantages of NFC, delivering universal mobile payment and cardless ATM capabilities across diverse socioeconomic customer bases.

Mentor tip

Structure the essay with clear analytical sections: technical mechanics, hardware accessibility/costs, usability/speed, security strengths/weaknesses, and a justified business conclusion.

Our analysis

Where the marks are

Each part sorted by the topic it mostly tests. Networks carries the most marks on this paper.

Networks24 marks · 80%
Q1, Q2, Q3, Q4
System fundamentals4 marks · 13%
Q2
Web science2 marks · 7%
Q1

Mentor insights

Traps to watch for

01
Confusing brute-force password guessing with cipher key decryption · Q1
In cryptographic contexts, brute-force decryption refers to methodically attempting all possible mathematical keys in a cipher keyspace (e.g., 2048-bit RSA or 128-bit AES), not merely guessing dictionary login passwords.
02
Believing SSL uses asymmetric encryption for the entire session · Q2
Asymmetric cryptography is only used during the initial SSL handshake to authenticate the server and securely exchange the session key; symmetric ciphers encrypt all subsequent data flow for speed.
03
Assuming SSL/TLS prevents Man-in-the-Browser attacks · Q3
SSL encrypts data in transit across the external network, but MitB malware alters the transaction data inside the browser's local memory before SSL encryption ever occurs.

Solutions and tips are GeorgeTheTutor's own; the questions are not reproduced here. Not affiliated with or endorsed by the International Baccalaureate Organization.

Want someone to go through your paper with you?

Our maths mentors took these exams recently. One-to-one, they'll find where your marks are going and fix it before May.

Find your maths mentor More past papers

Worked solutions

IB Computer Science HL · Paper 3

Computer Science, Higher Level

Session: May 2015
Marks: 30
Duration: 1 hour
Calculator: Not allowed
Questions: 4

Q1 Q2 Q3 Q4

Keep your copy of the paper open alongside. We don't reproduce the questions: each part below is labelled to match the May 2015 Global paper, which your school or the IB can provide.

Practice mode

Hide our working until you've had a go.

Questions

Questions 1–4 · 30 marks

Question 1

4 marks

Brute-force decryption and Device Description Repositories in mobile banking

Networks
Web science

(a)

2 marks

Define the concept of brute-force decryption:
Brute-force decryption is an algorithmic cryptanalysis method that systematically attempts every possible permutation in a cryptographic keyspace until the correct secret key is discovered.
Its feasibility depends directly on the bit length of the cipher key and available computational hardware resources.

Mentor tip

Explain that it methodically tests all possible key permutations rather than exploiting algorithmic design flaws in the cipher.

(b)

2 marks

Outline the role of a Device Description Repository (DDR) in mobile banking:
A Device Description Repository maintains an extensive database of hardware profiles, screen resolutions, browser rendering capabilities, and supported operating system features for mobile devices.
Banking servers read the incoming HTTP User-Agent header, query the DDR, and tailor web content and interface styling to match the specific handset's screen and processing limits.

Mentor tip

Describe how the repository matches the User-Agent header to deliver an optimized interface layout tailored to the handset.

Question 2

8 marks

Balancing security with usability and dual encryption mechanics in SSL

System fundamentals
Networks

(a)

4 marks

Explain the trade-off between security and usability using a real-world banking scenario:
1) Context of interaction: Consider point-of-sale micro-transactions, such as purchasing a quick refreshment at a crowded retail coffee shop using a mobile banking application.
2) Enforcing high security controls: Requiring complex alphanumeric passphrases, multi-factor biometric checks, and out-of-band SMS verification tokens maximizes defense against unauthorized account access and device theft.
3) Impact on usability: Introducing multi-step authentication creates significant friction, delays transaction queues, and frustrates customers who demand instant payment clearance on the go.
4) User behavior consequence: Faced with cumbersome security barriers, consumers may abandon the digital banking app altogether and revert to physical cash or contactless cards, defeating the bank's digital adoption strategy.

Mentor tip

Use a concrete example (like quick in-store payments) to show how increasing defensive rigor degrades the speed and simplicity of the user experience.

(b)

4 marks

Describe how the SSL/TLS protocol combines asymmetric and symmetric encryption:
1) Initial asymmetric authentication and key exchange: During the SSL handshake, the web server transmits its digital certificate containing its asymmetric public key. The client verifies the certificate against trusted authorities, generates a random symmetric session key, and encrypts it using the server's public key.
2) Secure decryption by the server: Only the server possessing the corresponding private key can decrypt this transmission, successfully establishing a shared secret over an insecure channel.
3) Symmetric bulk data encryption: Once both endpoints share the identical session key, all subsequent HTTP request and response payloads are encrypted and decrypted using symmetric ciphers (such as AES).
4) Computational efficiency justification: Asymmetric cryptography requires heavy mathematical processing unsuitable for continuous high-throughput data streams, whereas symmetric encryption provides high computational speed and minimal CPU overhead for bulk transaction handling.

Mentor tip

Explain that asymmetric encryption solves the initial key distribution challenge, after which symmetric encryption handles bulk data exchange for optimal speed.

Question 3

6 marks

Mechanics and authentication countermeasures for Man-in-the-Browser attacks

Networks

(a)

2 marks

Outline the execution sequence of a Man-in-the-Browser (MitB) attack:
A Man-in-the-Browser attack employs a Trojan payload that installs itself inside the client's web browser as an extension, helper object, or malicious script.
While the customer interacts with a genuine online banking portal, the malware intercepts and covertly alters outgoing transaction details (such as recipient account numbers or transfer amounts) in memory immediately before encryption, leaving the user interface showing the user's intended values.

Mentor tip

State that the malware resides directly in the browser software and alters transaction parameters in memory prior to network encryption.

(b)

4 marks

Explain why only specific authentication methods can neutralize Man-in-the-Browser attacks:
1) Failure of standard in-band authentication: Conventional passwords, hardware token one-time codes entered into the browser, and SSL/TLS encryption fail against MitB. Because the Trojan operates inside the browser session after valid user authentication, the corrupted transaction data is submitted through the authenticated channel without raising browser alarms.
2) Success of out-of-band verification: Out-of-band authentication leverages an isolated, separate communication network and device, such as sending an SMS summary or dedicated push notification to the customer's mobile handset.
3) Contextual transaction signing: The out-of-band message explicitly displays the destination account number and financial sum received by the bank's central server.
4) Human detection and authorization: If the Trojan altered the destination account on the PC browser, the customer immediately spots the altered recipient details on their mobile handset display and declines the authorization code, preventing fraudulent fund diversion.

Mentor tip

Emphasize that in-band credentials cannot catch data modified after entry, whereas out-of-band transaction signing displays server-received details on a separate device.

Question 4

12 marks

Comparative strategic evaluation of QR codes versus NFC for mobile banking transactions

Networks

12 marks

Evaluate the adoption of QR codes compared to Near Field Communication (NFC) for TransEuropa's mobile payments and ATM withdrawals:
Technical operational principles:
- Near Field Communication (NFC): Operates via high-frequency short-range radio waves (typically 13.56 MHz) across distances under four centimeters. It supports active mode (powered by handset battery for bidirectional data exchange) and passive mode (handset powered via RF induction from POS terminals). Transactions often interact with a tamper-resistant Secure Element embedded in hardware or SIM cards.
- Quick Response (QR) codes: Operates via two-dimensional matrix optical barcodes encoding encrypted account identifiers, tokenized transaction strings, or dynamic URLs. Either the customer's mobile app displays a dynamic QR code scanned by an optical retail reader / ATM camera, or the phone camera scans a merchant-generated dynamic payment code.
Infrastructure accessibility and device ubiquity:
- QR code advantages: Extremely cost-effective and universally accessible. Almost every basic smartphone features a digital camera capable of processing QR barcodes, requiring no specialized hardware upgrades. Retailers and ATMs can deploy software updates and optical scanners without expensive terminal overhaul.
- NFC limitations: Requires dedicated NFC controller chips, secure hardware elements, and specialized POS contactless terminals. In 2015, widespread NFC adoption faced platform fragmentation, carrier disputes over SIM Secure Element control, and restricted vendor ecosystems.
Transaction speed, ergonomics, and usability:
- NFC contactless interaction: Enables rapid, zero-friction payments; users simply tap their smartphone against the terminal without needing to unlock device displays or align optical lenses, making it ideal for high-throughput transit and retail checkouts.
- QR code workflow: Demands explicit manual intervention: the user must unlock their handset, launch the banking wallet application, navigate to the QR scanner interface, and align the camera view over the code, introducing slight latency at checkout counters.
Security architectures and vulnerability vectors:
- Countering traditional cloning: Both technologies eliminate physical magstripe skimming and ATM card cloning by replacing static account numbers with dynamic, one-time payment tokens.
- QR security considerations: Vulnerable to optical eavesdropping in crowded public spaces, and static merchant QR codes can be physically pasted over with fraudulent redirect links (QRishing). However, dynamic, encrypted tokens generated in-app with tight time-to-live expirations mitigate visual harvesting.
- NFC security considerations: Mitigates eavesdropping via strict physical proximity constraints (under 4 cm), but remains theoretically exposed to relay attacks unless strict timeout metrics and secure element cryptography are strictly enforced.
Strategic synthesis and conclusion:
For TransEuropa, choosing QR code technology provides immediate operational scalability across both developed European branches and emerging developing markets with legacy POS terminals. Its zero-barrier smartphone compatibility outweighs the slight speed advantages of NFC, delivering universal mobile payment and cardless ATM capabilities across diverse socioeconomic customer bases.

Mentor tip

Structure the essay with clear analytical sections: technical mechanics, hardware accessibility/costs, usability/speed, security strengths/weaknesses, and a justified business conclusion.

Our analysis

Where the marks are

Each part sorted by the topic it mostly tests. Networks carries the most marks on this paper.

Networks24 marks · 80%
Q1, Q2, Q3, Q4
System fundamentals4 marks · 13%
Q2
Web science2 marks · 7%
Q1

Mentor insights

Traps to watch for

01
Confusing brute-force password guessing with cipher key decryption · Q1
In cryptographic contexts, brute-force decryption refers to methodically attempting all possible mathematical keys in a cipher keyspace (e.g., 2048-bit RSA or 128-bit AES), not merely guessing dictionary login passwords.
02
Believing SSL uses asymmetric encryption for the entire session · Q2
Asymmetric cryptography is only used during the initial SSL handshake to authenticate the server and securely exchange the session key; symmetric ciphers encrypt all subsequent data flow for speed.
03
Assuming SSL/TLS prevents Man-in-the-Browser attacks · Q3
SSL encrypts data in transit across the external network, but MitB malware alters the transaction data inside the browser's local memory before SSL encryption ever occurs.

Solutions and tips are GeorgeTheTutor's own; the questions are not reproduced here. Not affiliated with or endorsed by the International Baccalaureate Organization.

Want someone to go through your paper with you?

Our maths mentors took these exams recently. One-to-one, they'll find where your marks are going and fix it before May.

Find your maths mentor More past papers