Loading…

Worked solutions

IB Computer Science HL · Paper 3

Computer Science, Higher Level

Session: November 2015
Marks: 30
Duration: 1 hour
Calculator: Not allowed
Questions: 4

Keep your copy of the paper open alongside. We don't reproduce the questions: each part below is labelled to match the November 2015 Global paper, which your school or the IB can provide.

Practice mode

Hide our working until you've had a go.

Questions

Questions 1–4 · 30 marks

Question 1

4 marks

Wi-Fi Protected Access standards and SIM Application Toolkit in mobile financial systems

Networks

(a)

2 marks

Define the wireless security protocol WPA (Wi-Fi Protected Access):
WPA is a wireless network security standard developed by the Wi-Fi Alliance to replace vulnerable WEP encryption across IEEE 802.11 local area networks.
It incorporates the Temporal Key Integrity Protocol (TKIP) or Advanced Encryption Standard (AES) with dynamic per-packet key generation and 802.1X/pre-shared key authentication to protect wireless communications from unauthorized interception.

Mentor tip

Identify WPA as an encrypted wireless networking standard created to supersede WEP using dynamic key rotation.

(b)

2 marks

Outline the function of the SIM Application Toolkit (STK) within mobile financial systems like M-PESA:
The SIM Application Toolkit provides programmed firmware capabilities embedded directly on a subscriber's SIM card that initiate actions independent of the phone's handset operating system.
In mobile banking, it renders interactive menu options on the handset screen, receives user PIN inputs securely, and transmits encrypted SMS payment commands directly to telecommunication servers, enabling financial services on basic feature phones.

Mentor tip

Explain that the STK executes directly on the SIM card to present secure menus and dispatch encrypted transactional messages even on entry-level feature phones.

Question 2

8 marks

Push versus pull messaging paradigms in SMS banking and QR code ATM cash withdrawals

Networks

(a)

4 marks

Distinguish between push and pull technologies in SMS banking using illustrative examples:
1) Pull technology (Client-initiated): The mobile subscriber explicitly triggers an interaction by transmitting an outbound SMS enquiry or command keyword to the bank's short-code server (for example, texting 'BAL' to check the current checking account balance or 'MINI' for recent debits). The server receives the inbound query, processes the database request, and returns an answer.
2) Push technology (Server-initiated): The bank's central mainframe server automatically initiates and broadcasts outbound SMS notifications to the client's registered device without immediate user prompting, triggered by specific business rules or events (such as real-time alerts for large card debits, low-balance warnings, or unusual international transactions).
3) Core operational difference: Pull relies on asynchronous on-demand customer querying, whereas push provides event-driven, automated broadcasts designed for risk management and real-time transaction awareness.

Mentor tip

Provide a distinct real-world banking example for both modes: customer requesting balances (pull) versus bank broadcasting automated debit fraud alerts (push).

(b)

4 marks

Explain how a mobile application facilitates cardless cash withdrawals at an ATM using QR code technology:
1) Transaction staging in-app: The customer logs into their secure mobile banking application, selects a cardless withdrawal option, specifies the withdrawal amount, and authorizes the request using their mobile PIN or biometric credentials.
2) Optical session pairing: The ATM display generates a dynamic, time-limited QR code containing encrypted session tokens, ATM hardware identifiers, and a cryptographic nonce. The customer uses their smartphone camera to scan this code (or conversely, the ATM's optical scanner reads a dynamic QR code generated on the user's mobile screen).
3) Server-side validation: The mobile app transmits the scanned payload back to the bank's centralized authentication server over an encrypted cellular connection, pairing the physical ATM terminal session with the customer's authenticated digital profile.
4) Automated cash dispensing: Upon verifying that the token is unexpired, matches the ATM terminal ID, and that sufficient funds exist, the banking backend transmits a command to the physical ATM cash dispenser, completing the transaction without inserting a plastic card.

Mentor tip

Break down the steps logically: in-app amount selection, optical scanning of a dynamic token, server-side session pairing, and physical cash dispensing.

Question 3

6 marks

Procedural handshake steps for establishing secure SSL/TLS banking sessions

Networks

6 marks

Describe the sequential procedural steps executed during the SSL/TLS handshake to establish a secure connection with an online banking portal:
1) Client Hello: The client browser initiates the handshake by dispatching a 'Client Hello' packet to the bank's web server, containing supported TLS protocol versions, available cipher suites (encryption algorithms), and a pseudo-random client byte string.
2) Server Hello and Certificate Delivery: The banking server responds with a 'Server Hello', selecting the strongest mutually supported cipher suite and supplying its digital certificate (often an Extended Validation certificate) signed by a trusted Certificate Authority, which embeds the bank's asymmetric public key and a server random byte string.
3) Trust Validation: The client browser validates the certificate against its pre-installed root CA store, verifying the certificate's validity dates, digital signature, and revocation status to authenticate the server's identity.
4) Premaster Secret Generation and Transmission: The client generates a random premaster secret, encrypts it using the bank server's asymmetric public key, and transmits it across the network. Only the bank's authentic private key can decrypt this transmission.
5) Session Key Derivation: Both client and server independently compute the identical symmetric session master key using the premaster secret combined with the previously exchanged random byte strings.
6) Finished Handshake and Symmetric Encryption: Both endpoints exchange encrypted 'Finished' verification messages confirming handshake integrity. All subsequent HTTP payloads (account numbers, balances, financial transfers) are protected using high-speed symmetric encryption.

Mentor tip

List the chronological steps: Client Hello, Server Hello with certificate, CA verification, premaster key exchange using the public key, symmetric key derivation, and finished verification.

Question 4

12 marks

Evaluating biometric authentication for fraud mitigation and user adoption in mobile banking

System fundamentals

12 marks

Evaluate whether adopting biometric authentication for mobile banking users represents an satisfactory and successful strategy for reducing fraud losses at TransEuropa:
Fraud risks in traditional banking authentication:
- Weaknesses of knowledge-based credentials: Single-factor passwords, PINs, and static security questions are highly susceptible to credential stuffing, dictionary guessing, keylogger Trojans (such as Man-in-the-Browser), and social engineering scams.
- Limitations of hardware TAN generators and SMS tokens: Physical keypads generating Transaction Authentication Numbers (TANs) provide strong two-factor security but impose hardware distribution expenses and usability burdens. SMS one-time passwords remain vulnerable to SIM-swapping exploits and network interception.
Advances in mobile biometric modalities:
- Technological capabilities: Modern smartphones integrate sophisticated physiological sensors, including capacitive and ultrasonic fingerprint scanners, 3D facial structured-light projectors, and iris recognition cameras.
- Storage architecture and Secure Enclaves: Rather than transmitting raw biometric images over public networks, modern handsets process scans locally within hardware-isolated coprocessors (Secure Enclaves), converting traits into irreversible mathematical hashes and releasing cryptographic signing keys only upon successful matching.
Effectiveness in mitigating financial fraud:
- Inherent binding to identity: Biometrics represent something the user 'is', which cannot be easily forgotten, shared, or stolen via standard phishing campaigns, substantially reducing unauthorized account takeovers.
- Integration with multi-factor frameworks: Combining biometrics with a known PIN (something the user knows) and device possession bound to a hardware key (something the user has) creates a highly resilient multi-factor defense that stops automated botnets and credential stuffing cold.
Limitations, failure modes, and security challenges:
- False Rejection and False Match Rates (FRR/FAR): Imperfect environmental conditions (wet fingers, poor lighting, sunglasses) cause false rejections that lock legitimate customers out of vital financial services. In rare instances, biometric spoofing (silicone molds or high-resolution 3D masks) can trigger false positive matches.
- Irrevocability of biometric compromise: Unlike a compromised password or credit card number that can be instantaneously changed, a user's stolen fingerprint or retinal scan cannot be reissued, creating permanent security liability.
Customer adoption willingness, privacy, and regulatory concerns:
- Usability advantages: Unlocking an application or authorizing a money transfer via a momentary fingerprint touch or glance provides near-zero friction, dramatically enhancing user convenience compared to carrying external TAN keypads.
- Privacy apprehensions: Privacy-conscious customers often harbor distrust regarding corporate storage of their personal biological markers, fearing state surveillance or catastrophic centralized database leaks.
- Accessibility and handset inequality: Low-income and rural customers utilizing budget smartphones or basic feature phones (as in TransEuropa's developing markets using M-PESA/STK) lack biometric hardware entirely, making universal biometric mandates impractical.
Comprehensive strategic synthesis:
TransEuropa should implement biometric authentication as a preferred, non-exclusive component of a risk-adaptive multi-factor framework. Enabling biometrics for daily transactions on equipped smartphones maximizes user convenience and suppresses credential fraud, while retaining secure tokenized fallbacks (such as hardware TANs or secure app-based authenticators) ensures accessibility across diverse customer demographics.

Mentor tip

Provide a well-rounded analysis covering fraud reduction, technical mechanics (Secure Enclaves), usability benefits, false rejection issues, privacy concerns, and hardware disparities across customer segments.

Our analysis

Where the marks are

Each part sorted by the topic it mostly tests. Networks carries the most marks on this paper.

Networks18 marks · 60%
Q1, Q2, Q3
System fundamentals12 marks · 40%
Q4

Mentor insights

Traps to watch for

01
Confusing WPA with WEP encryption · Q1
WPA was specifically engineered to replace the deeply flawed WEP protocol, introducing dynamic per-packet key generation (TKIP/AES) rather than static encryption keys.
02
Reversing the public and private key roles during the SSL handshake · Q3
The server's public key encrypts the premaster secret on the client, and only the server's private key can decrypt it; the private key is never shared or used to encrypt the premaster secret directly.
03
Assuming biometric templates are transmitted as raw images to bank servers · Q4
Modern mobile biometric systems do not transmit raw fingerprint or face pictures across the network; they generate local mathematical hashes inside hardware Secure Enclaves that authorize cryptographic keys locally.

Solutions and tips are GeorgeTheTutor's own; the questions are not reproduced here. Not affiliated with or endorsed by the International Baccalaureate Organization.

Want someone to go through your paper with you?

Our maths mentors took these exams recently. One-to-one, they'll find where your marks are going and fix it before May.

Find your maths mentor More past papers

Worked solutions

IB Computer Science HL · Paper 3

Computer Science, Higher Level

Session: November 2015
Marks: 30
Duration: 1 hour
Calculator: Not allowed
Questions: 4

Q1 Q2 Q3 Q4

Keep your copy of the paper open alongside. We don't reproduce the questions: each part below is labelled to match the November 2015 Global paper, which your school or the IB can provide.

Practice mode

Hide our working until you've had a go.

Questions

Questions 1–4 · 30 marks

Question 1

4 marks

Wi-Fi Protected Access standards and SIM Application Toolkit in mobile financial systems

Networks

(a)

2 marks

Define the wireless security protocol WPA (Wi-Fi Protected Access):
WPA is a wireless network security standard developed by the Wi-Fi Alliance to replace vulnerable WEP encryption across IEEE 802.11 local area networks.
It incorporates the Temporal Key Integrity Protocol (TKIP) or Advanced Encryption Standard (AES) with dynamic per-packet key generation and 802.1X/pre-shared key authentication to protect wireless communications from unauthorized interception.

Mentor tip

Identify WPA as an encrypted wireless networking standard created to supersede WEP using dynamic key rotation.

(b)

2 marks

Outline the function of the SIM Application Toolkit (STK) within mobile financial systems like M-PESA:
The SIM Application Toolkit provides programmed firmware capabilities embedded directly on a subscriber's SIM card that initiate actions independent of the phone's handset operating system.
In mobile banking, it renders interactive menu options on the handset screen, receives user PIN inputs securely, and transmits encrypted SMS payment commands directly to telecommunication servers, enabling financial services on basic feature phones.

Mentor tip

Explain that the STK executes directly on the SIM card to present secure menus and dispatch encrypted transactional messages even on entry-level feature phones.

Question 2

8 marks

Push versus pull messaging paradigms in SMS banking and QR code ATM cash withdrawals

Networks

(a)

4 marks

Distinguish between push and pull technologies in SMS banking using illustrative examples:
1) Pull technology (Client-initiated): The mobile subscriber explicitly triggers an interaction by transmitting an outbound SMS enquiry or command keyword to the bank's short-code server (for example, texting 'BAL' to check the current checking account balance or 'MINI' for recent debits). The server receives the inbound query, processes the database request, and returns an answer.
2) Push technology (Server-initiated): The bank's central mainframe server automatically initiates and broadcasts outbound SMS notifications to the client's registered device without immediate user prompting, triggered by specific business rules or events (such as real-time alerts for large card debits, low-balance warnings, or unusual international transactions).
3) Core operational difference: Pull relies on asynchronous on-demand customer querying, whereas push provides event-driven, automated broadcasts designed for risk management and real-time transaction awareness.

Mentor tip

Provide a distinct real-world banking example for both modes: customer requesting balances (pull) versus bank broadcasting automated debit fraud alerts (push).

(b)

4 marks

Explain how a mobile application facilitates cardless cash withdrawals at an ATM using QR code technology:
1) Transaction staging in-app: The customer logs into their secure mobile banking application, selects a cardless withdrawal option, specifies the withdrawal amount, and authorizes the request using their mobile PIN or biometric credentials.
2) Optical session pairing: The ATM display generates a dynamic, time-limited QR code containing encrypted session tokens, ATM hardware identifiers, and a cryptographic nonce. The customer uses their smartphone camera to scan this code (or conversely, the ATM's optical scanner reads a dynamic QR code generated on the user's mobile screen).
3) Server-side validation: The mobile app transmits the scanned payload back to the bank's centralized authentication server over an encrypted cellular connection, pairing the physical ATM terminal session with the customer's authenticated digital profile.
4) Automated cash dispensing: Upon verifying that the token is unexpired, matches the ATM terminal ID, and that sufficient funds exist, the banking backend transmits a command to the physical ATM cash dispenser, completing the transaction without inserting a plastic card.

Mentor tip

Break down the steps logically: in-app amount selection, optical scanning of a dynamic token, server-side session pairing, and physical cash dispensing.

Question 3

6 marks

Procedural handshake steps for establishing secure SSL/TLS banking sessions

Networks

6 marks

Describe the sequential procedural steps executed during the SSL/TLS handshake to establish a secure connection with an online banking portal:
1) Client Hello: The client browser initiates the handshake by dispatching a 'Client Hello' packet to the bank's web server, containing supported TLS protocol versions, available cipher suites (encryption algorithms), and a pseudo-random client byte string.
2) Server Hello and Certificate Delivery: The banking server responds with a 'Server Hello', selecting the strongest mutually supported cipher suite and supplying its digital certificate (often an Extended Validation certificate) signed by a trusted Certificate Authority, which embeds the bank's asymmetric public key and a server random byte string.
3) Trust Validation: The client browser validates the certificate against its pre-installed root CA store, verifying the certificate's validity dates, digital signature, and revocation status to authenticate the server's identity.
4) Premaster Secret Generation and Transmission: The client generates a random premaster secret, encrypts it using the bank server's asymmetric public key, and transmits it across the network. Only the bank's authentic private key can decrypt this transmission.
5) Session Key Derivation: Both client and server independently compute the identical symmetric session master key using the premaster secret combined with the previously exchanged random byte strings.
6) Finished Handshake and Symmetric Encryption: Both endpoints exchange encrypted 'Finished' verification messages confirming handshake integrity. All subsequent HTTP payloads (account numbers, balances, financial transfers) are protected using high-speed symmetric encryption.

Mentor tip

List the chronological steps: Client Hello, Server Hello with certificate, CA verification, premaster key exchange using the public key, symmetric key derivation, and finished verification.

Question 4

12 marks

Evaluating biometric authentication for fraud mitigation and user adoption in mobile banking

System fundamentals

12 marks

Evaluate whether adopting biometric authentication for mobile banking users represents an satisfactory and successful strategy for reducing fraud losses at TransEuropa:
Fraud risks in traditional banking authentication:
- Weaknesses of knowledge-based credentials: Single-factor passwords, PINs, and static security questions are highly susceptible to credential stuffing, dictionary guessing, keylogger Trojans (such as Man-in-the-Browser), and social engineering scams.
- Limitations of hardware TAN generators and SMS tokens: Physical keypads generating Transaction Authentication Numbers (TANs) provide strong two-factor security but impose hardware distribution expenses and usability burdens. SMS one-time passwords remain vulnerable to SIM-swapping exploits and network interception.
Advances in mobile biometric modalities:
- Technological capabilities: Modern smartphones integrate sophisticated physiological sensors, including capacitive and ultrasonic fingerprint scanners, 3D facial structured-light projectors, and iris recognition cameras.
- Storage architecture and Secure Enclaves: Rather than transmitting raw biometric images over public networks, modern handsets process scans locally within hardware-isolated coprocessors (Secure Enclaves), converting traits into irreversible mathematical hashes and releasing cryptographic signing keys only upon successful matching.
Effectiveness in mitigating financial fraud:
- Inherent binding to identity: Biometrics represent something the user 'is', which cannot be easily forgotten, shared, or stolen via standard phishing campaigns, substantially reducing unauthorized account takeovers.
- Integration with multi-factor frameworks: Combining biometrics with a known PIN (something the user knows) and device possession bound to a hardware key (something the user has) creates a highly resilient multi-factor defense that stops automated botnets and credential stuffing cold.
Limitations, failure modes, and security challenges:
- False Rejection and False Match Rates (FRR/FAR): Imperfect environmental conditions (wet fingers, poor lighting, sunglasses) cause false rejections that lock legitimate customers out of vital financial services. In rare instances, biometric spoofing (silicone molds or high-resolution 3D masks) can trigger false positive matches.
- Irrevocability of biometric compromise: Unlike a compromised password or credit card number that can be instantaneously changed, a user's stolen fingerprint or retinal scan cannot be reissued, creating permanent security liability.
Customer adoption willingness, privacy, and regulatory concerns:
- Usability advantages: Unlocking an application or authorizing a money transfer via a momentary fingerprint touch or glance provides near-zero friction, dramatically enhancing user convenience compared to carrying external TAN keypads.
- Privacy apprehensions: Privacy-conscious customers often harbor distrust regarding corporate storage of their personal biological markers, fearing state surveillance or catastrophic centralized database leaks.
- Accessibility and handset inequality: Low-income and rural customers utilizing budget smartphones or basic feature phones (as in TransEuropa's developing markets using M-PESA/STK) lack biometric hardware entirely, making universal biometric mandates impractical.
Comprehensive strategic synthesis:
TransEuropa should implement biometric authentication as a preferred, non-exclusive component of a risk-adaptive multi-factor framework. Enabling biometrics for daily transactions on equipped smartphones maximizes user convenience and suppresses credential fraud, while retaining secure tokenized fallbacks (such as hardware TANs or secure app-based authenticators) ensures accessibility across diverse customer demographics.

Mentor tip

Our analysis

Where the marks are

Each part sorted by the topic it mostly tests. Networks carries the most marks on this paper.

Networks18 marks · 60%
Q1, Q2, Q3
System fundamentals12 marks · 40%
Q4

Mentor insights

Traps to watch for

01
Confusing WPA with WEP encryption · Q1
WPA was specifically engineered to replace the deeply flawed WEP protocol, introducing dynamic per-packet key generation (TKIP/AES) rather than static encryption keys.
02
Reversing the public and private key roles during the SSL handshake · Q3
The server's public key encrypts the premaster secret on the client, and only the server's private key can decrypt it; the private key is never shared or used to encrypt the premaster secret directly.
03
Assuming biometric templates are transmitted as raw images to bank servers · Q4
Modern mobile biometric systems do not transmit raw fingerprint or face pictures across the network; they generate local mathematical hashes inside hardware Secure Enclaves that authorize cryptographic keys locally.

Solutions and tips are GeorgeTheTutor's own; the questions are not reproduced here. Not affiliated with or endorsed by the International Baccalaureate Organization.

Want someone to go through your paper with you?

Our maths mentors took these exams recently. One-to-one, they'll find where your marks are going and fix it before May.

Find your maths mentor More past papers