NCERT Solutions Class 12 Computer Science Chapter 12 Security Aspects

Give the NCERT reason, but also see why no real organisation keeps its computers offline. The book itself admits that staying aloof is not an ideal solution, because the world is moving toward being fully connected. So the safe-but-useless machine is a thought experiment that proves one point: connectivity is the doorway through which threats arrive.

• The deeper exam idea is the trade-off between security and usability. Real security work means staying connected so the machine is useful, then adding layers of protection so the connection cannot be abused.
• Watch the common trap. Even an isolated machine is not totally safe, because threats can still arrive on a pen drive or from a person with physical access. The Stuxnet worm famously crossed an air gap by hiding on USB drives.

If an exam asks for limits, say that disconnecting removes network threats but not physical or removable-media threats. A precise answer wins marks; a sweeping "it is fully safe" loses them.

Answer: No connection means no network attack path, so network threats vanish, but isolation costs usability and still leaves physical and removable-media risks.

Use one or two examples with a fact, not a long list. In a board answer the examiner wants the definition plus a couple of names; padding the page with ten virus names earns nothing extra. Attach one memorable fact to each name you give.

• ILOVEYOU (2000) arrived as an email attachment that looked like a love letter, overwrote files, and reached tens of millions of users in days.
• MyDoom (2004) became the fastest-spreading email worm-virus and caused damages estimated in the tens of billions of dollars.
• Stuxnet (2010) targeted industrial control systems and physically damaged centrifuges in Iran's nuclear programme, the first malware widely called a cyber-weapon.

Avoid the definition trap: students often write that a virus spreads by itself, but that describes a worm. A virus needs a host file to live in and a human to run that file before it can act.

Answer: Define a virus as harmful code that rides in a host file and runs on user action; back it with one or two named cases such as ILOVEYOU, MyDoom or Stuxnet, each with a single sharp fact.

Anchor the answer on two words: independence and automation. A worm is independent (no host file) and automatic (no human click); a virus is the opposite on both counts. Every other difference flows from these two roots.

• Because a worm is independent and automatic, it races across a network on its own, which is why worms such as MSBlast and Code Red spread to huge numbers of machines fast.
• This predicts the defence. Worms exploit network connections, so a firewall and prompt patching stop them. A virus is blocked more by user behaviour: do not open unknown attachments, plus antivirus scanning.

A neat closing line: a virus is a passenger that needs a vehicle and a driver, whereas a worm is its own vehicle and drives itself, which is exactly why a worm is harder to stop once it is loose.

Answer: Worm = independent and automatic, so it self-spreads over the network; virus = dependent on a host file and on a human click, so it spreads slowly.

Spell out why Bitcoin and why paying is risky. A higher-mark answer explains two design choices. First, attackers demand cryptocurrency because those payments are hard to trace back to a real person. Second, strong encryption means that without the attacker's private key, even the best technician usually cannot recover the files.

• Paying is not a guaranteed fix and is widely advised against. There is no promise that the attacker will send a working key, and paying funds and encourages more attacks.
• The recommended defence is preparation: keep regular backups stored offline so ransomware cannot reach them, keep software patched, and never open suspicious attachments.

Naming WannaCry with its scale (around 200,000 machines in roughly 150 countries) shows real knowledge, and the backup point shows you understand prevention, the mark-rich half of any security answer.

Answer: Ransomware monetises stolen access: encrypt the victim's data, demand untraceable Bitcoin to decrypt it, and rely on fear; the real cure is offline backups and patching, not paying.

Tie the name to the defining trait: social engineering. The wooden horse worked by deception, not by force. The Greeks won because the Trojans chose to pull the horse inside their own walls. A Trojan does not break in; it persuades the user to invite it in by disguising itself as something wanted.

• This explains why a Trojan does not need to self-replicate; deception is its whole delivery method.
• Because the attacker is already trusted by the victim's own action, a Trojan commonly drops a backdoor, a hidden entry point that lets the attacker return later.

The defence is also human: be suspicious of unexpected downloads, verify the source of any software, and avoid pirated programs, which are a classic disguise for Trojans.

Answer: A Trojan is named for the Greek wooden horse because both win by deception, not force; the metaphor captures social engineering, the disguise that makes a user invite the malware in, often leaving a backdoor behind.

Explain the scale that makes ad pennies add up. One pop-up earns almost nothing, but adware is built to infect a very large number of machines, and a tiny amount multiplied across thousands or millions of devices becomes a serious, steady income. That is why the NCERT text stresses infecting a substantial number of systems first.

• Know the family of pricing models: pay-per-click pays for each click, pay-per-view pays each time an ad is shown, and pay-per-install pays for bundling partner software.
• Aggressive adware sometimes tracks browsing habits and sells that profile data, a second income stream where adware shades into spyware.

The defence follows from the delivery method: read installer screens carefully, decline bundled extras, and avoid pirated or "free stuff" downloads.

Answer: Adware turns forced ads into cash at scale: pay-per-click, pay-per-view and pay-per-install across a huge number of infected machines, sometimes topped up by selling tracked browsing data.

Pick two distinct threat categories, not two flavours of one. A common slip is to write "it steals passwords" and "it steals email passwords" as if they were two separate threats; an examiner reads that as one point made twice.

• The first category is account compromise: stolen credentials let an attacker take over your email or banking portal, and from a hijacked email they can reset the passwords of more services.
• The second is financial and identity loss: captured card numbers, net-banking PINs and personal details enable direct fraud and identity theft.

A keylogger works silently in the background, so the victim has no visible sign. This connects to the next question: an online virtual keyboard with a randomised layout denies the keylogger the very thing it is built to capture.

Answer: Name two distinct harms, account takeover from stolen credentials and financial or identity fraud from captured banking and personal data, and add that the logging is silent, which is why it is dangerous.

Frame it as breaking the attacker's mapping. A software keylogger needs a stable mapping between what it observes and the actual key. On a fixed layout, the attacker observes the mouse-click coordinates and translates them straight back into the letter, because the "A" is always in the same spot.

• The randomised virtual keyboard destroys that mapping: the coordinate that meant "A" a moment ago might mean "Q" next time, so a captured stream of clicks becomes meaningless.
• NCERT specifically recommends a virtual keyboard while signing in from an unknown computer, such as a cyber-cafe, where you cannot trust the system is free of keyloggers.

Do not treat "on-screen" and "virtual" as identical just because both are software keyboards; the security difference lies entirely in fixed versus randomised layout.

Answer: The virtual keyboard's randomised layout destroys the fixed coordinate-to-key mapping a keylogger relies on, which is why it is safer, especially on untrusted public computers.

Group the four routes by who does the work. Three of the four depend on the user doing something, while one runs on its own. Internet downloads, spam email, and removable storage all need the victim to act; network propagation by worms moves machine to machine with no human help.

• The three user-driven routes are blocked mainly by careful behaviour: do not download free stuff from untrusted sites, do not click unsolicited links, and scan every removable device before use.
• The one automatic route, network propagation, is blocked mainly by network controls: a firewall as the first barrier and prompt software patching.

When an exam asks you to list the routes and suggest prevention, pair each route with its matching defence instead of giving a generic "install antivirus".

Answer: Three routes are user-triggered (Internet downloads, spam email, removable media) and one is automatic (network propagation by worms); match careful behaviour to the first three and firewall plus patching to the last.

Memorise by category, then explain the logic behind each. Three buckets cover all the signs and explain why each symptom appears.

• Browser and network misbehaviour (pop-ups, hijacked homepage, mass emails): adware and worms want to push ads, redirect you, and spread to your contacts.
• Performance degradation (slow machine, crashes, low storage): malware quietly consumes CPU, memory and disk in the background.
• Unexpected program and file activity (unknown startup programs, apps opening and closing, files appearing or vanishing): code running and changing your system without permission.

A single sign can be innocent (an old PC just runs slow), so it is the combination of several signs that should trigger an immediate scan with updated antivirus.

Answer: Sort the signs into three buckets, browser/network misbehaviour, performance slowdown, and odd program/file activity, explain each by what malware is doing, and note that several signs together should trigger an immediate updated antivirus scan.

Organise the long list into four layers of defence. This shows the examiner you understand the strategy, not just the bullet points.

• Software hygiene: update antivirus, apply OS and application patches, and stick to licensed or FOSS software instead of pirated copies.
• Network boundary: enable a firewall and avoid entering sensitive data over untrusted networks such as public Wi-Fi.
• User behaviour: do not click unsolicited links, do not type PINs on unknown computers, scan removable devices, and never share credentials.
• Recovery: take regular offline backups so even a successful attack such as ransomware can be undone.

A commonly tested point: do not install security software offered through a pop-up or advertisement, because fake "your PC is infected" pop-ups are themselves a malware trick. Close them with the window's X.

Answer: Group the measures into four layers, software hygiene, network boundary, user behaviour, and recovery (backups), and stress patching, offline backups, and never trusting pop-up "antivirus" offers as the highest-value habits.

Contrast the two big families: known patterns versus suspicious behaviour. The five methods split cleanly into two ideas, and naming that split shows real understanding.

• Pattern-based (signatures and heuristics) relies on knowledge of what bad code looks like. Fast and accurate for known malware, but defeated by brand-new or polymorphic threats.
• Behaviour-based (sandbox, data mining, real-time) watches what a program does. It can catch unknown and dormant malware that signatures miss, at the cost of being slower or occasionally raising false alarms.

Modern antivirus does not pick one method; it layers them, fast signature scanning for everyday known threats, plus behavioural and sandbox analysis as a safety net for the new and the disguised.

Answer: The five methods fall into two families, pattern-based (signatures, heuristics: fast but weak on new malware) and behaviour-based (sandbox, data mining, real-time: catch unknown threats but slower); real antivirus layers both.

Show the lock, the certificate and the right use of each protocol. The padlock in the address bar means the site presented a valid SSL/TLS Digital Certificate, which does two jobs: it sets up encryption, and it authenticates the server's identity so your browser knows it is really talking to your bank.

• This is why the chapter's payment advice, look for the lock and "https://" before entering banking details, is a genuine security control.
• HTTP is not "wrong", it is just for the wrong data. For a public news portal, plain HTTP is sufficient. The instant a page handles credentials or payments, HTTPS becomes essential.

Modern best practice has moved to HTTPS almost everywhere, partly because encryption also prevents tampering with the page in transit, not just eavesdropping.

Answer: HTTP's plain text is readable by interceptors; HTTPS fixes this with SSL/TLS encryption plus server authentication (the padlock and certificate), so use HTTP only for public pages and HTTPS for anything sensitive.

Separate the helpful first-party cookie from the tracking third-party one. The same technology can be a convenience or a privacy risk depending on who sets it.

• A first-party cookie is set by the website you are actually visiting and is the source of the advantages: it remembers your cart, keeps your session logged in, and auto-fills forms.
• The disadvantage clusters around third-party cookies, set by other domains (often advertisers) embedded in the page; these follow you across sites to build a profile and show targeted ads.

Name the security edge cases: "Supercookies" are malware disguised as ordinary cookies, and "Zombie cookies" recreate themselves even after deletion. Cookies are not inherently malicious; accept first-party cookies but restrict third-party ones in your browser.

Answer: First-party cookies give the advantage (remembering carts, logins, auto-fill); third-party cookies give the disadvantage (cross-site tracking), with supercookies and zombie cookies as the security edge cases; control them selectively rather than fearing all cookies.

Sort the three hats by two questions: permission and intent. Test one: do they have permission? Test two: is their intent to help or to harm?

• A white hat scores well on both: permission (organisations hire them) and intent to help by reporting and fixing flaws. This is the lawful, ethical side.
• A black hat fails both: no permission and harmful intent for gain. The chapter equates this group with crackers, and their work is illegal.
• A grey hat is the mixed case: intent is not malicious, but they typically act without permission, which keeps them out of the white-hat camp.

The point most students miss: "no bad intent" is not the same as "lawful". A grey hat who breaks in uninvited, even for the challenge, has still acted without authorisation.

Answer: Judge each hat by permission and intent: white = permission + helpful (ethical), black = no permission + harmful (cracker, illegal), grey = no permission but no malicious aim (neutral).

Make the one-versus-many difference drive the difficulty of defence. In a DoS attack there is one source, so the defence is straightforward: identify the offending IP address and block it. DDoS removes that limitation by recruiting an army.

• The attacker infects many computers worldwide with Bot malware, turning them into remotely controlled Zombies, and gathers them into a Bot-Net that hits the victim from thousands of addresses at once.
• Blocking one Zombie does nothing, and the malicious traffic blends in with genuine user traffic, so simple filtering can accidentally block real customers.

The Zombie owners are usually innocent victims whose machines were hijacked, which is why DDoS is also harder to trace back to the real attacker hiding behind the Bot-Net.

Answer: DoS = one source, so block that source and it stops; DDoS = a Bot-Net of many hijacked Zombies, so it is far harder to block, harder to trace, and harder to recover from.

Lock the difference to timing, then back it with the letter analogy. Eavesdropping is real-time interception happening live, whereas snooping captures the traffic and can store it for analysis later. Many students blur the two because both involve secret listening.

• The letter analogy is the perfect memory hook: snooping is like copying a letter, keeping the copy, and still delivering the original, which captures the store-and-analyse-later nature.
• The targets differ: eavesdropping goes after live private channels such as VoIP calls and video conferences, while snooping goes after general network traffic packets.

Both share the same cure: encryption. If the data is encrypted, then whether an attacker intercepts it live or captures it later, all they obtain is scrambled, unreadable content. This ties back to the HTTP-versus-HTTPS topic.

Answer: Timing is the core difference, eavesdropping is live, snooping is capture-now-analyse-later; remember the letter analogy, and note that encryption defeats both because intercepted data is then unreadable.