Use access levels, authentication and privacy settings
Limit who can use data and verify identity with controls that match the account risk.
Section 5 · The internet and its uses
Exam scope and assessment notes
This sequence follows Cambridge IGCSE Computer Science 0984, 2026–2028 syllabus Version 4. It covers subject content sections 5.1–5.3 only. The separately published 2029–2031 syllabus is not mapped here. Practice is original, self-checked and does not award an official Cambridge grade. Full timed papers and human subject-teacher review remain outstanding. Cambridge states that 0984 has the same 2026–2028 subject content as 0478, with 9–1 grading. In June and November, Cambridge lists 0984 in Administrative zone 3 and for centres in Oman and the UAE. Confirm availability for your centre and exam series with Cambridge International. The separately published 2029–2031 syllabus changes to Python 3 only and removes pseudocode; this 2026–2028 route does not cover those changes.
Before you begin
- No programming language is required. Be comfortable with place value and multiplication; each lesson introduces the computer-science notation it uses.
Work on paper. Try each question before revealing help, and explain why your method works.
Quick readiness check
What does authentication check?
What you will learn
- Explain access levels
- Compare passwords, biometrics and two-step verification
- Apply privacy settings to personal information
Controls reduce access and impersonation risk
Access levels give users only the permissions needed for their role. A student account might view a grade while only authorised staff can edit it; limiting permissions reduces the harm if an account is misused.
Apply and check the rule
Authentication checks identity using something known, such as a password; something possessed, such as a security code; or a biometric, such as a fingerprint. Two-step verification adds another check. Privacy settings control what information or activity other users can see, but they do not replace secure authentication.
Pause and explain
Which is an example of two-step verification?
Worked example
A school wants students to read feedback but not change marks. Which control should it configure?
Show the worked solution
- Identify the minimum permission students need.
- Give students read access to feedback.
- Restrict editing marks to authorised staff.
Answer Use role-based access levels: students can view feedback while only authorised staff can edit marks.
Try a topic test
Choose Easy, Normal or Difficult. Save your answers and open worked review after finishing.
Test this topic →From guided practice to a new situation
Write your answer and reasoning first. Use a hint only if you are stuck. The model solution is for self-checking; your written work is not automatically marked.
A learner should read an assignment but not publish grades. State the access level and why it is suitable.
Give me a hint
Give the minimum permission required.
Compare my reasoning
- The learner needs to view the assignment.
- They do not need permission to edit grades.
- Read-only access limits unnecessary changes.
Give view access to the assignment and no grade-editing permission.
Look for these in your work
- Required role
- Unneeded permission excluded
- Reason
Explain how a password and a one-time code can improve account security when used together.
Give me a hint
Identify the separate checks and the stolen-password case.
Compare my reasoning
- A password is something the user knows.
- A code delivered to a separate device is something they possess.
- A stolen password alone may no longer satisfy both checks.
The two checks use different evidence, so a stolen password by itself is less likely to let an attacker sign in.
Look for these in your work
- Password factor
- Possession factor
- Risk reduction
A student shares public photos but wants only friends to see their location history. Suggest a privacy setting and one limitation.
Give me a hint
Match the setting to the information.
Compare my reasoning
- Restrict location-history visibility to approved people or disable sharing.
- Review application and account-level privacy controls.
- A setting may not remove information already copied or shared elsewhere.
Restrict or disable location sharing and review who can access it. This cannot guarantee that data already copied by others is erased.
Look for these in your work
- Relevant setting
- Account review
- Limit
Common mistakes
- Giving every user administrator access
- Assuming a biometric alone makes an account impossible to compromise
What can you explain now?
What is the purpose of access levels?
Compare with the explanation
Restrict users to permissions appropriate for their role
Least privilege limits accidental changes and damage from compromised accounts.
After trying it yourself, choose your next review. This is your self-assessment.
Your review choice appears on Today. Sign in to sync it across devices.
Make it stick
How do access levels and authentication protect different parts of a system?
If you needed the solution, close it and solve the problem again from a blank page. A correct answer is stronger when you can explain the reason for each step.