Methods to detect and prevent cyber security threats: CAPTCHA (or similar)

The idea

CAPTCHA is a challenge–response test used to tell humans apart from automated scripts. A website presents a task that is easy for a person but hard for a bot, such as reading distorted letters, selecting images that match a prompt, or ticking a box that triggers behavioural checks. The user completes the challenge; the server judges the response and, if it passes, allows the action, for example submitting a login form or posting a comment. This reduces automated threats such as brute-force password guessing, spam account creation and scripted form flooding. It is a prevention measure because it blocks the automated request before it succeeds. It does not encrypt data or verify who a named user is, so it complements, rather than replaces, passwords and email confirmation. 'Or similar' means any equivalent human-verification challenge counts.

What earns the marks

• Identifies CAPTCHA as a test that distinguishes human users from automated programs (bots).
• Explains that the user must complete a challenge, such as reading distorted characters or selecting matching images.
• States that a correct response allows the requested action to proceed, while a failed or missing response blocks it.
• Links CAPTCHA to preventing automated threats such as brute-force login attempts, spam registrations or scripted form submissions.
• Recognises that CAPTCHA is a prevention method and does not itself encrypt data or confirm a specific user's identity.

Common mistakes and how to put them right

• Thinking CAPTCHA encrypts the data sent to the server.

  Put it right: It is a human-verification challenge and provides no encryption.

• Believing CAPTCHA proves the identity of a named account holder.

  Put it right: It only shows a human, not which human, is present.

• Assuming CAPTCHA stops all malware or phishing.

  Put it right: It mainly deters automated abuse such as scripted logins and spam.

Exam tips

• Name the mechanism (a challenge a human can pass but a bot struggles with) before giving the benefit.
• Tie the answer to a specific automated threat, such as repeated password guesses, to gain credit for purpose.
• Keep the distinction clear between prevention (blocking the automated request) and detection or encryption.