IB Questionbank

User interface language: English | Español

Date	May 2022	Marks available	6	Reference code	22M.1.SL.TZ0.3
Level	SL	Paper	1	Time zone	no time zone
Command term	Explain	Question number	3	Adapted from	N/A

Question

Schools told not to use cloud computing software applications

Schools in the German state of Hesse will no longer be able to use cloud computing services with software applications, such as G Suite and Office 365, due to new data protection rules. This has identified the risk of schools’ data being stored and accessed by third parties from outside of Germany.

In contrast, many schools in other parts of the world use cloud computing services and software applications. These applications allow students to access software that was previously only installed on their computers.

Identify two types of cloud computing software applications that students might use at school.

[2]

a.i.

If the schools in Hesse can no longer use cloud computing software applications, they will need to store their data on a local file server and access it through a local area network (LAN).

Identify two ways in which data could be secured if the school stored it locally.

[2]

a.ii.

Identify two ways in which students could authenticate themselves on their local area network (LAN).

[2]

a.iii.

The European Union’s (EU) General Data Protection Regulation (GDPR) governs data protection and privacy in the EU. Its regulations give users certain rights in terms of their data.

Explain three principles that should be included in data protection regulations such as GDPR.

[6]

A new school has opened in Switzerland, and its principal and IT manager are considering two options:

Option 1: Using a local client–server network.

Option 2: Using a cloud-based service.

Evaluate these two options.

[8]

Markscheme

Answers may include:

Word processor: Google Docs / Microsoft Word.
Spreadsheet: Google Sheets / Microsoft Excel.
Email: Gmail / Microsoft Outlook.
Presentation: Google Slides / Microsoft PowerPoint / Apple Keynote.
Website design: Google Sites.
Calendars: Google Calendar.
Online forms: Google Forms / Microsoft Forms.
Collaboration tools: Microsoft Teams / Google Classroom.
Storage apps: Microsoft OneDrive / Google Drive.
Video Communication: Zoom, Skype, Teams, Meet etc.
Learning Management Systems: Blackboard/ Moodle / PowerSchool / Canvas / Schoology etc.

Award [1] for identifying each application up to [2].

Note to examiners:
DO NOT accept Microsoft Office / Office 365 / Google Workspace / Gsuite as these are mentioned in the stimulus materials on the question paper.

a.i.

Answers may include:

Different levels of access
Login (username and password / biometrics)
Firewalls, proxy server
Encryption
Audit trails
Anti-virus / anti-malware software
Physical security of the servers

Award [1] for identifying each way the data can be stored securely up to [2].

a.ii.

Answers may include:

Single-factor/primary authentication
Two-factor authentication (2FA)
Single sign-on (SSO)
Multi-factor authentication (MFA)

Award [1] for identifying each way in which students could authenticate themselves on their local area network (LAN), up to [2].

a.iii.

Answers may include:

The right to know who has access to my data
… and for the purposes it is being used for.
The level of security used to protect the data
… so only appropriate users of the data have access.
The purpose that the data will be used for
… will it be shared with third parties?
Data will not be processed without informed consent from the owner
… unless there is a legal requirement to process the data.
Requires that the holder of the data controller provides information to the data subject
… in a concise, transparent, intelligible and easily accessible form, using clear and plain language.
The data subject has the right to be forgotten
… so data can be deleted after it has served its required purpose.
Data should be stored on a server within the same country or within a country with similar data protection legislation in place.
… so that the owner of the data is sure that its security remains protected.

Award [1] for identifying a principle that should be included in data regulation principles such as GDPR and [1] for a development up to [2].

Mark as [2] + [2] + [2].

Answers may include:

Option 1:

Advantages

The management of the client–server network can be carried out in-house which will mean the way in which the network is set up can be tailored to the school’s needs (systems).
There will be fewer costs to external agencies for the upkeep of the network i.e. there is no monthly fee / subscription fees, etc., which will need to be managed by the IT manager.
The IT manager will have complete knowledge about where their data is held.
A client–server network allows in-house control of backup and security (this could be argued from both sides depending on the competency of the IT staff).
The principal will be able to claim the data is more secure as it is housed on a school server instead of on a third-party server (systems).

Disadvantages

The hardware costs for network infrastructure as well as software licensing costs will need to be paid by the school and managed by the IT manager/principal (costs).
The IT manager/principal will need to employ staff who can manage the network and maintain the hardware or arrange for this to be outsourced (costs).

Option 2:

Advantages

The management of the client–server network can be carried out remotely by the cloud service provider which will mean that IT manager will not have to carry out a number of tasks linked to the maintenance of the network (feasibility).
The cloud-based provider will provide backing up facilities as part of the service so the IT manager will not have to address this issue (reliability, systems).
The cloud-based provider will be able to provide up-to-date versions of software and services more efficiently than the IT manager who may have to buy them in after carrying out due diligence (systems).
Increasing the storage capacity of the network would be easily done by requesting this from the cloud service provider (systems). No additional hardware or infrastructure will be required (cost, feasibility).

Disadvantages

There will still be a need to have some hardware and software on site (for example print servers) which will need to be purchased and maintained by the IT manager (cost, systems).

In part (c) of this question it is expected there will be a balance between the terminology related to digital systems and the terminology related to social and ethical impacts.

Keywords: education, data, security, reliability, network, cloud, client, server, systems, ethics, values, cost, feasibility

Refer to SL/HL paper 1, part c markbands when awarding marks. These can be found under the "Your tests" tab > supplemental materials > Digital society markbands and guidance document.