The Internet and Its Uses
Core Revision Module
Revision & Practice Book
Interactive revision notes with exam tips and worked examples for this chapter.
Practice & Resources
2 toolsChapter overview
A summary of this Computer Science chapter — open a section to read it. The full notes, worked examples and practice questions are in the study modules above.
What is The Internet and Its Uses about?
Cambridge IGCSE Computer Science 0478 is not divided into tiers. Every candidate sits the same two papers, both papers assess the full A*–G grade range, and all ten subject-content topics are required. So every one of the ten requirements mapped in this chapter is examinable for you, whichever grade you are working towards. Nothing here is optional, and nothing here is reserved for a different tier — there is no other tier.
The internet is the worldwide infrastructure of interconnected networks. The world wide web is the collection of websites and web pages that is accessed using that infrastructure. When you type a URL, the browser separates out the domain name, asks the domain name server (DNS) to turn it into an IP address, sends an HTTP or HTTPS request to the web server at that address, receives HTML and other resources back, and renders the page on your screen. Along the way the browser may store cookies. The same infrastructure carries digital currency transactions, which a blockchain records as time-stamped, hash-linked blocks so that a change to an old record is detectable. And because everything above is reachable from anywhere, Topic 5 finishes with the cyber security threats that exploit it and the layered solutions that reduce them.
The internet is the infrastructure: the worldwide network of interconnected computer networks, made up of the cables, fibre, routers, satellite and wireless links that carry data, together with the agreed protocols that make them work as one system. The world wide web is the collection of websites and web pages that are stored on web servers and accessed using the internet. The web is therefore one service that runs on the internet, not the internet itself.
A uniform resource locator (URL) is a text-based address that identifies where a particular resource on the web can be found. It can contain the protocol to be used, the domain name of the site, and the path and web page or file name of the resource being requested. A URL is written for people to read and type; it is not the numerical address the network uses. The domain name inside it must first be resolved to an IP address before any request can be sent.
HTTP (hypertext transfer protocol) is the set of rules that governs how a web browser and a web server exchange web pages and other resources: the browser sends a request for a named resource, and the server returns a response containing a status and, where possible, the resource itself. HTTPS (hypertext transfer protocol secure) is the same request-and-response protocol with security added: the data is encrypted before transmission, and the server proves its identity with a digital certificate. HTTPS therefore protects data in transit; it makes no claim at all about whether the website's content, owner or business is honest.
A web browser is the application software used to access and display web pages. Its main purpose is to render HTML and display web pages — that is, to interpret the HTML sent back by a web server and turn it into the formatted text, images and multimedia the user sees. Around that central job it also provides an address bar, navigation tools, multiple tabs, bookmarks or favourites, a record of user history, and the storage of cookies.
Key ideas to remember
- The one sentence to carry into the exam: a name is resolved to an address, an address is used to make a request, a request returns a response, a response is rendered — and every stage of that journey has both a threat and a matching defence.
What you need to be able to do
- 5.1.1 — Understand the difference between the internet and the world wide web, and be able to say which of the two a given description belongs to.
- 5.1.2 — Understand what is meant by a uniform resource locator (URL), and identify the protocol, the domain name and the web page or file name inside a given address.
- 5.1.3 — Describe the purpose and operation of HTTP and HTTPS, and say precisely what the secure version protects and what it does not.
- 5.1.4 — Explain the purpose and functions of a web browser, including that its main purpose is to render HTML and display web pages.
- 5.1.5 — Describe how web pages are located, retrieved and displayed on a device when a user enters a URL, naming the roles of the browser, IP addresses, the domain name server, the web server and HTML.
- 5.1.6 — Explain what is meant by cookies and how they are used, distinguishing session from persistent cookies.
- 5.2.1 — Understand the concept of a digital currency and how digital currencies are used.
- 5.2.2 — Understand the process of blockchain and how it is used to track digital currency transactions.
- 5.3.1 — Describe the processes involved in, and the aim of carrying out, brute-force attacks, data interception, DDoS attacks, hacking, malware (virus, worm, Trojan horse, spyware, adware, ransomware), pharming, phishing and social engineering.
- 5.3.2 — Explain how a range of solutions keep data safe: access levels, anti-malware, authentication (username and password, biometrics, two-step verification), automating software updates, checking the spelling and tone of communications, checking the URL attached to a link, firewalls, privacy settings, proxy servers and the SSL security protocol.
- State / identify — a single fact, no explanation. "Identify the protocol" wants https and nothing else.
- Define — a precise one-sentence meaning of the term.
- Describe — the features or stages, in order where order matters. Describing page retrieval means listing the steps, not justifying them.
- Explain — a reason as well as a fact: cause or feature → mechanism → result.
- Compare — statements that hold both items against the same criterion. "One is fast" is not a comparison; "HTTP sends data unencrypted whereas HTTPS encrypts it" is.
Common mistakes to avoid
- M1 — "The internet and the world wide web are the same thing." Why it is wrong The internet is the global infrastructure of interconnected networks. The world wide web is the collection of websites and web pages accessed using that infrastructure. Email, VoIP and file transfer all use the internet without being web pages. Say instead "The world wide web is one service that runs on the internet; the internet is the infrastructure that carries it."
- M2 — "A URL is an IP address." Why it is wrong A URL is a text-based address containing a protocol, a domain name and often a path and file name. An IP address is a numerical address identifying a device. They are connected only because DNS converts the domain name inside the URL into an IP address. Say instead "The URL contains a domain name, which the domain name server resolves to the web server's IP address."
- M3 — "Every URL must end in a file name." Why it is wrong The syllabus says a URL can contain the protocol, the domain name and the web page or file name. Many valid addresses stop at the domain name, and the server then returns its default page. Say instead "Where no file name is given, the web server supplies its default page for that address."
- M4 — "The DNS sends the web page back to the browser." Why it is wrong The domain name server returns an IP address and nothing else. The web server stores and returns the page. Say instead "The DNS returns the IP address; the browser then sends its request to the web server, which returns the HTML."
- M5 — "DNS searches for the website." Why it is wrong Searching by keyword is what a search engine does, using an index. DNS performs an exact lookup of a domain name in its records; if the name is not there, it passes the query on or returns an error. Say instead "DNS looks up the exact domain name in its records and returns the matching IP address."
- M6 — "A browser and a search engine are the same thing." Why it is wrong The browser is application software on your device whose main purpose is to render HTML and display web pages. A search engine is a service on someone else's web servers that searches an index of pages for your keywords and returns links. The browser displays the search engine, just as it displays any other website. Say instead "The browser rendered the search engine's results page; the search engine did the searching."
- M7 — "The web server displays the page on the screen." Why it is wrong The web server sends the HTML and other resources. Turning that into what you see — rendering — happens in the browser on the user's device. Say instead "The web server returns the HTML; the browser renders it and displays the page."
- M8 — "HTTPS means the website is honest, safe, or free of malware." Why it is wrong HTTPS encrypts the connection and lets the browser check the server's certificate for that domain. It makes no assessment of the content, the seller or any files offered for download. A criminal can obtain a valid certificate for a domain they control and run a fake shop over HTTPS. Say instead "HTTPS protects the data in transit and authenticates the server; it does not verify that the website itself can be trusted."
- M9 — "HTTPS prevents data from being intercepted." Why it is wrong Interception can still occur. Encryption changes what the interception is worth: the captured data is ciphertext and cannot be understood without the key. Say instead "Data can still be intercepted, but it is encrypted, so it cannot be understood."
- M10 — "Cookies are programs, or viruses, and they infect your computer." Why it is wrong A cookie is a small piece of data stored by the browser and returned to the site that set it. It cannot execute, replicate or damage anything. The genuine concern is privacy: a persistent identifier can be used to build a picture of browsing behaviour. Say instead "Cookies are data, not programs, so they are not malware — but persistent cookies can be used to track a user across visits."
- M11 — "All digital currency is cryptocurrency." Why it is wrong Cryptocurrency is one kind of digital currency — one that uses cryptography and typically a blockchain, and is often not centrally issued. Other digital currencies are issued and controlled centrally. Nor are they all anonymous: a public ledger shows every transaction, with identities behind identifiers rather than absent. Say instead "A digital currency exists only electronically; cryptocurrencies are one type of digital currency."
- M12 — "Paying by card or by phone means you are using a digital currency." Why it is wrong These are payment methods that move an ordinary currency — one that also exists as physical notes and coins. The test is whether the currency itself has any physical form. Say instead "A card payment transfers an ordinary currency electronically; a digital currency has no physical form at all."
- M13 — "A blockchain cannot be hacked and it is impossible to change." Why it is wrong The design makes alteration detectable, not physically impossible. Changing data in a block changes its hash, so the value stored in the next block no longer matches and the chain is inconsistent from there on — and the altered copy disagrees with every other copy of the ledger. Whether a rewritten history could ever be accepted depends on the design of the system and on how it reaches agreement. Nor is every blockchain public. Say instead "Any change alters the hash and breaks the link to the next block, so the alteration is detected and the altered ledger is rejected."
- M14 — "A virus and a worm spread in the same way." Why it is wrong A virus attaches to a host file or program and replicates when the host is run, opened or shared — so it usually needs a user to do something. A worm needs no host and no user action, and spreads across networks on its own. Say instead "A virus needs a host file; a worm self-replicates across the network without one."
- M15 — "A Trojan horse replicates itself." Why it is wrong A Trojan's method is deception, not reproduction. It appears to be legitimate software, the user installs it, and it then performs a hidden malicious action. It does not self-replicate. Say instead "A Trojan horse is disguised as legitimate software and does not self-replicate; the user runs it themselves."
- M16 — "Phishing and pharming are the same thing." Why it is wrong Phishing sends a deceptive message and needs the victim to act on it. Pharming redirects the browser to a fraudulent site even when the correct address has been entered, so the victim may do nothing wrong. Phishing is a form of social engineering; pharming is a technical redirection. Say instead "In pharming the user typed the correct address and was still redirected; in phishing the user was persuaded to follow a link."
- M17 — "Every cyber attack is 'hacking', and a DDoS attack steals data." Why it is wrong Hacking specifically means gaining unauthorised access. A DDoS attack accesses nothing — it exhausts a server's resources so that legitimate users cannot reach the service. The loss is availability, not confidentiality. Using "hacking" for everything loses the mark for naming the correct threat. Say instead "A DDoS attack denies access to the service; no data is read or copied."
- M18 — "One measure is enough: a firewall removes all malware, antivirus gives complete protection, two-step verification means two passwords, and a proxy makes you anonymous." Why it is wrong Four separate overclaims. A firewall filters traffic against rules and cannot clean an infected machine. Anti-malware reduces risk; no product detects everything. Two-step verification requires a second step of a different kind — two passwords would both be things you know, so one theft would yield both. A proxy hides the client address from the destination only; the proxy itself sees and may log the traffic. Say instead "Each measure addresses particular risks and leaves others open, so several complementary layers are used together — defence in depth."
Examiner tips
- The routes are study methods, not qualification tiers. "Learn" and "Revise" describe when you read something, never who has to know it. If you are reading this chapter at all, all ten requirements apply to you.
- How the command word changes the answer. Topic 5 uses six verbs and each expects a different amount: State / identify — a single fact, no explanation. "Identify the protocol" wants https and nothing else. Define — a precise one-sentence meaning of the term. Describe — the features or stages, in order where order matters. Describing page retrieval means listing the steps, not justifying them. Explain — a reason as well as a fact: cause or feature → mechanism → result. Compare — statements that hold both items against the same criterion. "One is fast" is not a comparison; "HTTP sends data unencrypted whereas HTTPS encrypts it" is.
- This chapter gives no financial advice. Topic 5 asks you to explain what digital currency is and how the record is kept. It never asks whether any currency is a good thing to own, what it might be worth, or how to obtain one — and an answer that strays into that territory earns nothing. Keep every answer descriptive and technical.
- The shape of a full-mark security answer. Whenever a question gives you a scenario, work along this chain: threat → action → consequence → defence → why the defence helps. Naming the threat alone is usually one mark of several. The marks are in the middle of that chain.
- Where HTTPS genuinely helps — and where it does not. Against pharming, a valid certificate is a real safeguard: if the browser is redirected to an attacker's server, that server cannot normally present a valid certificate for the genuine domain, so the browser warns the user. Against phishing it helps far less, because the victim is being sent to a different domain that the attacker legitimately controls and can obtain a certificate for. The padlock proves the connection is encrypted, not that the domain is the one you meant to visit — which is exactly why "check the URL attached to a link" is a separate, named defence.
- How to write a solution answer that scores. Not "use a firewall", but "a firewall examines incoming and outgoing traffic against a set of rules and blocks anything that does not meet them, which stops unauthorised connections reaching the server". The mark is for the mechanism and the effect, not the name. Where a question offers marks for two or three measures, give measures that address different parts of the problem rather than three versions of the same idea.
- One reliable way to waste time in Topic 5 is answering a "state" question with an "explain" answer. The marks are fixed. A one-mark question cannot pay for four sentences, and the time spent writing them is taken from a later question that could have paid.
- Worth one extra sentence if there is room: "HTTPS secures the connection; it does not certify that the shop itself is honest or that the goods will arrive." That precision is exactly what an AO3 question would go on to ask.
- The three sentences most worth memorising word for word, because each one closes off a whole family of errors: "The world wide web is the collection of websites and web pages accessed using the internet." "The domain name server returns the IP address; the web server returns the page; the browser renders it." "Each measure reduces particular risks and leaves others open, so several complementary layers are used together."
Every chapter note, MCQ explanation, and structured mark scheme is rigorously vetted by Cambridge curriculum specialists.