Essentials: know these by heart

Know the paper and what each verb asks for. Every mark is lost or won here.

1. When and how long ★
   Tue 27 Oct 2026, 9.50 am to 12.20 pm. 10 min reading + 2 h 20 min writing = 2 h 30 min, 80 marks (about 1.75 min per mark). Sat online with wired headphones.
2. Paper shape (2025) ★ 2025 paper
   Q1–14 objective (16 marks), Q15–27 written, coded, drawn or extended (64 marks).
3. Question types
   Multiple choice, multi-select, drag-into-order, fill-in-the-blanks (dropdowns), drawing, pseudocode, Python, SQL, short answer, extended response.
4. Online tools
   The online exam has an HSC drawing tool and a pseudocode editor. Practise on the NESA familiarisation exam.
5. Year 11 and Year 12
   Both years are examinable (2022 syllabus; 2026 is the second HSC). The 2025 paper was drawn from Year 12: SSA, web, automation, project.
6. Identify ★
   Recognise and name. A word or phrase is enough.
7. Outline ★
   Sketch in general terms; a short statement per main point.
8. Describe ★
   Give characteristics and features: what it is and what it does, with a detail.
9. Distinguish
   Name both and say what is different.
10. Compare ★
    Similarities AND differences (both, whereas, in contrast).
11. Explain ★
    Cause and effect: the how or why (because, therefore, which means).
12. Discuss ★ 2025 Q24, Q25
    Give points for and against: a positive AND a negative.
13. Assess
    Make a judgement of value or size, then support it.
14. Evaluate
    Judge against criteria (effectiveness, cost, security) and finish with a verdict.
15. Justify
    Give the decision plus the reason.
16. Construct / design
    Make a model, diagram, query or program.
17. One point per mark ★
    About three developed points for 3 marks. Do not write an essay for 3 marks.
18. Use the scenario ★ 2025 marker feedback
    Name a detail from the stimulus. Marking ladders give the top mark only when the answer links to the scenario.
19. Answer the exact verb 2025 Q16(b)
    "Outline TWO ways" means exactly two. In 2025 Q16(b), students listed ways to investigate load times instead of ways to minimise them.
20. 3-mark ladder
    3 = explains the whole requirement and links to the scenario; 2 = outlines features; 1 = identifies a feature.
21. Code answers (marker feedback) ★ 2025 marker feedback
    Call your function after defining it; indent correctly; put quotation marks around text in SQL.

Year 11 content is still examinable. These come up as 1–4 mark items and underpin the code questions.

1. Eight development steps ★
   Requirements definition, determining specifications, design, development, integration, testing and debugging, installation, maintenance.
2. Three control structures ★
   Sequence, selection, iteration (repetition). Every algorithm is a combination of these.
3. Top-down v bottom-up
   Top-down: start with the whole problem and refine it into subroutines. Bottom-up: build and test small components first, then combine them.
4. Procedure v function
   A procedure performs a task; a function returns a single value (RETURN).
5. Four paradigms ★
   Imperative (step-by-step commands that change state), object-oriented (objects from classes), logic (facts and rules), functional (functions and recursion, avoid changing state).
6. Binary and hex ★
   Binary place values 128 64 32 16 8 4 2 1 (1011 = 11). One hex digit = 4 bits; hex digits 0–9, A–F (0xB3 = 1011 0011 = 179).
7. Two's complement ★
   Leftmost bit is the sign (1 = negative). To negate: invert all bits then add 1 (5 = 00000101 → 11111011 = −5).
8. Two's complement range
   n bits: −2^(n−1) to 2^(n−1) − 1 (8 bits: −128 to +127).
9. ASCII and Unicode
   Characters are stored as binary codes. ASCII is 7/8 bit; Unicode covers all languages. In Python ord("A") = 65, chr(65) = "A".
10. Data structures
    Array (fixed size, same type, index from 0), record (fields of different types), stack (LIFO), queue (FIFO), tree (root and children), hash table (key-value, Python dictionary).
11. Class and object ★
    A class is the blueprint (attributes and methods). An object is an instance of a class with its own attribute values.
12. Encapsulation ★
    Bundle data and the methods that use it in a class and restrict direct access (private attributes, getters and setters).
13. Abstraction ★
    Hide complex detail and expose only what is needed (call account.deposit() without knowing how it works).
14. Inheritance ★ 2025 Q22
    A subclass takes the attributes and methods of a superclass and can add or change them (code reuse; an "is-a" relationship).
15. Polymorphism ★
    Different classes give their own version of the same method name, so one call behaves differently for different objects (speak() for Dog and Cat).
16. Message passing
    Objects communicate by calling each other’s methods (parameters in, return value out).
17. Testing levels and boxes
    Unit, subsystem, system. Black box: inputs and outputs only. White box: internal code and paths. Grey box: partial knowledge.
18. Three error types ★
    Syntax (breaks language rules, will not run), logic (runs, wrong result), runtime (fails while running, e.g. divide by zero).
19. Sensor, actuator, end effector ★
    Sensor: input that detects the environment. Actuator: output that causes movement (motor, servo). End effector: device at the end of a robot arm (gripper).
20. Open v closed loop ★
    Open loop: output set without checking the result (timer sprinkler). Closed loop: sensor feedback adjusts the output to reach a target (thermostat, cruise control).
21. Microcontroller
    A small computer on one chip (CPU, memory, input/output pins) dedicated to controlling a device.
22. Degrees of freedom
    The independent directions or axes a part can move; motion constraints are the limits on that movement.

The most examined Year 12 topic: the CIA words, threats and their fixes, and the testing terms.

1. Confidentiality ★
   Only authorised people can read the information (encryption, access controls).
2. Integrity ★
   Data is accurate and unchanged by unauthorised parties (hashing, checksums, digital signatures, validation).
3. Availability ★
   Authorised users can reach the system and data when needed (backups, redundancy, protection from denial of service).
4. Authentication ★ 2025 Q6
   Verifying a user or system is who they claim to be (password, MFA, certificate). Answer used in 2025 Q6.
5. Authorisation ★
   Deciding what an authenticated user may do (roles, least privilege). Authentication comes first.
6. Accountability
   Actions can be traced to a user (audit logs, timestamps).
7. Security by design ★
   Security is built in from the start of development, not added at the end.
8. Cryptography ★
   Converts plain text to cipher text with an algorithm and a key so only key holders can read it.
9. Symmetric v asymmetric ★
   Symmetric: one shared key both ways, fast. Asymmetric: public key encrypts, private key decrypts (or signs); solves key sharing but slower.
10. Hashing ★
    One-way function giving a fixed-length hash; same input = same hash; cannot be reversed. Stores passwords (with a salt) and checks integrity.
11. Sandboxing ★
    Running code in an isolated, restricted environment so it cannot harm the rest of the system (browser tabs, containers).
12. Privacy by design: three parts ★ 2025 Q16(c)
    Proactive not reactive; embed privacy into design (collect only needed data, private defaults, encrypt, retention limits); respect for user privacy (consent, control).
13. Regulatory compliance ★ 2025 Q10
    Meeting laws, regulations and industry standards. It is about protecting sensitive data and meeting legal standards, NOT limiting updates, bypassing security or cutting testing.
14. Privacy Act
    The Privacy Act 1988 (Cth) and the Australian Privacy Principles govern how personal information is collected, used, stored and disclosed.
15. Social, ethical and legal issues
    Copyright, intellectual property, employment, data security, privacy, digital disruption.
16. SAST ★ 2025 Q13
    Static: analyses source code WITHOUT running it, early, white box; can give false positives.
17. DAST ★ 2025 Q13
    Dynamic: tests the RUNNING app from outside, later, black box (no source code). Finds injection, XSS, misconfiguration.
18. Code review
    Peers read the source code to find bugs and security flaws (manual).
19. Vulnerability assessment v penetration test ★
    Assessment: scan, list and rank weaknesses (does not exploit). Pen test: authorised simulated attack that exploits them.
20. Business continuity v disaster recovery ★
    Continuity keeps the business operating; disaster recovery restores IT systems and data. RTO = how long until back; RPO = how much data loss (in time) is acceptable.
21. Defensive input handling ★
    Never trust input: validate (type, range, length, format), sanitise (neutralise dangerous characters), error-handle (try/except, safe message, log detail privately).
22. Allow-list
    Accept only known-good values rather than trying to block known-bad ones.
23. API risk ★ 2025 Q5
    Excessive data exposure = exposing more data than intended. Fixes: return only needed fields, authenticate and authorise every request, validate input, HTTPS, rate limiting, generic error messages.
24. Session management ★ 2025 Q20
    Track state with a random, unpredictable session ID in a cookie: expiry/timeout, HTTPS only (Secure, HttpOnly), destroy on logout. Limit session data to keep it efficient.
25. Memory and exception management
    Release memory and files when done; handle runtime errors with try / except / finally; unhandled exceptions can reveal stack traces to attackers.
26. Broken authentication ★
    Weak login or session handling lets attackers take over accounts. Fix: strong passwords and hashing, MFA, lockout or rate limiting, session timeout.
27. XSS ★
    Attacker’s script runs in other users’ browsers via a page. Fix: sanitise input, escape/encode output, Content Security Policy.
28. CSRF ★
    A malicious site makes a logged-in user’s browser send an unwanted request. Fix: anti-CSRF tokens, check the origin, SameSite cookies.
29. XSS v CSRF
    XSS abuses the user’s trust in a site (script runs on the site). CSRF abuses the site’s trust in the user’s browser (forged request).
30. Invalid forwarding and redirecting
    Redirecting to a URL taken from user input can send users to phishing sites. Fix: allow-list valid destinations.
31. Race condition ★ 2025 Q8
    Two processes use shared data at the same time and the result depends on timing (two purchases of the last item). Fix: locks, atomic operations, transactions.
32. File attacks
    Malicious uploads, path traversal (../), tampering. Fix: validate type, size and content, store uploads outside the web root, least-privilege permissions.
33. Side-channel attack
    Learns secrets from indirect leakage (timing, power, electromagnetic, sound). Fix: constant-time code, random delays, shielding.

Protocols and ports, how a request works, securing data in transit, and load-time methods.

1. Packet ★
   A header (source and destination IP, sequence number, protocol) plus a payload (the data); reassembled in order at the destination using the sequence numbers.
2. IP address and DNS ★
   IPv4 = four numbers 0–255 (32 bits) identifying a device. DNS translates a domain name to its IP address (port 53).
3. Ports (web) ★
   HTTP 80 (not encrypted); HTTPS 443 (HTTP over SSL/TLS).
4. Ports (files and email) ★
   FTP 21; SMTP 25 sends mail; POP3 110 downloads mail to one device; IMAP 143 keeps mail on the server, synced.
5. Port
   A number that identifies the service on a device (the IP address finds the device, the port finds the application).
6. TCP/IP
   IP addresses and routes packets; TCP makes delivery reliable (connection, ordering, re-sending lost packets).
7. Request flow ★
   Browser asks DNS for the IP, opens a TCP connection (80 or 443), sends the HTTP(S) request, the server returns a response (status code and content), the browser renders it.
8. SSL/TLS certificate ★
   Issued by a trusted certificate authority; proves the site’s identity and holds its public key; enables HTTPS (authentication of the server).
9. Hash v digital signature ★
   Hash value: changes if the data changes (integrity). Digital signature: hash encrypted with the sender’s private key; checked with the public key (origin and integrity).
10. TLS key exchange
    TLS uses asymmetric encryption to agree a shared key, then symmetric for the session.
11. Front end and back end ★
    Front end (client): HTML structure, CSS style, JavaScript behaviour. Back end (server): application logic, authentication, database access (Python Flask/Django, Node.js, PHP).
12. SQL v NoSQL ★
    SQL: relational tables, fixed schema, good for transactions. NoSQL: flexible schema, scales horizontally, suits big and unstructured data.
13. ORM v SQL ★ 2025 Q9
    SQL = control and performance. ORM = convenience and portability: you use objects and the ORM writes the SQL (2025 Q9).
14. Data mining and metadata ★ 2025 Q18
    Data mining finds non-obvious patterns in large data. Metadata describes other data (title, duration, time, location). Metadata lets mining find patterns and predict demand (2025 Q18).
15. Streaming management
    Storage, CDNs that cache content near users, load balancing, auto-scaling, and predictive maintenance from traffic logs.
16. W3C and WAI ★
    W3C: international web standards body (HTML, CSS). WAI: its accessibility initiative, producing WCAG, ATAG and WAI-ARIA.
17. WCAG colour contrast ★
    4.5:1 for normal text, 3:1 for large text. Do not rely on colour alone.
18. PWA ★
    Web app that installs, works offline and loads fast. Built with a service worker (background script that serves from cache or network), a web app manifest and HTTPS.
19. CSS ★ 2025 Q7
    Controls presentation separately from HTML. One external style sheet = consistent look; media queries adapt to different devices. selector { property: value; }
20. Load-time methods ★ 2025 Q16(b)
    Minification, image optimisation, lazy loading, caching, CDN, async/defer scripts, back-end tuning (select only needed columns, index tables).
21. Load-time answer pattern
    Method + how it works + effect on load time (e.g. lazy loading shows only images in view, so less data is downloaded first).
22. Why server-side programming 2025 Q23(b)
    Reads from the database, produces dynamic content (menu, order status), keeps data secure on the server (2025 Q23b).
23. UX and accessibility
    Clear consistent navigation, alt text, semantic HTML, ARIA, keyboard use, captions; inclusivity: language options, dark mode, scalable text.

Training types, the algorithm to pick for each job, neural network vocabulary, and the bias answers worth up to 6 marks.

1. AI v ML ★
   ML is a subset of AI: algorithms that learn patterns from data. All ML is AI; not all AI is ML.
2. Supervised ★ 2025 Q3
   Trained on LABELLED data to predict labels (classification, regression).
3. Unsupervised ★
   Finds patterns in UNLABELLED data (clustering, anomaly detection).
4. Semi-supervised
   A small amount of labelled data plus a large amount of unlabelled data.
5. Reinforcement ★
   An agent learns by trial and error from rewards and penalties.
6. Memory hook ★
   Labels = supervised. No labels = unsupervised. Few labels = semi. Rewards = reinforcement.
7. Linear regression ★
   Predicts a continuous number by fitting a straight line (y = mx + c).
8. Polynomial regression
   Fits a curve for a non-linear relationship; too high a degree overfits.
9. Logistic regression ★ 2025 Q12
   Despite the name it CLASSIFIES: predicts the probability (0 to 1, sigmoid) of a category, usually yes/no (2025 Q12).
10. K-nearest neighbour
    Classifies a new point by the majority class of its K closest points; no training phase, slow on big data.
11. Choosing a model ★
    A number = linear or polynomial. A category or yes/no = logistic or KNN. Straight trend = linear; curved = polynomial.
12. Decision tree
    Internal node tests a feature, branch is the outcome, leaf is the decision. Easy to explain; can overfit.
13. Neural network layers ★ 2025 Q25
    Input layer, hidden layers (more = deep), output layer. Connections have weights; neurons use an activation function.
14. Training cycle ★
    Forward propagation → loss (prediction v correct answer) → backpropagation (send error back, update weights) → repeat over many epochs.
15. Neural network limits
    Needs large datasets and heavy computation, can overfit, hard to explain (black box).
16. MLOps three stages ★
    Design (define the problem and success metrics); Model development (data wrangling, feature engineering, training, testing); Operations (deployment, support, monitoring).
17. DevOps ★ 2025 Q11
    Combines development and operations for faster, more reliable delivery. Principles: rapid feedback, automation of repetitive tasks, collaboration (2025 Q11).
18. RPA v BPA ★
    RPA: software bots mimic a user on individual repetitive tasks. BPA: automates a whole end-to-end process.
19. Human bias ★ 2025 Q27
    Explicit (intentional) or implicit (unconscious) bias can enter at design, data collection and labelling.
20. Dataset bias ★
    Training data that is not diverse or representative, so the model performs poorly for some groups.
21. Labelling bias
    People interpret the same data differently when labelling, so inconsistent labels teach the AI the wrong pattern.
22. Bias fixes ★
    Diverse representative data, dataset audits, diverse teams, clear labelling guidelines with several reviewers, testing across groups.
23. Impact discussions (5 marks) ★ 2025 Q24
    Give a positive AND a negative, each tied to the scenario. Areas: worker safety, people with disability, employment, efficiency and environment, economy.

Approaches and implementation methods are compared again and again. Learn the one-line difference for each.

1. Functional v performance requirements ★
   Functional: what the system must DO. Performance: how WELL (speed, capacity, reliability).
2. Feasibility
   Scheduling (by the deadline?) and financial (cost v budget); also technical and operational.
3. Direct implementation ★ 2025 Q1
   Old system off, new on at once. Cheapest and quickest; highest risk (no fallback).
4. Phased implementation ★
   New system introduced in stages (module by module). Lower risk, takes longer.
5. Parallel implementation ★
   Old and new run side by side and outputs are compared. Safest (backup) but costs more. Critical systems.
6. Pilot implementation ★ 2025 Q1
   Installed for a small group or one location first, then rolled out to everyone.
7. Choosing an implementation method ★
   Critical = parallel. Small, urgent or low risk = direct. Large with separable parts = phased. Many sites = pilot.
8. Waterfall ★ 2025 Q2
   Sequential, plan-driven: each stage finishes before the next. Good for fixed requirements; inflexible, client sees product late.
9. Agile ★ 2025 Q2
   Iterative: working software in short sprints with constant client feedback. Flexible; less predictable cost and less documentation.
10. WAgile ★
    Hybrid: Waterfall-style planning and design up front, Agile sprints for development.
11. Keywords for the approaches
    Sequential, phases, documentation = Waterfall. Sprints, iterations, feedback, flexible = Agile.
12. Gantt chart ★
    Bar chart of tasks against time showing start/end, durations and dependencies.
13. Process diary / logbook Check
    Dated record of what was done, decisions, problems and solutions.

    The term page for this is marked Check; the fact itself comes from the verified memorise set.
14. Data dictionary columns ★ 2025 Q15(a)
    Variable, data type, format for display, size in bytes, size for display, description, example, validation.
15. Choosing data types ★
    Name = string; whole count = integer; price or mark = real; yes/no = Boolean; birth date = date and time.
16. Testing levels ★
    Unit (one part), integration/subsystem (modules together), system (whole system v requirements), acceptance (client confirms), beta (real users trial a near-final version).
17. Test data ★
    Boundary values (range 1–10: test 0, 1, 10, 11), path coverage (every branch/loop runs), faulty/abnormal data (wrong type, empty, negative).
18. Test plan
    Each test, the test data, expected output, actual output and pass/fail.
19. Debugging tools ★ 2025 Q15(b)
    Breakpoint (pause on a line), single-line stepping, watches (track variables), debugging output statements (print), IDE debugger.
20. Desk checking
    Manually tracing an algorithm with sample data in a trace table; peer checking is someone else doing it.
21. Maintenance types ★
    Corrective (fix bugs), adaptive (new environment, law or hardware), perfective (improve performance or add features).
22. Stub v driver ★
    Stub: stand-in for a low-level module not built yet (returns a fixed value). Driver: temporary code that calls a module that has no mainline yet.
23. Version control
    Tracks changes; branch, merge and revert; keeps history for teams (Git, GitHub).
24. Code optimisation 2025 Q4
    Language-dependent: uses features of the specific language (2025 Q4). Language-independent: better algorithm, remove redundant code, fewer nested loops.

Drawing questions are marked on correct symbols and labels. Know every symbol cold.

1. Flowchart symbols ★
   Terminator (rounded) = Start/End; rectangle = process; parallelogram = input/output; diamond = decision with labelled Yes/No arrows. Read top to bottom, left to right.
2. Flowchart errors
   No Start/End, unlabelled decision arrows, loops that never end, flowing upward without a loop.
3. DFD symbols ★
   Circle = process (verb phrase, at least one input and one output); open rectangle = data store; rectangle = external entity; labelled arrow = data flow (name the data, not the action).
4. DFD rule ★
   Data moves between a store or entity only via a process, never directly (no entity-to-store flow).
5. Level 0 v Level 1 ★
   Level 0 (context): one process for the whole system, entities and labelled flows only, no stores. Level 1: sub-processes and data stores; inputs and outputs must balance with Level 0.
6. Structure chart symbols ★
   Top box = mainline; sub-modules below; EMPTY circle = data passed; FILLED circle = flag (control value); diamond = decision; curved arrow = repetition.
7. Class diagram ★ 2025 Q22
   Three-part box: name, attributes, methods. Inheritance arrow from child to parent (shared attributes only in the parent); show multiplicity (1, 0..*).
8. Storyboard
   One frame per screen with layout and content; arrows (navigation) between screens; annotate what each button does.
9. Decision tree (diagram)
   Root decision, labelled branches (conditions), each path ends in an outcome.
10. Gantt chart
    Named tasks, duration for each, dependencies, clear time scale with dates and milestones.
11. UI mock-up
    Labelled boxes (heading, buttons, inputs, navigation), consistent layout, readable fonts and contrast, accessible features.
12. Wiring diagram
    Standard symbols (resistor, capacitor, diode, LED, switch, motor, voltage source); show data and power paths.

Code questions are worth the most marks. Write these from memory.

1. input() is a string ★
   Convert numbers with int() or float().

   age = int(input("Enter age: "))
   print(f"Hello {name}")

2. for and range ★ 2025 Q26
   range(1, 6) gives 1,2,3,4,5 (stop is excluded). Check off-by-one.

   for i in range(1, 6):
       print(i)

3. Selection ★
   if / elif / else, each with a colon and an indented body.

   if mark >= 90:
       grade = "A"
   elif mark >= 80:
       grade = "B"
   else:
       grade = "C"

4. Strings and slicing ★
   s[:3] = first 3 characters, s[-1] = last, len(s), "war" in s.

   expected = uName[:3] + "123"   # 2025 Q19

5. Lists
   append, remove, sum, max, sort; loop with range(len(nums)).

   nums.append(16)
   total = sum(nums)

6. Function: define, return, CALL ★ 2025 marker feedback
   Markers noted students defined functions but never called them. Call it and print or use the result.

   def calc_area(width, height):
       return width * height
   
   print(calc_area(3, 4))

7. random.randint ★ 2025 Q26
   Inclusive of both ends.

   import random
   n = random.randint(1, 25)

8. try / except ★
   Catch a runtime error and give a safe message.

   try:
       number = int(input("Number: "))
   except ValueError:
       print("Please enter a whole number")

9. File handling ★
   "w" overwrites, "a" appends; with closes the file automatically.

   with open("scores.txt", "a") as f:
       f.write("Alex,90\n")
   with open("scores.txt") as f:
       for line in f:
           name, mark = line.strip().split(",")

10. Class, constructor, method ★
    __init__ sets attributes with self; methods take self.

    class Person:
        def __init__(self, name, age):
            self.name = name
            self.age = age
        def greet(self):
            return "Hi, I am " + self.name

11. Inheritance in Python ★
    Subclass in brackets; super().__init__() calls the parent constructor; redefine a method to override.

    class Student(Person):
        def __init__(self, name, age, student_id):
            super().__init__(name, age)
            self.student_id = student_id

12. Encapsulation in Python
    Double underscore = private; use getter and setter methods; validate inside the setter.

    self.__balance = balance
    def get_balance(self):
        return self.__balance

13. Parameterised query ★ Check secure coding
    The ? placeholder sends user input as DATA, so it can never run as SQL (stops SQL injection). Never join input into the SQL string.

    cur.execute("SELECT * FROM Student WHERE Name = ?", (user_input,))
    conn.commit()   # needed after INSERT/UPDATE/DELETE

    The term page for this is marked Check; the fact itself comes from the verified memorise set.
14. Hashing a password
    Store a hash, never plain text (use a salt and a slow hash such as bcrypt in real systems).

    import hashlib
    hashed = hashlib.sha256("secret".encode()).hexdigest()

15. Flask route and form
    @app.route with methods; request.form reads the form; session stores the logged-in user; redirect(url_for(...)).

    @app.route("/login", methods=["GET", "POST"])
    def login():
        if request.method == "POST":
            username = request.form["username"]
            if check_user(username, password):
                session["user"] = username
                return redirect(url_for("dashboard"))

16. Protect a page with the session
    Check the session; redirect to login if missing; session.clear() on logout. Needs app.secret_key.

    if "user" not in session:
        return redirect(url_for("login"))

17. SQL clause order ★ 2025 Q21
    SELECT, FROM, WHERE, GROUP BY, ORDER BY. Quote text and date values. WHERE filters rows before grouping.

    SELECT Category, COUNT(JobID) AS Jobs
    FROM Issues
    WHERE Status = 'Pending'
    GROUP BY Category
    ORDER BY Jobs DESC

18. SQL aggregates and AS ★
    SUM, AVG, COUNT, MAX, MIN; AS renames a field for display.

    SELECT AVG(Mark) AS Average, MAX(Mark) AS Highest
    FROM Results
    WHERE Subject = 'Software Engineering'

19. SQL join ★
    Match the primary key of one table to the foreign key in the other; without the matching condition you get every combination of rows.

    SELECT Student.Name, Subject.Title
    FROM Student
    INNER JOIN Enrolment ON Student.StudentID = Enrolment.StudentID
    INNER JOIN Subject ON Enrolment.SubjectID = Subject.SubjectID

20. SQL insert, update, delete ★
    UPDATE and DELETE need WHERE, or they change every row.

    INSERT INTO Student (Name, Mark) VALUES ('Sam', 85);
    UPDATE Student SET Mark = 90 WHERE StudentID = 1;
    DELETE FROM Student WHERE StudentID = 1;

21. Primary key and foreign key ★
    Primary key uniquely identifies each row. Foreign key holds another table’s primary key. One-to-many: foreign key on the many side; many-to-many needs a linking table.
22. Pseudocode rules ★
    Keywords in CAPITALS; every BEGIN has an END, IF has ENDIF, WHILE has ENDWHILE, FOR has NEXT, CASEWHERE has END CASE; indent every body.
23. Pseudocode loops ★
    WHILE checks first (body may run zero times). REPEAT...UNTIL runs at least once and stops when the condition is true. FOR counts.

    WHILE condition is true
        process
    ENDWHILE
    
    REPEAT
        process
    UNTIL condition is true
    
    FOR i = 1 TO 5 STEP 1
        statements
    NEXT i

24. Pseudocode selection
    IF / ELSE / ENDIF; multi-way with CASEWHERE.

    IF condition THEN
        process 1
    ELSE
        process 2
    ENDIF
    
    CASEWHERE expression evaluates to
        choice a: process a
        OTHERWISE: default process
    END CASE

25. Pseudocode function
    A function returns one value with RETURN; refer to subroutines by name in the mainline.

    BEGIN Add (x, y)
        total = x + y
        RETURN total
    END Add (x, y)

Not counted as essentials. These are standard practice or from the school notes, but the supplied syllabus text does not name them, or the sources disagree. Learn them, and if the exam wording disagrees, follow the exam wording.

1. SQL injection Check
   Input joined into SQL text changes the query (x' OR '1'='1 returns every row). Fix: parameterised queries.

   SQL injection is the standard example in the school notes; the course specification names XSS and defensive input handling.
2. SFTP port Check
   SFTP is the encrypted alternative to FTP and normally uses port 22. The school notes say 443; the usual port is 22, so know the protocol and give 22 if asked.

   The school notes and the standard value disagree.
3. GDPR Check
   EU regulation covering EU residents’ data, even for overseas companies.

   GDPR comes from the school notes; the syllabus says "regulatory compliance" without naming laws.
4. Linear search Check
   Check each item in turn until found or the end is reached.

   Not named in the syllabus; it appears in past questions and the school notes.
5. Binary search Check
   Repeatedly halve a sorted list (divide and conquer).

   Not named in the syllabus; it appears in past SDD questions.
6. White-box testing Check
   Tester sees the internal code and tests every path.

   Not found word-for-word in the supplied syllabus or specifications.
7. Level 1 DFD Check
   Breaks the single process into numbered sub-processes with data stores; balances with Level 0.

   The specification gives Level 0; Level 1 as a refinement is standard practice.
8. ERD Check
   Entities as boxes, crow’s foot for “many”, primary and foreign keys marked.

   The school drawing-questions page says the ERD is technically not in the syllabus.
9. KNN is supervised Check
   K-nearest neighbour is normally taught as supervised (it uses labelled neighbours); the school notes group it under unsupervised. K-means is the unsupervised one.

   School notes and standard teaching disagree. If the exam wording disagrees with your notes, follow the exam wording.
10. Open-loop control and the line follower Check
    Open loop has no sensor feedback; the line-follower pattern is closed loop.

    Not found word-for-word in the supplied syllabus or specifications.
11. Training data v test data Check
    Train the model on one set; test it on data it has not seen.

    Standard ML practice; check the exact wording against your class notes.
12. Recursion Check
    A function that calls itself, with a base case to stop.

    Not named in the 2022 syllabus text; included because of the functional paradigm and past SDD questions.