Past questions › sample-q25
2025 8 marks Extended response Software Automation (Year 12) ML, DevOps, RPA, BPA in security
NESA HSC Software Engineering Sample Examination + Marking Guidelines (official, 2025)
A telecommunications company had a recent security breach which prompted a review of its systems. It has contracted QuidantCon, whose proposal includes: 1. Business Process Automation (BPA) Security: predictive analysis (identify vulnerabilities in business processes and automate risk mitigation); automated compliance monitoring (continuous compliance with security regulations through ML). 2. DevOps Integration: automated security testing (ML-powered code scanning and vulnerability testing); anomaly detection (monitor logs and traffic using ML). 3. Robotic Process Automation (RPA) Enhancement: intelligent task automation (optimise workflows using ML); threat prediction (predict and prevent security threats with ML). Discuss QuidantCon's proposal for security enhancements to the company's systems. (8 marks, max 300 words)
Marking criteria
8: Discusses the proposal with reference to ML in DevOps, RPA and BPA from the slideshow. 6-7: Outlines advantages AND disadvantages with reference to at least TWO of these areas. 4-5: Outlines some advantages and/or disadvantages with reference to ML in DevOps and/or RPA and/or BPA. 2-3: Some understanding of the features of the proposal. 1: Some relevant information.
Sample answer
QuidantCon's proposal for the company suggests leveraging machine learning (ML) and automation to bolster security measures. One key benefit is the automation of security testing and vulnerability scanning, facilitated by integrating ML-powered tools into the DevOps pipeline. This approach ensures continuous security testing and provides rapid feedback to developers, allowing for early detection of security issues and reducing the risk of vulnerabilities being exploited. The frequent and automated testing improves the overall security position and enhances compliance with industry standards. Additionally, ML algorithms can analyse vast amounts of data to detect patterns and anomalies, which is crucial for proactive threat identification. This capability enables the company to identify security risks proactively, learn from past incidents, and predict future attacks, thereby enhancing their overall security measures.
QuidantCon's proposal for the company also raises some concerns. One key issue is the need for high-quality data for ML algorithms to work effectively. If the data is inconsistent or incomplete, the ML models may not perform well, leading to false positives or missed threats. Another concern is the complexity of implementing ML solutions, which can be challenging and may require specialised skills and training. This complexity could result in integration challenges, higher costs, and delays. Additionally, ML systems can be biased, potentially affecting security decisions. Security and privacy are also critical, as handling sensitive data requires protection against unauthorised access and breaches. These concerns emphasise the need for a careful and balanced approach when considering ML and automation in security practices.