Mark Scheme

Section A — Structured Questions

1. (a) (up to 2) The AND gate outputs 1 only when both (all) of its inputs are 1; when both inputs are 1 the output is 1. [2] (b) (4) Q = A OR B outputs: 0, 1, 1, 1 (in the four rows). 1 mark per correct output. [4] (c) (up to 4) The AND gate gives an output of 1 only when both inputs are 1 (otherwise 0); the OR gate gives an output of 1 when at least one input is 1 (0 only when both are 0). Clear contrast referring to the conditions for a 1 output. [4]

2. (a) (up to 2) A linear search checks each item in a list one at a time, in order, from the start, until it finds the target (or reaches the end). [2] (b) (up to 4) Advantage: a binary search is much faster on large lists (it halves the search area each step, so far fewer comparisons) (2); condition: the list must already be sorted (in order) (2). [4] (c) (up to 4) A bubble sort compares each adjacent pair of items and swaps them if they are in the wrong order; it passes through the list repeatedly, and after each pass the largest remaining value "bubbles" to the end; it stops when a pass makes no swaps (the list is sorted). Reference to comparisons and swaps. [4]

3. (a) (up to 2) A record is all the data about one item/person (a row); a field is a single item/category of data (a column, e.g. Name). [2] (b) (up to 4) A relational database reduces data duplication/redundancy (data stored once, linked by keys), which saves space and makes updating easier and more consistent (change data in one place); it also improves data integrity and can be queried more flexibly. Two developed points. [4] (c) (up to 6) (i) should return the Name of every record where Year = 11; (ii) should return all records where Grade = 'A'. (up to 4 for correct descriptions/what they do — 2 each) + (up to 2) a correct SQL statement for one, e.g. SELECT Name FROM Students WHERE Year = 11; or SELECT * FROM Students WHERE Grade = 'A';. Accept minor syntax variation. [6]

4. (a) (up to 2) Malware = malicious software designed to damage, disrupt or gain unauthorised access to a computer system (e.g. viruses, worms, ransomware). [2] (b) (up to 4) A virus is malicious code that attaches to files/programs and replicates, damaging or disrupting the system; phishing is a social-engineering attack that uses fake emails/messages to trick users into revealing personal/financial information. Technical malware vs deceiving the user. [4] (c) (up to 6) Two methods developed, 3 each: firewall (blocks unauthorised network traffic); anti-malware/antivirus (detects and removes malicious software); strong passwords + user access levels/authentication (limit who can access data); encryption (data unreadable if stolen); regular updates/patches; staff training (spot phishing); backups (recover after an attack). Method + how it helps. [6]

Section B — Extended Response

5. (16 marks) Levels-marked discussion and evaluation.

• Threats: malware/ransomware; hacking/unauthorised access; phishing of staff; insider misuse; data loss from hardware failure; the high value/sensitivity of patient data makes it a target.
• Measures: firewalls and anti-malware; encryption of patient records; strong authentication and access levels (only relevant staff see records); regular backups; staff training; software updates; physical security.
• Evaluation: technical measures are strong but no system is completely secure; the human factor (staff falling for phishing, weak passwords) is often the weakest link, so training matters as much as technology; backups limit damage but do not prevent breaches; encryption protects data even if stolen. A layered approach is most effective.
• Level 4 (13–16): balanced discussion of threats and measures with genuine evaluation of effectiveness and a justified conclusion; Level 3 (9–12): several developed points; Level 2 (5–8): limited/one-sided; Level 1 (1–4): basic.

Sample Answers with Examiner Commentary

Question 2(c) — Sample Answers

Grade A response. "A bubble sort works by comparing each pair of adjacent items in the list and swapping them if they are in the wrong order. It starts at the beginning: for the list [7, 3, 9, 2] it compares 7 and 3, sees they are in the wrong order and swaps them to get [3, 7, 9, 2]; it compares 7 and 9 (correct, no swap); then 9 and 2 and swaps to get [3, 7, 2, 9]. That is one pass, and the largest value, 9, has 'bubbled' to the end. The algorithm keeps passing through the list, each time comparing adjacent pairs and swapping where needed, until it completes a whole pass with no swaps, which means the list is fully sorted into ascending order."

Mark: 4/4. Examiner commentary: A full-mark answer that explains the mechanism precisely — comparing adjacent pairs and swapping when out of order — and refers explicitly to both comparisons and swaps as the question demands. Walking through an actual pass on the given list, and noting that the largest value bubbles to the end and that the sort stops when a pass makes no swaps, demonstrates genuine understanding of how the algorithm terminates, not just what it does. This is exactly the level of detail the four marks require.

Grade C response. "A bubble sort puts the numbers in order by swapping them around until they are sorted. It compares the numbers and swaps the big ones to the end."

Mark: 2/4. Examiner commentary: The candidate shows a basic, correct idea — that the sort compares numbers and swaps them until the list is in order, with larger values moving to the end — earning two marks. However, the description lacks precision: it does not make clear that only adjacent pairs are compared, that the list is passed through repeatedly, or that the sort stops when a pass makes no swaps. Describing the adjacent-pair comparison and the repeated passes, ideally with a quick example, would gain the remaining marks.

Question 4(c) — Sample Answers

Grade A response (extract). "One method is to use a firewall, which monitors and controls the traffic coming into and out of the network and blocks any unauthorised or suspicious connections. This helps by stopping hackers and malware from getting into the system in the first place, acting as a barrier between the organisation's network and the outside internet. A second method is to encrypt sensitive data. Encryption scrambles the data using a key so that even if an attacker manages to steal it, they cannot read or use it without the key. This helps by protecting the confidentiality of the data as a last line of defence, so that a breach does not automatically mean the information is exposed."

Mark: 6/6. Examiner commentary: A full-mark answer. Two distinct, valid protection methods (a firewall and encryption) are each explained clearly and, crucially, paired with how each helps — the firewall blocking unauthorised access at the boundary, encryption rendering stolen data unusable as a last line of defence. Explaining the mechanism and the benefit of each, rather than simply naming security measures, is exactly what the six-mark question rewards.

Grade C response. "They could use antivirus software and firewalls to stop hackers and viruses getting in."

Mark: 3/6. Examiner commentary: The candidate names two valid methods — antivirus and a firewall — and gives a general purpose (stopping hackers and viruses), earning three marks. However, the two methods are bundled into one statement and neither is developed. To reach full marks, each should be explained separately with how it helps: antivirus detecting and removing malicious software, and a firewall monitoring and blocking unauthorised network traffic. Treating each method fully and separately would earn the remaining marks.