HKDSE · Thinka-original Practice Paper

2023 HKDSE Information and Communication Technology Practice Paper | DSE Mock

Thinka 2023 DSE-Style Mock — Information and Communication Technology

125 marks210 mins2023
An original Thinka practice paper modelled on the structure and difficulty of that year's HKDSE paper. Not affiliated with or reproduced from the HKEAA.

Paper 1 Section A (MCQ)

Answer all 40 multiple-choice questions. All questions carry equal marks.
40 Question · 40 marks
Question 1 · MCQ
1 marks
Let \(A\) and \(B\) be two 8-bit signed integers represented in two's complement, where \(A = 01011011_2\) and \(B = 10100100_2\). Which of the following statements about the operation \(A + B\) is/are correct? (1) The result is negative. (2) No overflow occurs. (3) The hexadecimal representation of the result is \(\text{FF}_{16}\).
  1. A.(1) only
  2. B.(1) and (2) only
  3. C.(2) and (3) only
  4. D.(1), (2) and (3)
Question 2 · MCQ
1 marks
A host has the IP address 192.168.10.45 with a subnet mask of 255.255.255.224. Which of the following is the network address (subnet address) to which this host belongs?
  1. A.192.168.10.0
  2. B.192.168.10.32
  3. C.192.168.10.45
  4. D.192.168.10.63
Question 3 · MCQ
1 marks
Consider a database with two tables: Student(StudentID, Name, Class) where StudentID is the primary key, and Enrollment(StudentID, CourseID, EnrollDate) where (StudentID, CourseID) is the composite primary key, and StudentID is a foreign key referencing Student(StudentID). Which of the following operations will NOT violate any integrity constraints?
  1. A.Inserting a record into Enrollment with a StudentID value that does not exist in Student.
  2. B.Deleting a record from Student whose StudentID is currently referenced in Enrollment.
  3. C.Inserting a record into Enrollment with a null value for StudentID.
  4. D.Inserting a record into Student with a new StudentID value that does not exist in Student.
Question 4 · MCQ
1 marks
A database table Sales has columns SaleID, ProductID, Region, and Amount. What is the output of the following SQL query? SELECT Region, COUNT(SaleID) FROM Sales GROUP BY Region HAVING AVG(Amount) > 1100. [Sales Data: (1, 'P01', 'North', 1500), (2, 'P02', 'South', 2000), (3, 'P01', 'South', 1200), (4, 'P03', 'North', 800), (5, 'P02', 'North', 1000), (6, 'P01', 'North', 500)]
  1. A.Region: South, COUNT(SaleID): 2
  2. B.Region: North, COUNT(SaleID): 4
  3. C.Region: North, COUNT(SaleID): 4; Region: South, COUNT(SaleID): 2
  4. D.No records returned
Question 5 · MCQ
1 marks
A database relation R(A, B, C, D) has a composite primary key (A, B). Which of the following functional dependencies would violate the Second Normal Form (2NF)?
  1. A.(A, B) -> C
  2. B.C -> D
  3. C.A -> D
  4. D.(A, B) -> D
Question 6 · MCQ
1 marks
Consider the following pseudocode: A is a 1-indexed array of 5 integers: [4, 7, 2, 9, 5]. For i from 1 to 4 do: For j from 1 to 5 - i do: If A[j] > A[j+1] then Swap A[j] and A[j+1]. What is the content of the array A after the outer loop completes its first iteration (i.e., when i = 1)?
  1. A.[2, 4, 5, 7, 9]
  2. B.[4, 2, 7, 5, 9]
  3. C.[4, 2, 5, 7, 9]
  4. D.[2, 7, 4, 5, 9]
Question 7 · MCQ
1 marks
Which of the following correctly describes the roles of the Program Counter (PC) and the Memory Address Register (MAR) during the instruction fetch phase of a machine cycle?
  1. A.PC holds the address of the next instruction to be fetched, and MAR holds the memory address currently being read.
  2. B.MAR holds the data fetched from memory, and PC holds the decoded instruction.
  3. C.PC holds the address in memory currently being read, and MAR holds the next instruction.
  4. D.MAR holds the address of the next instruction, and PC holds the accumulated result of arithmetic operations.
Question 8 · MCQ
1 marks
Alice wants to send a confidential message to Bob and ensure that Bob can verify that the message indeed came from Alice (authenticity and non-repudiation). Using public-key cryptography, which keys should Alice use to (1) sign the message, and (2) encrypt the message, respectively?
  1. A.(1) Alice's private key; (2) Bob's public key
  2. B.(1) Alice's public key; (2) Bob's private key
  3. C.(1) Bob's public key; (2) Alice's private key
  4. D.(1) Bob's private key; (2) Alice's public key
Question 9 · MCQ
1 marks
A school wants to host its student management system. Instead of maintaining physical servers, the school decides to rent virtual servers and storage space from a cloud service provider, but the school's IT staff will still install and manage the operating system, databases, and application software. Which cloud service model is the school utilizing?
  1. A.Software as a Service (SaaS)
  2. B.Platform as a Service (PaaS)
  3. C.Infrastructure as a Service (IaaS)
  4. D.Database as a Service (DBaaS)
Question 10 · MCQ
1 marks
Which of the following statements comparing a compiler and an interpreter is/are correct? (1) A compiler translates the entire source code into machine code before execution, whereas an interpreter translates and executes code line-by-line. (2) An interpreted program generally runs faster than a compiled program because it does not require a compilation step. (3) If there is a syntax error in the middle of the code, a compiler will report the error before generating any executable, while an interpreter may execute the preceding lines before stopping at the error.
  1. A.(1) only
  2. B.(1) and (2) only
  3. C.(1) and (3) only
  4. D.(2) and (3) only
Question 11 · MCQ
1 marks
In an 8-bit two's complement representation, what is the binary representation of the decimal number \(-37\)?
  1. A.11011011
  2. B.11011010
  3. C.10100101
  4. D.11100101
Question 12 · MCQ
1 marks
Which of the following statements about Cache Memory is/are correct?

(1) It is faster than registers inside the CPU.
(2) It stores frequently used data and instructions to speed up CPU access.
(3) It is typically larger in capacity than the main memory (RAM).
  1. A.(2) only
  2. B.(1) and (2) only
  3. C.(2) and (3) only
  4. D.(1), (2) and (3)
Question 13 · MCQ
1 marks
Which of the following IP addresses can be assigned to a host on a private local area network (LAN) without routing on the public Internet?

(1) 10.150.23.45
(2) 172.20.100.2
(3) 192.168.1.254
(4) 168.192.0.1
  1. A.(1) and (3) only
  2. B.(2) and (3) only
  3. C.(1), (2) and (3) only
  4. D.(1), (2), (3) and (4)
Question 14 · MCQ
1 marks
In public-key cryptography, when Alice wants to send a digitally signed message to Bob to ensure non-repudiation and integrity, Alice should:
  1. A.Encrypt the message hash with Alice's private key.
  2. B.Encrypt the message hash with Bob's public key.
  3. C.Encrypt the message hash with Alice's public key.
  4. D.Encrypt the message hash with Bob's private key.
Question 15 · MCQ
1 marks
In a relational database, there are two tables:
`STUDENT(StudentID, StudentName, ClassID)` and `CLASS(ClassID, ClassName, RoomNo)`.
`StudentID` is the primary key of `STUDENT`, and `ClassID` is the primary key of `CLASS`. `ClassID` in `STUDENT` is a foreign key referencing `CLASS`. Which of the following operations violates referential integrity?
  1. A.Inserting a new record into CLASS with a new ClassID.
  2. B.Inserting a new record into STUDENT with a ClassID that does not exist in CLASS.
  3. C.Deleting a record from STUDENT.
  4. D.Changing the ClassName of a class in the CLASS table.
Question 16 · MCQ
1 marks
Consider the table `Sales(SalesID, ItemID, Quantity, Price)`.
What is the purpose of the following SQL statement?

```sql
SELECT ItemID, SUM(Quantity * Price) AS TotalRevenue
FROM Sales
GROUP BY ItemID
HAVING SUM(Quantity * Price) > 1000;
```
  1. A.To find the list of item IDs where the unit price of any individual sale is greater than 1000.
  2. B.To calculate the total quantity sold for each item, and display those with total quantity greater than 1000.
  3. C.To find the item IDs whose total revenue (Quantity * Price) across all sales is greater than 1000.
  4. D.To display all sales records where the sales amount is greater than 1000, grouped by ItemID.
Question 17 · MCQ
1 marks
A table `ProjectMember(ProjectID, EmployeeID, EmployeeName, HoursWorked)` has a composite primary key `(ProjectID, EmployeeID)`.
The functional dependencies are:
- `(ProjectID, EmployeeID) -> HoursWorked`
- `EmployeeID -> EmployeeName`

Which normal form does this table satisfy, and what is the reason?
  1. A.First Normal Form (1NF) only, because there is a partial dependency.
  2. B.Second Normal Form (2NF) only, because there are no transitive dependencies.
  3. C.Third Normal Form (3NF), because all non-key attributes are fully functionally dependent on the primary key.
  4. D.It is not even in 1NF, because it has duplicate keys.
Question 18 · MCQ
1 marks
Consider the following pseudocode:

```
Set A to [3, 8, 2, 7, 5]
Set N to 5
For i from 0 to N - 2:
For j from 0 to N - 2 - i:
If A[j] > A[j+1] Then
Swap A[j] and A[j+1]
EndIf
EndFor
EndFor
```

What is the state of array `A` after the outer loop has completed exactly 2 iterations (i.e., `i = 0` and `i = 1`)?
  1. A.[3, 2, 7, 5, 8]
  2. B.[2, 3, 5, 7, 8]
  3. C.[2, 3, 7, 5, 8]
  4. D.[2, 3, 5, 8, 7]
Question 19 · MCQ
1 marks
Consider the following recursive function:

```
Function f(n, k)
If n == 0 Then
Return 0
Else If n % 2 == 1 Then
Return k + f(n // 2, k * 2)
Else
Return f(n // 2, k * 2)
EndIf
EndFunction
```
Note: `//` is integer division. What is the return value of the function call `f(11, 3)`?
  1. A.33
  2. B.13
  3. C.15
  4. D.48
Question 20 · MCQ
1 marks
A school wants to host its own virtual learning environment (VLE) website. The IT department decides to rent virtual machines (VMs) and storage from a cloud provider. They will install and maintain the operating systems, web server software, and the VLE application themselves. Which cloud service model is the school utilizing?
  1. A.Infrastructure as a Service (IaaS)
  2. B.Platform as a Service (PaaS)
  3. C.Software as a Service (SaaS)
  4. D.Database as a Service (DBaaS)
Question 21 · MCQ
1 marks
An 8-bit register stores a signed integer using two's complement representation. If the content of the register is \(10101100_2\), what is its decimal value?
  1. A.-84
  2. B.-44
  3. C.-83
  4. D.172
Question 22 · MCQ
1 marks
Consider two database tables: `STUDENT` and `CLASS`.\n`STUDENT` table: `StudentID` (Primary Key), `Name`, `ClassID` (Foreign Key referencing `CLASS.ClassID`)\n`CLASS` table: `ClassID` (Primary Key), `TeacherInCharge`\n\nWhich of the following actions will definitely violate referential integrity?\nI. Inserting a new student record with a `ClassID` that does not exist in the `CLASS` table.\nII. Deleting a class record from the `CLASS` table while some student records in the `STUDENT` table still have that `ClassID`.\nIII. Updating a student's `Name` to null.
  1. A.I only
  2. B.I and II only
  3. C.II and III only
  4. D.I, II and III
Question 23 · MCQ
1 marks
Consider the following pseudocode segment:\n\n```\nX = 15\nY = 6\nWhile X != Y Do\n If X > Y Then\n X = X - Y\n Else\n Y = Y - X\n EndIf\nEndWhile\n```\n\nWhat is the final value of `X`?
  1. A.3
  2. B.6
  3. C.9
  4. D.15
Question 24 · MCQ
1 marks
A computer has an IP address of `192.168.10.45` with a subnet mask of `255.255.255.224`. Which of the following IP addresses belongs to the same subnet as this computer?
  1. A.192.168.10.15
  2. B.192.168.10.30
  3. C.192.168.10.60
  4. D.192.168.10.65
Question 25 · MCQ
1 marks
Alice wants to send a confidential message to Bob using public-key cryptography. She also wants to ensure that Bob can verify the message indeed came from her (authentication). Which of the following describes the correct encryption process?
  1. A.Alice encrypts the message with Bob's public key, then encrypts the result with her own public key.
  2. B.Alice encrypts the message with her own private key, then encrypts the result with Bob's public key.
  3. C.Alice encrypts the message with Bob's private key, then encrypts the result with her own private key.
  4. D.Alice encrypts the message with Bob's public key, then encrypts the result with her own private key.
Question 26 · MCQ
1 marks
Consider the database table `SALES` below:\n\n| SaleID | Product | Category | Amount |\n|---|---|---|---|\n| 1 | Laptop | IT | 8000 |\n| 2 | Mouse | IT | 150 |\n| 3 | Desk | Furniture | 1200 |\n| 4 | Chair | Furniture | 800 |\n| 5 | Phone | IT | 5000 |\n\nWhat is the output of the following SQL query?\n\n```sql\nSELECT Category, AVG(Amount) FROM SALES\nGROUP BY Category\nHAVING COUNT(*) > 1 AND AVG(Amount) > 1000;\n```
  1. A.Category | AVG(Amount)
    IT | 4383.33
  2. B.Category | AVG(Amount)
    IT | 4383.33
    Furniture | 1000.00
  3. C.Category | AVG(Amount)
    Furniture | 1000.00
  4. D.Empty set (No rows returned)
Question 27 · MCQ
1 marks
Which of the following statements about "thrashing" in virtual memory is/are correct?\n\nI. Thrashing occurs when the operating system spends more time swapping pages in and out of secondary storage than executing actual program instructions.\nII. Increasing the capacity of physical RAM can help resolve the thrashing problem.\nIII. Defragmenting the hard disk is the most effective way to eliminate thrashing.
  1. A.I only
  2. B.I and II only
  3. C.II and III only
  4. D.I, II and III
Question 28 · MCQ
1 marks
During the fetch-decode-execute cycle of a CPU, which register is updated to store the address of the next instruction to be fetched immediately after an instruction is fetched?
  1. A.Memory Address Register (MAR)
  2. B.Program Counter (PC)
  3. C.Instruction Register (IR)
  4. D.Accumulator (ACC)
Question 29 · MCQ
1 marks
Consider a relation `BOOK_LOAN` with attributes:\n`{LoanID, StudentID, StudentName, BookID, BookTitle, LoanDate}`\n\nAssume that:\n- `LoanID` is the primary key.\n- Each student has a unique `StudentID` and a single `StudentName`.\n- Each book has a unique `BookID` and a single `BookTitle`.\n\nWhich of the following normal forms does this relation satisfy?\n\nI. First Normal Form (1NF)\nII. Second Normal Form (2NF)\nIII. Third Normal Form (3NF)
  1. A.I only
  2. B.I and II only
  3. C.II and III only
  4. D.I, II and III
Question 30 · MCQ
1 marks
A software development company wants to develop and deploy a new web application. They want to focus entirely on coding and managing the application, without worrying about managing the underlying operating systems, hardware servers, storage, or network infrastructure. Which cloud computing service model is most suitable for them?
  1. A.Infrastructure as a Service (IaaS)
  2. B.Platform as a Service (PaaS)
  3. C.Software as a Service (SaaS)
  4. D.Database as a Service (DBaaS)
Question 31 · MCQ
1 marks
Consider the following pseudocode:
```
Integer Array A[0..5] = {3, 8, 2, 9, 5, 4}
Integer i, temp
For i = 0 To 4 Do:
If A[i] > A[i+1] Then:
temp = A[i]
A[i] = A[i+1]
A[i+1] = temp
EndIf
EndFor
```
What is the content of array `A` after executing the pseudocode?
  1. A.{2, 3, 4, 5, 8, 9}
  2. B.{3, 2, 8, 5, 4, 9}
  3. C.{3, 8, 2, 5, 4, 9}
  4. D.{3, 2, 5, 4, 8, 9}
Question 32 · MCQ
1 marks
A database table `STUDENT` contains fields `StudentID`, `Name`, `Class`, and `Score`. Which of the following SQL queries can correctly display the class name and the number of students in each class who scored 60 or above?
  1. A.`SELECT Class, COUNT(*) FROM STUDENT WHERE Score >= 60 GROUP BY Class;`
  2. B.`SELECT Class, COUNT(*) FROM STUDENT GROUP BY Class HAVING Score >= 60;`
  3. C.`SELECT Class, COUNT(Score) FROM STUDENT WHERE Score >= 60 GROUP BY StudentID;`
  4. D.`SELECT Class, SUM(Score) FROM STUDENT WHERE Score >= 60 GROUP BY Class;`
Question 33 · MCQ
1 marks
In a relational database, table `PROJECT` has a composite primary key `(ProjID, MemberID)`. Table `MEMBER` has a primary key `MemberID`. Which of the following statements about referential integrity is/are correct?
(1) `MemberID` in `PROJECT` is a foreign key referencing `MemberID` in `MEMBER`.
(2) `MemberID` in `PROJECT` cannot contain duplicate values.
(3) A record cannot be added to `PROJECT` if its `MemberID` does not exist in `MEMBER`.
  1. A.(1) only
  2. B.(1) and (3) only
  3. C.(2) and (3) only
  4. D.(1), (2) and (3)
Question 34 · MCQ
1 marks
Consider the following Entity-Relationship (ER) diagram representing a library system:
`[Reader] <---- (1:N) ---- [Borrow] ---- (N:1) ----> [Book]`
Which of the following descriptions about the relationship between `Reader` and `Book` is correct?
  1. A.A reader can borrow multiple books, and a book can be borrowed by multiple readers at different times.
  2. B.Each reader can only borrow one book, and each book can only be borrowed by one reader.
  3. C.The relation `Borrow` should have a composite primary key consisting of keys from both `Reader` and `Book` tables only, without any other fields allowed.
  4. D.The relationship between `Reader` and `Book` is a one-to-one (1:1) relationship.
Question 35 · MCQ
1 marks
A computer has the IP address `192.168.10.75` and the subnet mask `255.255.255.240`. Which of the following is the network address (or subnet ID) of the subnet to which this computer belongs?
  1. A.`192.168.10.0`
  2. B.`192.168.10.64`
  3. C.`192.168.10.72`
  4. D.`192.168.10.80`
Question 36 · MCQ
1 marks
An audio file is recorded with the following specifications:
- Sampling rate: \(44.1 \text{ kHz}\)
- Sampling size: \(16\text{-bit}\)
- Channel: Stereo (2 channels)
- Duration: \(2\text{ minutes}\)
If no compression is applied, what is the estimated file size of the recorded audio file in megabytes (MB)? (Assume \(1 \text{ MB} = 10^6 \text{ bytes}\))
  1. A.\(5.3 \text{ MB}\)
  2. B.\(10.6 \text{ MB}\)
  3. C.\(21.2 \text{ MB}\)
  4. D.\(42.3 \text{ MB}\)
Question 37 · MCQ
1 marks
Which of the following descriptions about different types of computer memory is/are correct?
(1) Cache memory is faster than main memory (RAM) and is used to store frequently accessed data.
(2) ROM is non-volatile and is typically used to store the BIOS/UEFI boot programs.
(3) RAM is volatile, meaning its content is lost when the power is turned off.
  1. A.(1) and (2) only
  2. B.(1) and (3) only
  3. C.(2) and (3) only
  4. D.(1), (2) and (3)
Question 38 · MCQ
1 marks
Alice wants to send a confidential document to Bob over the Internet. To ensure both **confidentiality** (only Bob can read the document) and **authenticity** (Bob can verify that Alice is the sender), which of the following encryption methods should Alice use?
  1. A.Encrypt the document using Alice's private key, then encrypt the result using Bob's public key.
  2. B.Encrypt the document using Bob's private key, then encrypt the result using Alice's public key.
  3. C.Encrypt the document using Alice's public key, then encrypt the result using Bob's private key.
  4. D.Encrypt the document using Bob's public key, then encrypt the result using Alice's public key.
Question 39 · MCQ
1 marks
A software company wants to deploy a web application. Instead of managing physical servers, they decide to rent virtual machines and storage from a cloud service provider, allowing them to install their own operating systems, databases, and application software. Which cloud computing service model are they utilizing?
  1. A.Software as a Service (SaaS)
  2. B.Platform as a Service (PaaS)
  3. C.Infrastructure as a Service (IaaS)
  4. D.Database as a Service (DBaaS)
Question 40 · MCQ
1 marks
Which of the following are the typical tasks performed by an operating system (OS)?
(1) Allocating memory space to different running applications.
(2) Managing input/output devices using device drivers.
(3) Scanning files to detect and remove computer viruses.
  1. A.(1) and (2) only
  2. B.(1) and (3) only
  3. C.(2) and (3) only
  4. D.(1), (2) and (3)

Paper 1 Section B (Conventional)

Answer all questions in the spaces provided.
5 Question · 40 marks
Question 1 · Structured Conventional
8 marks
An image has a resolution of \(1024 \times 1024\) pixels and is stored in 24-bit true color.

(a) (i) Calculate the uncompressed file size of the image in MB, using \(1\text{ MB} = 1024^2\text{ bytes}\). Show your calculations. (2 marks)
(ii) If the image is converted to 8-bit grayscale, what is the ratio of the file size of the grayscale image to that of the original 24-bit image? (1 mark)

(b) Consider an 8-bit system using two's complement representation.
(i) Represent the decimal number \(-18\) in 8-bit two's complement. (1 mark)
(ii) Perform the subtraction \(35 - 18\) by adding \(35\) and \(-18\) in 8-bit two's complement binary addition. Show your steps and the final result in decimal. (2 marks)

(c) Explain why UTF-8 is widely adopted over ASCII for web pages that support multilingual content, such as Chinese and English. (2 marks)
Question 2 · Structured Conventional
8 marks
A school's local area network (LAN) is connected to the Internet via a router. The internal network uses the private IP address range \(192.168.1.0/24\).

(a) (i) Write down the subnet mask of \(192.168.1.0/24\) in dotted decimal notation. (1 mark)
(ii) What is the maximum number of host devices that can be assigned valid IP addresses in this subnet? Explain your answer. (2 marks)

(b) Explain the primary function of each of the following in the school's network:
(i) DHCP Server (2 marks)
(ii) NAT (Network Address Translation) running on the router (2 marks)

(c) A student tries to ping a website using its domain name (e.g., `www.school.edu.hk`), but the ping fails. However, entering the website's IP address directly in a web browser successfully loads the page. Identify the network service that is likely malfunctioning. (1 mark)
Question 3 · Structured Conventional
8 marks
An online bookstore database contains two tables: `PUBLISHERS` and `BOOKS`. The schemas are defined as follows:

`PUBLISHERS(PubID, PubName, Address, Contact)`
`BOOKS(BookID, Title, Price, PubID, PublishDate)`

(a) (i) Identify the primary key and the foreign key of the `BOOKS` table. (2 marks)
(ii) State and explain the relationship between `PUBLISHERS` and `BOOKS` (e.g., 1:1, 1:N, or M:N). (2 marks)

(b) (i) A database administrator attempts to insert a book record with a `PubID` that does not exist in the `PUBLISHERS` table. State what will happen and name the integrity constraint violated. (2 marks)
(ii) Can a user insert a new book record with a null value in `BookID`? Explain your answer with reference to database integrity. (2 marks)
Question 4 · Structured Conventional
8 marks
The following algorithm is designed to find the second largest value in an array `A` of `N` integers (where \(N \ge 2\)). The array index starts from 1.

```
1. largest = A[1]
2. second_largest = -999999
3. For i = 2 to N Do
4. If A[i] > largest Then
5. second_largest = largest
6. largest = A[i]
7. Else If A[i] > second_largest And A[i] != largest Then
8. second_largest = A[i]
9. EndIf
10. EndFor
```

(a) Trace the execution of the algorithm with \(N = 5\) and \(A = [12, 15, 8, 15, 14]\) by completing the table below. (4 marks)

| `i` | `A[i]` | `largest` | `second_largest` |
| --- | --- | --- | --- |
| Initial | - | 12 | -999999 |
| 2 | 15 | | |
| 3 | 8 | | |
| 4 | 15 | | |
| 5 | 14 | | |

(b) (i) If the input array is \(A = [10, 10, 10]\) with \(N = 3\), what is the final value of `second_largest`? (1 mark)
(ii) Explain how the condition `A[i] != largest` in line 7 ensures the algorithm works correctly when there are duplicate maximum values in the array (e.g., finding the second largest *distinct* value). (3 marks)
Question 5 · Structured Conventional
8 marks
An e-commerce platform handles confidential customer transactions and requires user login.

(a) The platform uses `https://` instead of `http://` for its web address.
(i) Identify the network protocol used to implement HTTPS. (1 mark)
(ii) Explain how this protocol protects user credentials (such as passwords) from being stolen via 'packet sniffing' on public Wi-Fi. (2 marks)

(b) To prevent brute-force attacks by automated scripts, the platform places a CAPTCHA on the login page. Explain how CAPTCHA helps distinguish between human users and automated bots. (2 marks)

(c) During the HTTPS connection setup, asymmetric encryption is used initially, but the system switches to symmetric encryption for transferring web pages.
(i) Why is asymmetric encryption used in the initial handshake rather than symmetric encryption? (2 marks)
(ii) Why is symmetric encryption preferred over asymmetric encryption for data transmission after the handshake? (1 mark)

Paper 2 Elective (Conventional)

Answer any THREE questions out of four from your chosen elective.
3 Question · 45 marks
Question 1 · Elective Structured Conventional
15 marks
A local food delivery platform, "HK-Express-Food", wants to design a database to store information about restaurants, food items, and customer orders. Initially, a junior database designer proposes a single relation to hold all the data:

`ORDER_TEMP (OrderID, CustomerID, CustomerName, CustomerPhone, RestaurantID, RestaurantName, RestaurantAddress, OrderDate, FoodID, FoodName, UnitPrice, Quantity, DeliveryFee)`

Assume that each order is made by a single customer from a single restaurant on a specific date, and multiple food items can be ordered in one single order.

(a) Identify the primary key of `ORDER_TEMP` and explain why this relation is not in the Second Normal Form (2NF), referring to the concept of partial functional dependency. (3 marks)

(b) Identify two transitive dependencies in `ORDER_TEMP`. Explain how transitive dependency can lead to data redundancy or update anomalies. (3 marks)

(c) Decompose the relation `ORDER_TEMP` into a set of relations in the Third Normal Form (3NF). For each relation, state its name, and list its attributes, clearly underlining the primary key(s) and marking the foreign key(s) with an asterisk (*) or a hash sign (#). (6 marks)

(d) HK-Express-Food wants to add a "Coupons" feature. A coupon can be used multiple times by different customers, and a customer can use multiple different coupons over time, but each order can use at most one coupon. Suggest how the database schema should be modified to support this feature. (3 marks)
Question 2 · Elective Structured Conventional
15 marks
A fitness center "FitLife" manages its members, classes, and bookings using three relational tables:

`MEMBER (MemberID, MemberName, MemberType, JoinDate, Balance)`
- `MemberType` can be 'Gold', 'Silver', or 'Bronze'.
- `Balance` is the current prepaid monetary balance in the member's account.

`CLASS (ClassID, ClassName, Instructor, Fee, MaxCapacity)`
- `Fee` is the cost of attending the class.

`BOOKING (BookingID, MemberID, ClassID, BookingDate, Status)`
- `Status` can be 'Confirmed' or 'Cancelled'.

Write SQL statements to perform the tasks in (a) to (e).

(a) Write an SQL statement to list the names of Gold members who joined after '2023-01-01', sorted by their names in alphabetical order. (2 marks)

(b) Write an SQL statement to display the `ClassName` and the total number of confirmed bookings for each class. If a class has no confirmed bookings, display 0. (3 marks)

(c) Write an SQL statement to show the names of members who have booked at least two different classes instructed by 'Alex'. (3 marks)

(d) (i) Due to a promotion, FitLife wants to refund \$20 to the `Balance` of all Gold members who have at least one confirmed booking of the class named 'Yoga Basic'. Write an SQL statement to update the `MEMBER` table accordingly. (3 marks)
(ii) State the type of database integrity constraint that can be used to prevent `Balance` from falling below zero, and write an SQL segment to define this constraint on the `MEMBER` table. (2 marks)

(e) Create a database view named `V_CLASS_SUMMARY` that shows the `ClassID`, `ClassName`, and the percentage of occupancy for each class. (The percentage of occupancy is defined as: the total number of bookings in the `BOOKING` table for that class divided by its `MaxCapacity`, multiplied by 100). (2 marks)
Question 3 · Elective Structured Conventional
15 marks
An online retail store "HK-Shop" manages customer purchases using a relational database. High volumes of simultaneous transactions are executed. A simplified schema for the stock control system is:

`INVENTORY (ProductID, ProductName, StockLevel, UnitPrice)`
`ORDER_LINE (OrderID, ProductID, Quantity)`

(a) Suppose Customer A and Customer B both attempt to purchase the same product (with `ProductID` = 'P101', which currently has `StockLevel` = 1) at the exact same millisecond.
(i) Describe the concurrency problem that could occur if no transaction management (locking) is implemented. State the term for this phenomenon. (3 marks)
(ii) Explain how "Two-Phase Locking (2PL)" can prevent this concurrency issue. (2 marks)
(iii) However, locking can lead to a "deadlock" situation. Describe what a deadlock is in this context, and suggest one method the Database Management System (DBMS) can use to handle it. (3 marks)

(b) HK-Shop's database administrator (DBA) wants to optimize the performance of the following SQL query, which runs frequently:
```sql
SELECT ProductName, UnitPrice
FROM INVENTORY
WHERE UnitPrice BETWEEN 100 AND 500
ORDER BY UnitPrice DESC;
```
(i) Suggest and write an SQL statement to create an appropriate database index to speed up this query. (2 marks)
(ii) Explain how this index improves query performance. (2 marks)
(iii) State one negative impact of creating too many indexes on a database. (1 mark)

(c) Security is a crucial concern. The DBA wants to grant access rights to a newly hired customer service officer, "Lucy". Lucy should only be allowed to view (but not modify) order details, and she should not have any access to the `INVENTORY` table.
Write the SQL statement(s) to grant Lucy the appropriate privileges on the `ORDER_LINE` table. (2 marks)