2024 CCEA A-Level Digital Technology 2650 模擬試題連答案詳解

(a) A repeater regenerates and strengthens a weakening signal so it can be transmitted further without loss of data quality. (b) An IP address is a unique numeric address assigned to a device to identify it and enable routing of data to and from it. (c) A peer-to-peer (P2P) network has no dedicated central server; every computer has equal status and can share resources directly with any other. (d) A media converter translates signals between two different transmission media, such as fibre optic and copper cable, allowing them to be connected. (e) A MAC (Media Access Control) address is a unique physical address assigned by the manufacturer to a network interface card. Answer: (a) repeater; (b) IP address; (c) peer-to-peer (P2P) network; (d) media converter; (e) MAC address

[1] mark for each correct term (max 5): (a) repeater; (b) IP address; (c) peer-to-peer/P2P network; (d) media converter; (e) MAC address.

(a) The Data Protection Act gives individuals rights over their personal data and places obligations on organisations that collect, store and use it. (b) The Copyright, Designs and Patents Act protects the intellectual property rights of creators of original works, including software, against unauthorised copying or use. (c) The Computer Misuse Act creates the criminal offence of unauthorised access to computer material. (d) A second, more serious offence under the Computer Misuse Act is unauthorised access with intent to commit or facilitate a further offence. (e) A third offence under the Computer Misuse Act is unauthorised modification of computer material, which covers actions such as impairing the operation of a computer or program, for example by deploying malware. Answer: (a) Data Protection Act; (b) Copyright, Designs and Patents Act; (c) Computer Misuse Act; (d) unauthorised access with intent to commit a further offence; (e) unauthorised modification of computer material

[1] mark for each correct term (max 5).

(a) The knowledge base stores the facts and rules about the specific domain the expert system covers. (b) The inference engine applies logical rules to the knowledge base and any input provided by the user to reach a conclusion or recommendation. (c) A shell is a generic expert system with an empty knowledge base, which developers populate with domain-specific rules and facts to create a new application. (d) Heuristics are experience-based rules of thumb used to reach a workable conclusion where no exact algorithmic solution exists. (e) A knowledge engineer works with a human expert to acquire their knowledge and encode it into the expert system's knowledge base. Answer: (a) knowledge base; (b) inference engine; (c) shell; (d) heuristics; (e) knowledge engineer

[1] mark for each correct term (max 5).

(a) A cell is the geographical area covered by a single mobile phone mast/base station. (b) A handoff is the process of transferring an active call from one cell to another as the caller moves, without interrupting the call. (c) The base station controller manages radio communication between mobile phones and the network within a cell. (d) The mobile switching centre manages the switching of calls between mobile phones and other networks, and tracks a phone's location as it moves between cells. (e) The public switched telephone network (PSTN) is the conventional wired network used for traditional landline calls. (f) A mobile phone mast is the physical structure that transmits and receives the radio signals used for mobile communication. Answer: (a) cell; (b) handoff; (c) base station controller; (d) mobile switching centre; (e) public switched telephone network (PSTN); (f) mobile phone mast

[1] mark for each correct term (max 6).

(a) To retrieve specific fields matching a condition, use SELECT to name the required fields, FROM to name the table, and WHERE to filter rows: `SELECT FirstName, LastName FROM STUDENT WHERE YearGroup = 13;`. Checking by re-reading the statement: it names only FirstName and LastName after SELECT (not all fields), reads from the correct table STUDENT, and filters correctly on YearGroup = 13, which matches what was asked. (b) To add a new row, use INSERT INTO, naming the table and the fields in order, followed by VALUES with the corresponding data in the same order, with text values in quotes and the numeric YearGroup left unquoted: `INSERT INTO STUDENT (StudentID, FirstName, LastName, CourseCode, YearGroup) VALUES ('S045', 'Aoife', 'Byrne', 'CS2', 12);`. Checking by matching each value position to its field name confirms StudentID='S045', FirstName='Aoife', LastName='Byrne', CourseCode='CS2', YearGroup=12, exactly as specified. Answer: (a) SELECT FirstName, LastName FROM STUDENT WHERE YearGroup = 13; (b) INSERT INTO STUDENT (StudentID, FirstName, LastName, CourseCode, YearGroup) VALUES ('S045', 'Aoife', 'Byrne', 'CS2', 12);

(a) [1] mark for correct SELECT clause naming only FirstName and LastName; [1] mark for correct FROM STUDENT; [1] mark for correct WHERE YearGroup = 13 condition. (b) [1] mark for correct INSERT INTO STUDENT with field list; [1] mark for correct VALUES clause with values in matching order; [1] mark for correct use of quotes for text values and no quotes for the numeric value. Total [6]. Minor syntax variations (e.g. missing semicolon) should not be penalised if the statement is otherwise correct and unambiguous.

(a) To change the value of a field in an existing record, use UPDATE to name the table, SET to name the field and its new value, and WHERE to identify the specific record: `UPDATE BOOK SET OnLoan = 'Y' WHERE ISBN = '978-0-14-118776-1';`. Checking by re-reading the statement: it updates the correct table (BOOK), sets the correct field (OnLoan) to the correct value ('Y'), and restricts the change to the record matching the given ISBN, so it will not affect any other book. (b) To remove records matching a condition, use DELETE FROM to name the table and WHERE to specify which records to remove: `DELETE FROM BOOK WHERE Genre = 'Horror';`. Checking by re-reading the statement confirms it removes records only from the BOOK table and only those where Genre = 'Horror', leaving all other genres untouched. Answer: (a) UPDATE BOOK SET OnLoan = 'Y' WHERE ISBN = '978-0-14-118776-1'; (b) DELETE FROM BOOK WHERE Genre = 'Horror';

(a) [1] mark for correct UPDATE BOOK; [1] mark for correct SET OnLoan = 'Y'; [1] mark for correct WHERE clause identifying the specific ISBN. (b) [1] mark for correct DELETE FROM BOOK; [1] mark for correct WHERE Genre = 'Horror' condition; [1] mark for the statement correctly restricting deletion to matching records only (not all records). Total [6].

To create a new table, CREATE TABLE names the table and lists each field with its data type and length in brackets: `CREATE TABLE EMPLOYEE (EmployeeID CHAR(6) PRIMARY KEY, Surname VARCHAR(20), DepartmentCode CHAR(4), Salary DECIMAL(10,2));`. Checking each field against the requirement: EmployeeID uses CHAR(6) for a fixed-length 6-character text field and is marked PRIMARY KEY as required; Surname uses VARCHAR(20) for a variable-length text field up to 20 characters; DepartmentCode uses CHAR(4) for a fixed-length 4-character text field; Salary uses DECIMAL(10,2), a numeric type storing values with 2 decimal places, matching the specification. Answer: CREATE TABLE EMPLOYEE (EmployeeID CHAR(6) PRIMARY KEY, Surname VARCHAR(20), DepartmentCode CHAR(4), Salary DECIMAL(10,2));

[1] mark for correct CREATE TABLE EMPLOYEE syntax; [1] mark for EmployeeID correctly typed as fixed-length 6-character text; [1] mark for EmployeeID correctly marked as the primary key; [1] mark for Surname correctly typed as variable-length text up to 20 characters; [1] mark for DepartmentCode correctly typed as fixed-length 4-character text; [1] mark for Salary correctly typed as numeric with 2 decimal places. Total [6]. Equivalent, correct data type names (e.g. TEXT/VARCHAR variants) should be accepted.

1NF: the table as given has no repeating groups or multi-valued fields (each row represents exactly one booking, with all attributes holding a single atomic value), so it is already in first normal form, with BookingRef identified as the primary key since it uniquely identifies each row. 2NF: second normal form is concerned with partial dependencies, which can only occur where the primary key is composite (made up of more than one attribute). Since the primary key here, BookingRef, is a single attribute, no partial dependency is possible, so the table is automatically in 2NF once it is in 1NF. 3NF: third normal form requires removing transitive dependencies, where a non-key attribute depends on another non-key attribute rather than directly on the primary key. Here, CustomerName and CustomerPhone depend on CustomerID (not directly on BookingRef) — this is a transitive dependency (BookingRef → CustomerID → CustomerName/CustomerPhone) — and similarly InstructorName and InstructorPhone depend on InstructorID rather than directly on BookingRef. Checking the remaining attributes (VehicleReg, LessonDate, LessonTime, LessonCost) confirms they are specific to each individual booking and depend directly on BookingRef alone, so no further transitive dependency exists. To reach 3NF, the transitively dependent attributes are removed into their own tables, leaving a foreign key behind to preserve the relationship: BOOKING(BookingRef [PK], CustomerID [FK], InstructorID [FK], VehicleReg, LessonDate, LessonTime, LessonCost); CUSTOMER(CustomerID [PK], CustomerName, CustomerPhone); INSTRUCTOR(InstructorID [PK], InstructorName, InstructorPhone). Answer: BOOKING(BookingRef[PK], CustomerID[FK], InstructorID[FK], VehicleReg, LessonDate, LessonTime, LessonCost); CUSTOMER(CustomerID[PK], CustomerName, CustomerPhone); INSTRUCTOR(InstructorID[PK], InstructorName, InstructorPhone)

[1] mark for correctly identifying the table is already in 1NF with BookingRef as the primary key and no repeating groups. [1] mark for correctly explaining that, because the key is not composite, there are no partial dependencies, so the table is already in 2NF. [1] mark for correctly identifying the transitive dependency of CustomerName/CustomerPhone on CustomerID. [1] mark for correctly identifying the transitive dependency of InstructorName/InstructorPhone on InstructorID. [1] mark for correctly decomposing into three tables (BOOKING, CUSTOMER, INSTRUCTOR) with appropriate attributes in each. [1] mark for correctly identifying all primary keys and foreign keys in the final 3NF tables. Total [6].

(a) The scenario describes three distinct things about which data is held: OWNER, with a suitable primary key of OwnerID; PET, with a suitable primary key of PetID; and APPOINTMENT, with a suitable primary key of AppointmentID — each key uniquely identifies a single record of that entity. (b) The OWNER–PET relationship is one-to-many, since one owner may own many pets, but each pet has only one owner; because the 'many' side is PET, the foreign key (OwnerID) is placed in the PET table, linking each pet back to its owner. The PET–APPOINTMENT relationship is also one-to-many, since one pet may have many appointments over time, but each appointment is for only one pet; because the 'many' side is APPOINTMENT, the foreign key (PetID) is placed in the APPOINTMENT table. Checking against the requirement that no many-to-many relationship should remain: both relationships described are genuinely one-to-many as stated in the scenario, so no further resolving (e.g. via a linking table) is required. Answer: (a) OWNER(OwnerID), PET(PetID), APPOINTMENT(AppointmentID); (b) OWNER–PET is one-to-many with the foreign key OwnerID in PET; PET–APPOINTMENT is one-to-many with the foreign key PetID in APPOINTMENT

(a) [1] mark each for correctly identifying OWNER, PET and APPOINTMENT as the three entities with a suitable primary key for each (max 3; accept any sensibly named unique identifier). (b) [1] mark for correctly stating OWNER–PET is one-to-many with the foreign key in PET; [1] mark for correctly stating PET–APPOINTMENT is one-to-many with the foreign key in APPOINTMENT; [1] mark for correctly identifying which entity holds the foreign key in both cases (assessed across both relationships). Total [6].

A communication protocol is an agreed set of rules that governs how data is formatted, transmitted, received and acknowledged between devices on a network. Protocols are needed because a network typically connects hardware and software from many different manufacturers, and without a shared, agreed standard, one device's data format, transmission speed, or method of signalling the start and end of a message might not be understood by another. Protocols ensure that data is broken into an agreed structure (such as packets), that devices know how to establish and end a connection, that errors in transmission can be detected and handled consistently, and that data arrives in a form the receiving device can correctly interpret. Without protocols, devices could send data that is technically transmitted but effectively unreadable or unusable by the receiving device, making reliable network communication impossible. Answer: protocols are agreed rules for formatting, transmitting and receiving data, allowing different devices to communicate reliably; without them, devices could use incompatible formats/timing, causing communication to fail or data to be corrupted

Point-marked. [1] mark for defining a protocol as an agreed set of rules. [1] mark for identifying that protocols allow devices from different manufacturers to communicate. [1–2] marks for explaining what protocols standardise (e.g. data format, timing, error handling, establishing/ending a connection). [1–2] marks for explaining the consequence of not having protocols (communication failure, data corruption/misinterpretation). Total [6].

The OSI model organises network communication into seven layers, from the Physical layer (concerned with the physical transmission of raw bits over a medium) up through the Data Link, Network, Transport, Session and Presentation layers, to the Application layer (concerned with providing network services directly to user applications). Each layer performs a specific, well-defined function and only communicates directly with the layers immediately above and below it, via a standard interface. The purpose of dividing communication into layers in this way is to allow interoperability between hardware and software produced by different manufacturers, since any product that correctly implements a given layer's standard interface can work with products implementing the adjacent layers, regardless of who made them. Layering also simplifies the design and understanding of network communication, since each layer can be designed, tested and understood largely independently of the others; and it makes troubleshooting easier, since a fault can often be isolated to a specific layer. Finally, layering allows one layer to be updated or replaced (for example, adopting a new transmission medium at the Physical layer) without requiring changes to the layers above it, provided the standard interface between layers is maintained. Answer: seven layers (Physical, Data Link, Network, Transport, Session, Presentation, Application), each handling a distinct function; layering enables interoperability between manufacturers, simplifies design/troubleshooting, and allows one layer to change without affecting the others

Point-marked. [1–2] marks for naming/describing the seven layers of the OSI model (accept them in correct order for full credit; partial order gains partial credit). [1] mark for explaining that each layer performs a distinct function and interacts only with adjacent layers. [1–2] marks for explaining the purpose of layering (e.g. interoperability between manufacturers, simplified design/troubleshooting, ability to change one layer independently). [1] mark for overall accuracy and use of correct terminology. Total [6].

(a) Data transmitted over a network can be corrupted by interference or noise on the transmission medium (for example electrical interference on a cable, or signal degradation over a wireless link), which can change one or more bits in the data as it travels. Error detection and correction methods are needed so that this corruption can be identified (and, where possible, corrected or the data re-sent), preventing incorrect or corrupted data from being used or stored as if it were accurate. (b) A parity bit is an extra bit added to each byte of data before transmission, set so that the total number of 1-bits in the byte (including the parity bit) is either always even (even parity) or always odd (odd parity), depending on the scheme in use. When the byte is received, the receiving device recalculates the parity of the received bits; if the recalculated parity does not match the agreed scheme, an error is flagged, since this shows that one (or an odd number) of bits must have changed during transmission. (c) A checksum is calculated from a larger block of data before it is transmitted, typically by combining the values of the data (for example, by summing them using an agreed method), and this checksum value is transmitted along with the data. On receipt, the receiving device performs the same calculation on the received data to produce its own checksum, and compares this to the transmitted checksum value; if the two values do not match, this indicates that an error occurred somewhere in the block during transmission. Answer: (a) transmission errors are caused by interference/noise, so detection/correction methods are needed to catch corrupted data; (b) a parity bit makes the count of 1-bits even/odd as agreed, and a mismatch on receipt flags an error; (c) a checksum calculated from the data is sent alongside it and recalculated on receipt — a mismatch flags an error

(a) [1] mark for identifying that transmission can introduce errors (e.g. due to interference/noise); [1] mark for explaining the need to detect/correct these before use. (b) [1] mark for describing that a parity bit makes the number of 1-bits even or odd; [1] mark for describing that the receiver recalculates and compares parity to detect a mismatch. (c) [1] mark for describing that a checksum value is calculated from the data and sent with it; [1] mark for describing that the receiver recalculates and compares the checksum to detect an error. Total [6].

In a bus topology, all devices are connected to a single shared cable (the backbone), which keeps cabling requirements and cost relatively low, since only one central cable is needed rather than an individual cable to every device. However, this makes a bus topology poorly resilient to failure: if the main backbone cable is damaged or develops a fault at any point, communication for some or all devices on the network can be lost, and a single faulty device or connector can be harder to isolate on a shared cable. In a star topology, every device is connected by its own individual cable to a central switch or hub, which requires significantly more cabling and is therefore generally more expensive to install, especially as the network grows. In terms of resilience, however, a star topology is generally stronger: because each device has its own dedicated connection, a fault in one cable or device only affects that single device, and the rest of the network continues to operate normally. The main weakness of a star topology is that it introduces a single point of failure at the central switch or hub — if this fails, the entire network goes down, since every device's connection depends on it. Overall, a bus topology is cheaper to install but less resilient, while a star topology costs more but isolates individual faults more effectively, at the cost of depending entirely on the central hub. Answer: bus is cheaper but a single cable fault can disable the whole network; star costs more (more cabling) but isolates individual device/cable faults, though the central hub becomes a single point of failure

Point-marked. [1–2] marks for correctly comparing cost (bus cheaper due to less cabling; star more expensive due to individual cabling to each device). [1–2] marks for correctly explaining bus resilience (a backbone fault can disable some/all of the network). [1–2] marks for correctly explaining star resilience (individual faults isolated, but the central hub is a single point of failure). Total [6].

TCP/IP (Transmission Control Protocol/Internet Protocol) is a suite of communication protocols that work together to enable data to be transmitted reliably across interconnected networks, such as the internet. The Internet Protocol (IP) is responsible for addressing and routing: each device is assigned an IP address, and IP uses this address to determine the path data should take across potentially many interconnected networks to reach the correct destination device. The Transmission Control Protocol (TCP) is responsible for reliable delivery: it breaks data down into smaller packets before transmission, numbers them so they can be correctly sequenced, and, at the receiving end, checks that all packets have arrived; if a packet is missing or corrupted, TCP requests that it be re-sent, and once all packets have arrived, TCP reassembles them in the correct order into the original data. Together, IP's addressing/routing and TCP's reliable, ordered delivery allow data to be sent reliably between any two devices connected to the internet, even though the data may travel across many different networks and take different routes to get there, which is what makes global, dependable internet communication possible. Answer: IP handles addressing/routing of data across networks; TCP breaks data into packets, ensures reliable ordered delivery (detecting loss and requesting retransmission), and reassembles packets — together enabling reliable communication over the internet

Point-marked. [1–2] marks for describing the role of IP (addressing and routing of packets to the correct destination). [1–3] marks for describing the role of TCP (breaking data into packets, sequencing, detecting and requesting retransmission of lost packets, reassembly). [1] mark for correctly explaining how the two together enable reliable communication over the internet. Total [6].

Bandwidth refers to the maximum amount of data that can be transmitted over a network connection within a given period of time, usually measured in bits per second (or a multiple, such as megabits per second). A connection with a higher bandwidth can carry more data in the same amount of time. Broadband refers to a type of internet connection or transmission technology that provides a high bandwidth, always-on connection, typically capable of carrying multiple signals or channels of data simultaneously over the same medium, which allows for fast data transfer and supports activities such as streaming or large downloads that would not be practical over a low-bandwidth connection. In short, bandwidth is the measurable capacity of a connection, whereas broadband is a category of connection technology characterised by having a high bandwidth. Answer: bandwidth is the measurable maximum data transfer capacity of a connection (bits per second); broadband is a category of always-on, high-bandwidth connection technology capable of carrying multiple data channels

[1–2] marks for correctly defining bandwidth as the maximum data transfer rate/capacity of a connection, with correct units referenced (e.g. bits per second). [1–2] marks for correctly defining broadband as a high-bandwidth, always-on connection/technology. [1] mark for clearly distinguishing the two terms. Total [5].

Fibre optic cable can carry a very high volume of data at very high bandwidth over long distances with little loss of signal quality, and is relatively secure, since intercepting the signal generally requires direct physical access to the cable, which is difficult to achieve undetected. However, fibre optic installation is comparatively expensive and inflexible, since cabling must be physically run to every connected point, making it best suited to fixed, high-traffic links, such as a network's backbone connecting switches or buildings. Wireless transmission offers much greater flexibility and mobility, allowing devices to connect and move around without being physically cabled, and is typically cheaper and faster to deploy for end-user access, but it generally provides lower bandwidth and a lower volume of reliable data transfer than fibre optic, and is more vulnerable to interference from other signals or physical obstructions. Wireless is also inherently less secure, since its signal can potentially be intercepted by any device within range, rather than requiring physical access to a cable, which is why wireless networks typically rely on encryption to protect data in transit. An organisation therefore commonly uses fibre optic for fixed, high-capacity backbone connections where maximum bandwidth and security matter most, while using wireless to provide flexible, convenient access for end-user devices such as laptops and mobile phones, accepting the trade-off of somewhat lower bandwidth and the need for additional security measures such as encryption. Answer: fibre optic gives higher bandwidth/data volume and stronger security but is costly/inflexible, so it is used for fixed backbone links; wireless is flexible and cheaper to deploy but has lower bandwidth and weaker security (needing encryption), so it is used for flexible end-user access

Point-marked. [1–2] marks for comparing volume of data transfer/bandwidth (fibre optic higher, wireless lower/more variable). [1–2] marks for comparing security (fibre optic requires physical access to intercept, more secure; wireless can be intercepted remotely, less secure, needs encryption). [1–2] marks for a valid explanation of why an organisation would use both (e.g. fibre for backbone, wireless for flexible end-user access). Total [6].

A logical data model describes what data is needed and how it is structured and related — for example, the entities involved, their attributes, and the relationships between them — without reference to any particular database management system or how the data will actually be stored. A physical data model, by contrast, describes how that logical structure is actually implemented in a specific database system, including the precise data types used for each field, indexes created to speed up searching, and how the data is physically organised and stored on disk. In short, the logical model focuses on the meaning and structure of the data from the users'/business's point of view, while the physical model focuses on the technical implementation details. A data dictionary is a centralised description of every field (attribute) used across a database, typically recording, for each field, its name, data type, length, any validation rules that apply to it, and a description of its purpose. Its purpose is to ensure consistency in how data is defined and used throughout the database (for example, preventing the same field being defined with different data types in different tables), and to provide a clear, authoritative reference document for developers, database administrators and other users who need to understand exactly what each field represents and how it should be used. Answer: logical model = structure of data (entities/attributes/relationships) independent of implementation; physical model = how that structure is actually implemented in a specific database system (data types, indexes, storage); data dictionary = centralised record of every field's definition, ensuring consistency and providing a reference

Point-marked. [1–2] marks for correctly describing a logical data model (structure of data independent of implementation). [1–2] marks for correctly describing a physical data model (how data is implemented in a specific system). [1–2] marks for correctly explaining the purpose of a data dictionary (centralised field definitions, ensuring consistency, providing a reference). Total [6].

The Data Protection Act sets out a set of principles governing how organisations must handle personal data, including that data must be processed lawfully and fairly, kept accurate and up to date, kept for no longer than necessary, kept secure against unauthorised access or loss, and used only for the specific purpose for which it was collected. It also gives individuals a number of rights over their own data, such as the right to find out what data an organisation holds about them and the right to have inaccurate data corrected. This impacts organisations in several ways: they must actively comply with these principles in how they collect, store, use and eventually delete personal data; they must only collect data that is genuinely necessary for their purpose, rather than gathering data speculatively; they must put in place appropriate security measures to protect the data they hold; and they can face legal and financial penalties, as well as reputational damage, if they breach the Act, for example through a data breach or by misusing personal data. This affects both employees (whose own personal records, such as HR data, are protected) and members of the public, such as customers, whose data the organisation collects and must handle responsibly. Answer: sets principles for lawful, accurate, secure, purpose-limited processing of personal data and gives individuals rights (e.g. access, correction); organisations must comply with these principles, secure data appropriately, and face penalties for breaches, affecting both employees and the public

Point-marked. [1–2] marks for describing key principles of the Act (e.g. lawful/fair processing, accuracy, data minimisation, retention limits, security). [1] mark for describing at least one individual right (e.g. right to access/correct data). [1–2] marks for explaining the impact on organisations, employees and/or the public (e.g. compliance requirements, security measures, penalties for breach). Total [5].

The Computer Misuse Act creates three main criminal offences: unauthorised access to computer material (accessing a computer system or data without permission); unauthorised access with intent to commit or facilitate a further offence (accessing a system without permission in order to then carry out a further crime, such as fraud); and unauthorised modification of computer material, which covers actions that impair the operation of a computer or program or alter/delete data without authorisation, for example by deploying malware or a virus. This impacts individuals within an organisation in several ways: an employee who accesses systems, files or data they are not authorised to use — even without malicious intent, such as looking at a colleague's records out of curiosity — can be committing a criminal offence and can face prosecution as well as disciplinary action or dismissal by their employer. The Act acts as a deterrent against both external hacking and insider misuse of systems, since employees are made aware that unauthorised access carries real legal consequences. It also means organisations must implement clear access controls and permissions (so that individuals can only access what they are actually authorised to use), both to reduce the risk of a breach and to support enforcement action if an offence does occur. Answer: creates the offences of unauthorised access, unauthorised access with intent to commit a further offence, and unauthorised modification of computer material; individuals face prosecution/dismissal for unauthorised access to systems/data, deterring hacking and insider misuse, while organisations must implement access controls

Point-marked. [1–2] marks for correctly describing at least two of the three main offences under the Act. [1–2] marks for explaining the impact on individuals (e.g. prosecution, disciplinary action/dismissal for unauthorised access). [1] mark for explaining the impact on the organisation (e.g. need for access controls, deterrent effect). Total [5].

An expert system typically consists of a knowledge base, which stores the facts and rules relevant to the specific domain (such as symptoms and diagnostic rules in medicine); an inference engine, which applies these rules to the facts entered by the user to work through the logic and reach a conclusion or recommendation; and a user interface, through which the user enters information (such as a patient's symptoms) and receives the system's output, often along with an explanation of how the conclusion was reached. In medical diagnosis, expert systems offer several benefits: they can apply a consistent, systematic process to every case, are available at any time without the limitations of human availability or fatigue, and can hold and apply a vast amount of specialist medical knowledge that would be difficult for any single doctor to retain, which can be especially valuable in areas facing a shortage of specialists. They can also act as a supportive second opinion, helping to reduce human error by prompting a doctor to consider possibilities they might otherwise overlook. However, there are also significant drawbacks: an expert system's knowledge and reasoning are limited strictly to what has been explicitly programmed into its knowledge base, so it lacks the intuition, common sense and ability to handle genuinely unusual or novel cases that an experienced human doctor might manage; it cannot take legal or ethical responsibility for a diagnosis, which remains with the human clinician; there is a risk that doctors or patients place too much trust in its output without adequate human review; building and maintaining an accurate, up-to-date knowledge base requires significant, ongoing investment; and if the knowledge base is incomplete, outdated or contains an error, the system may produce an incorrect recommendation with potentially serious consequences. Answer: structure = knowledge base, inference engine, user interface; medical use offers consistency, 24/7 availability and vast specialist knowledge, but is limited by lack of intuition for unusual cases, no legal/ethical responsibility, risk of over-reliance, high maintenance cost, and errors from an incomplete/outdated knowledge base

Point-marked. [1–2] marks for correctly describing the structure (knowledge base, inference engine, user interface). [1–2] marks for at least two valid benefits of use in medical diagnosis. [1–2] marks for at least two valid drawbacks/limitations of use in medical diagnosis. Total [6].

The use of artificial intelligence in automated decision making raises several ethical considerations. Transparency and accountability: many AI systems, particularly those based on complex models, can act as a 'black box', making decisions in a way that is difficult for even their developers to fully explain, which raises concerns about fairness and about who is accountable when an automated decision causes harm — the organisation using the system, the developers who built it, or some shared responsibility. Bias and discrimination: AI systems learn patterns from the data they are trained on, and if that training data reflects existing human biases (for example, historical patterns of unequal treatment), the AI can inherit or even amplify these biases, leading to discriminatory outcomes for particular groups of people in decisions such as loan approvals or recruitment shortlisting. Human oversight: because automated decisions can significantly affect people's lives, there is debate about whether individuals should have a right to a meaningful human review of, or explanation for, decisions that are made about them by an AI system, rather than the decision being entirely automated. Employment impact: the increasing use of AI for tasks previously carried out by people also raises ethical concerns about job displacement and the wider social impact of automation. Answer: key concerns include lack of transparency/explainability, bias inherited from training data leading to discrimination, unclear accountability when harm occurs, job displacement, and the need for meaningful human oversight of significant automated decisions

Point-marked. [1] mark each for any valid ethical consideration explained with some development (max 5), e.g. lack of transparency/'black box' decisions, bias/discrimination from training data, unclear accountability, job displacement, need for human oversight/right to review.

Digital technology supports data mining at every stage: it is used to gather large volumes of data automatically from sources such as sales transactions, loyalty card usage or online browsing activity; to store this data, often in very large databases or data warehouses capable of holding huge volumes of records; to process the data, for example cleaning and organising it into a consistent, usable format; and to analyse it, using statistical and pattern-recognition software to identify trends, correlations and patterns across the data that would not be apparent simply from looking at individual records. This poses several threats to individual privacy: data about individuals can be collected and analysed without their full knowledge or explicit, informed consent; patterns and correlations found across seemingly anonymous or unrelated pieces of data can sometimes be combined to identify a specific individual, even where no single piece of data alone would do so (re-identification); the analysis can draw sensitive inferences about a person — for example about their health, finances or personal habits — from data they did not consider sensitive when it was originally collected; and once personal data has been gathered and stored for mining purposes, it becomes a valuable target that is vulnerable to misuse, unauthorised access or a data breach. Answer: digital technology gathers, stores, processes and analyses large volumes of data to find patterns; this threatens privacy through data collected/analysed without full consent, re-identification from combined data, sensitive inferences drawn from non-sensitive data, and vulnerability to breach/misuse

Point-marked. [1–2] marks for describing how digital technology is used across gathering, storing, processing and analysing data in data mining. [1–3] marks for explaining valid privacy threats (e.g. lack of consent, re-identification, sensitive inference, risk of breach/misuse). Total [5].

A natural language and voice recognition system requires a microphone or similar audio input device to capture the user's spoken words as an analogue sound signal. An analogue-to-digital converter then converts this analogue signal into a digital signal that the computer can process. Speech recognition software analyses the resulting digital audio, breaking the sound down into phonemes (the basic units of sound in speech) and comparing the patterns found against a large, stored database of vocabulary and language models, in order to convert the spoken audio into text. Natural language processing software then goes further than simple transcription: it analyses the grammar, syntax and context of the resulting text in order to interpret its intended meaning, allowing the system to correctly interpret commands or questions (rather than just producing a literal transcript) and to generate an appropriate response. Answer: a microphone captures speech as an analogue signal, an analogue-to-digital converter digitises it, speech recognition software converts the digital audio into text by matching phoneme patterns to a stored language model, and natural language processing software interprets the grammar/context of that text to determine its meaning

Point-marked. [1] mark for identifying a microphone/audio input device capturing an analogue signal. [1] mark for identifying an analogue-to-digital converter. [1–2] marks for describing speech recognition software converting digital audio into text (e.g. phoneme matching against a language model). [1] mark for describing natural language processing software interpreting grammar/context/meaning of the text. Total [5].

In a ring topology, devices are connected in a closed loop, with data typically passing from device to device around the ring (for example using token passing) until it reaches its destination. This makes a standard ring topology poorly resilient: because data must travel around the full loop, the failure of a single cable or device can break the loop and disrupt communication for some or all devices on the network, unless the network has been designed with a second, redundant ring to provide an alternative path. Adding a new device to a ring is also relatively disruptive, since the ring must physically be broken at one point to insert the new device's connections, which can interrupt network communication while this is carried out. In a star topology, every device is connected individually to a central switch, and data for any device passes through this central point. This generally makes a star topology more resilient to the failure of an individual device or cable, since such a failure only affects the one device connected by that cable, leaving the rest of the network unaffected; however, the central switch itself becomes a single point of failure, since its failure disconnects every device at once. Adding a new device to a star network is straightforward and non-disruptive: a new cable is simply connected from the device to a free port on the central switch, without needing to interrupt any of the existing connections. On balance, a star topology is generally preferable in terms of both resilience to individual device/cable failure and ease of adding new devices, since faults and expansion can both be handled without affecting the rest of the network, though this comes at the cost of complete dependence on the central switch remaining operational; a ring topology, by contrast, is both more vulnerable to a single point of failure disrupting the whole loop and more disruptive to expand, unless additional redundancy is built in. Answer: star topology is generally more resilient to individual device/cable failure and easier to expand, but depends entirely on the central switch; ring topology is more vulnerable to a single fault disrupting the whole loop (unless a redundant ring is used) and more disruptive to expand, since the ring must be broken to add a device

Levels of response (scaled for 7 marks). Band 0 (1–2 marks): lacks detail, limited terminology, largely one-sided. Band 1 (3–5 marks): competent descriptions of both topologies, but with a one-sided or underdeveloped evaluation, adequate terminology. Band 2 (6–7 marks): detailed, accurate descriptions of both topologies, a balanced evaluation covering resilience and ease of expansion for both, and a high standard of terminology, spelling, punctuation and grammar. Total [7].

Cloud computing offers several business benefits: it generally has a lower upfront capital cost, since organisations pay for storage and computing resources on a subscription or usage basis rather than purchasing and maintaining their own servers; it is highly scalable, allowing resources to be increased or decreased quickly to match demand; it provides accessibility from any location with an internet connection, supporting flexible and remote working; and it typically reduces the burden on an organisation's own IT staff, since the cloud provider manages the underlying hardware, software updates and often backup and disaster recovery as part of the service. In terms of security, however, cloud computing raises concerns because an organisation's data is stored on servers owned and managed by a third party, potentially in a different country, which raises questions about who can access the data and which country's data protection laws apply; the organisation is also reliant on the cloud provider's own security measures and reputation, and access to the data depends on having a reliable internet connection. Traditional on-premise storage gives an organisation full physical control over its own hardware and over exactly where its data is stored, and does not depend on an internet connection to access data stored locally; it also allows security measures to be tailored precisely to the organisation's own specific requirements, since the organisation controls every aspect of the system. However, on-premise storage requires a high upfront capital investment in hardware, ongoing maintenance costs, and dedicated in-house IT expertise to manage and secure the systems; it is also less scalable, since increasing capacity typically requires purchasing and installing additional hardware, and the organisation bears full responsibility for its own backup and disaster recovery arrangements, with no external provider to fall back on. On balance, cloud computing typically offers greater cost-flexibility, scalability and reduced maintenance burden, making it attractive for many organisations, particularly smaller ones, while traditional on-premise storage may still be preferred by organisations that require maximum direct control over highly sensitive data and do not wish to depend on a third-party provider's security and availability. Answer: cloud computing offers lower upfront cost, scalability, remote accessibility and reduced in-house maintenance, but raises third-party/jurisdictional security concerns and depends on internet access; on-premise storage offers full control over hardware, data location and security with no internet dependency, but has high upfront/maintenance costs, needs in-house expertise, and places full backup/disaster-recovery responsibility on the organisation

Levels of response (scaled for 7 marks). Band 0 (1–2 marks): lacks detail, limited terminology, largely one-sided. Band 1 (3–5 marks): competent descriptions of both approaches, but with a one-sided or underdeveloped evaluation, adequate terminology. Band 2 (6–7 marks): detailed, accurate descriptions of both approaches, a balanced evaluation covering business benefits and security for both, and a high standard of terminology, spelling, punctuation and grammar. Total [7].

An expert system operates strictly within the boundaries of its knowledge base and the rules defined by a knowledge engineer working with a human expert. Within its specific, well-defined domain, this makes an expert system very reliable, consistent and explainable, since its inference engine can show exactly which rules led to a given conclusion. However, this same fixed structure is also its key limitation when facing unfamiliar situations: if a case falls outside the rules and facts already encoded in its knowledge base, the expert system has no way to reason beyond what it has been explicitly given, and may either fail to produce a useful recommendation or produce an incorrect one, since it cannot adapt or learn from the new situation on its own. Broader artificial intelligence, particularly approaches based on neural network modelling, works differently: rather than relying only on a fixed set of explicitly programmed rules, a neural network learns to recognise patterns from large volumes of training data, adjusting its internal structure as it learns. This gives it greater potential to generalise and respond flexibly to new or previously unseen inputs that were not explicitly anticipated by its designers, more closely resembling the kind of adaptable, human-like behaviour that a test such as the Turing test is concerned with identifying. However, neural-network-based AI is not without its own limitations when handling unfamiliar situations: its performance can still be poor or unpredictable when faced with inputs very different from anything in its training data, and, unlike an expert system, it is often much less transparent, making it harder to explain why a particular output was produced. On balance, an expert system is more reliable and explainable within its narrow, well-defined domain but is essentially unable to handle situations outside its programmed rules, whereas neural-network-based AI has a greater underlying capacity to generalise to unfamiliar situations because it is not limited to a fixed rule set, though this flexibility often comes at the cost of transparency and can still fail unpredictably when faced with genuinely novel data. Answer: expert systems are reliable and explainable but limited strictly to their pre-programmed rules, failing on genuinely unfamiliar cases; neural-network-based AI can generalise more flexibly to new inputs by learning patterns rather than following only fixed rules, but is less transparent and can still perform unpredictably on very unfamiliar data

Levels of response (scaled for 7 marks). Band 0 (1–2 marks): lacks detail, limited terminology, largely one-sided. Band 1 (3–5 marks): competent descriptions of both approaches, but with a one-sided or underdeveloped evaluation, adequate terminology. Band 2 (6–7 marks): detailed, accurate descriptions of both approaches, a balanced evaluation of their ability to handle unfamiliar situations, and a high standard of terminology, spelling, punctuation and grammar. Total [7].