Read this first
| Time | Total marks | You will need |
|---|---|---|
| 2 hours 15 minutes | 90 | Black pen. No calculator, notes or electronic devices. |
Instructions
- Press Start timer above and work in silence, without notes.
- Answer all questions in Section A and Section B.
- Type your answers in the boxes (they're saved on this device), or write on lined paper and number each answer clearly, e.g. 5 (c).
- Mark schemes stay locked until you press I've finished: show mark schemes.
Information
- The total mark for this paper is 90.
- The marks for each question are shown in brackets. Use this as a guide to how much time to spend on each question.
- Questions marked with an asterisk (*) are levels-based: you will be marked on the quality of your extended response.
- Where the term 'code' is used, it refers to Python 3.10 or later.
Advice
- Read each question carefully before you start to answer it.
- Use the scenario in Section B in your answers.
- Try to answer every question.
- Check your answers if you have time at the end.
■ MOCK EXAMINATION
This is a practice paper written to match the style and structure of the live assessment. It is not a Pearson paper. When you mark it: for point-marked questions, award one mark for each point in the list, up to the total, and accept other valid answers. For levels-based (*) questions, read the whole answer, choose the level that best fits, then the mark within it. Indicative content is a guide, not a checklist. Spec references show where to revise if you lost marks.
SECTION A (30 marks)
Answer ALL questions.
Define the term 'B2B'.
Spec 5.1.2
- Business to Business: a business that sells products or services to other businesses (1).
State two external stakeholders of an NHS hospital.
Spec 5.1.3
- Any two: patients; suppliers; government / Department of Health; regulators (e.g. CQC); local community; outsourced services.
Explain one impact of reputational damage on an online retailer after a data breach.
Spec 5.3.2
- Customers lose trust (1) so they shop with competitors, reducing sales (1).
(Total for Question 1 = 5 marks)
Explain the difference between structured and unstructured data.
Spec 6.3.2–3
- Structured data is organised in a fixed format such as rows and columns / quantitative (1); unstructured has no predefined format, e.g. images, emails / qualitative (1).
State the data format described: (i) a lightweight format of key–value pairs used by most web APIs; (ii) a format that uses custom tags to describe data.
Spec 6.5.1
- (i) JSON (1) (ii) XML (1)
Describe a transposition error and one way of preventing it.
Spec 6.8.4–5
- Two characters are swapped, e.g. 1234 entered as 1243 (1). Prevention: double entry verification / check digit / validation / drop-down or pre-filled values (1).
State three of the six Vs of Big Data.
Spec 6.7.1
- Any three: volume; variety; variability; velocity; veracity; value.
(Total for Question 2 = 9 marks)
State two features of a real-time operating system.
Spec 7.2.1
- Any two: responds to inputs within a guaranteed time; used for monitoring and control; transaction processing; high reliability.
Identify the OSI layer responsible for each: (i) routing packets between networks; (ii) encryption and compression; (iii) MAC addressing and framing.
Spec 7.3.7
- (i) Network (ii) Presentation (iii) Data link
Explain the difference between bandwidth and latency.
Spec 7.3.11
- Bandwidth is the maximum amount of data transferred per second (1); latency is the delay for data to travel from source to destination (1).
In Software as a Service, state two things the client is responsible for.
Spec 7.5.3
- User accounts (1) and data (1).
(Total for Question 3 = 9 marks)
Describe what is meant by spear phishing.
Spec 8.2.1
- A phishing attack targeted at a specific person or organisation (1) using personal details to make it look genuine (1).
Explain the difference between authentication and authorisation.
Spec 8.4.2
- Authentication verifies a user is who they claim to be, e.g. password, MFA (1); authorisation decides what an authenticated user is allowed to access or do (1).
Name the type of backup that copies all changes made since the last full backup.
Spec 8.3.1
- Differential (1).
Give two reasons why an organisation must keep staff salary information confidential.
Spec 8.1.2
- Any two: stop competitors offering higher wages to poach staff; stop staff comparing pay and demanding the same; protect privacy / legal requirement.
(Total for Question 4 = 7 marks)
TOTAL FOR SECTION A = 30 MARKS
SECTION B (60 marks)
Answer ALL questions.
■ SCENARIO: NORTHWAY LOGISTICS
- Northway Logistics delivers parcels for online retailers across the North of England. It has 400 staff and three depots: Wakefield, Hull and Preston.
- Drivers use handheld scanners that record GPS location, delivery time and a photo as proof of delivery.
- Northway is launching a customer tracking app and a new depot management system. It is considering moving all its systems from servers at the Wakefield head office to a public cloud provider.
- Last year a competitor was hit by ransomware and could not deliver for four days.
Explain two factors that may have triggered Northway's decision to launch the tracking app.
Spec 5.4.1–2
- Factor (1) + explanation (1), twice. E.g. consumer trends / social: customers expect live tracking (1) so Northway must offer it to keep retail contracts (1); new competitors already offer tracking (1); technological: new GPS scanners make it possible (1); strategic objective of additional services (1).
Explain the role of the change advisory board in this project.
Spec 5.4.4
- Any three: review change requests; prioritise them; approve through stages; monitor implementation (collate data, check, accelerate); provide feedback.
Discuss the suitability of pilot and direct implementation for the new depot management system.
Spec 5.4.4
Indicative content: pilot at one depot (e.g. Hull) finds problems on a small scale, staff there can train others, other depots keep working normally; slower full rollout; pilot depot bears the risk. Direct: quick and cheap, but if the system fails all three depots stop and parcels are not delivered, with serious impact on retailer contracts; no fallback. Pilot is likely more suitable given three similar depots and the cost of failure.
(Total for Question 5 = 13 marks)
For each item recorded by the scanners, state whether it is structured or unstructured data: (i) GPS location; (ii) delivery time; (iii) proof-of-delivery photo.
Spec 6.3
- (i) Structured (ii) Structured (iii) Unstructured
Explain how data wrangling would be used before Northway analyses delivery times from the three depots.
Spec 6.8.1–2
- Any four steps applied: structure the data from three depots into the same fields (1); clean: remove duplicates, fix time formats (1); validate: check times are within working hours, no missing values (1); enrich: add depot/region or route data (1); output to a single data set for analysis (1).
Recommend a data visualisation format for the operations director to monitor deliveries during the day, and justify your choice.
Spec 6.9
- Dashboard (1); shows real-time KPIs such as deliveries completed and late (1) on one screen so the director can react quickly during the day (1). Accept other formats if well justified.
(Total for Question 6 = 10 marks)
Explain two benefits of using Infrastructure as a Service to host the tracking app.
Spec 7.5.2–3
- Benefit (1) + explanation (1), twice. E.g. elasticity (1): resources scale up at peak times such as Christmas (1); no hardware to buy or maintain (1) reducing upfront cost (1); control over the OS and software (1) to configure the app as needed (1); provider's data centres improve availability (1)(1).
Explain why Northway would use a VPN to connect the Hull and Preston depots to its systems.
Spec 7.3.2
- Creates an encrypted tunnel over the internet (1) so depot data cannot be read if intercepted (1), without the cost of private leased lines (1).
Explain two methods Northway could use to improve the resilience of its tracking system.
Spec 7.6.2
- Method (1) + explanation (1), twice. E.g. redundancy: duplicate servers with failover (1) so tracking stays available if one fails (1); regular offsite/cloud backups (1) so data can be restored (1); planned patching (1); device hardening (1); hot or warm site (1).
(Total for Question 7 = 11 marks)
Retailers access tracking data through an API. Explain two ways the API could be secured.
Spec 8.2.1, 8.3.1
- Method (1) + explanation (1), twice. E.g. authentication with API keys/tokens (1) so only approved retailers can access data (1); HTTPS encryption (1) to prevent interception (1); input validation (1) to prevent injection attacks (1); rate limiting (1) against DoS (1); certification / security testing of the API (1)(1).
Explain how the IAAA model applies when depot staff log in to the depot management system.
Spec 8.4.2
- Identification: staff member enters username / scans ID badge (1).
- Authentication: password plus MFA or badge PIN verifies identity (1).
- Authorisation: role-based access, e.g. depot staff see only their depot, managers see more (1).
- Accountability: actions recorded in audit logs (1).
Discuss the measures Northway should take to prevent and recover from a ransomware attack.
Spec 8.2.1, 8.3.1, 7.6.2
Indicative content: prevention: staff training on phishing, email filtering, anti-malware, patching, MFA, least privilege, network segregation between depots, disable USB. Recovery: offline/immutable backups tested regularly; incident response and disaster recovery plan; alternative site; communication with retailers. Lesson from the competitor: four days without deliveries shows the cost of downtime; balance against budget.
(Total for Question 8 = 14 marks)
Evaluate Northway's plan to move its systems from on-premises servers to a public cloud provider.
Spec 7.5, 7.6, 5.3, 8.3
Indicative content:
- Benefits: elasticity for peak periods; no ageing servers to replace; provider's redundancy and backups improve resilience; access from all depots and the app anywhere; potentially lower upfront cost; provider handles hardware.
- Drawbacks: reliance on internet connections at depots; ongoing subscription costs; data held by third party, possibly abroad, raising data protection issues; less control; vendor lock-in; migration risk and staff training.
- Delivery model choice: IaaS gives control but needs skilled staff; PaaS/SaaS reduce management.
- Security: shared responsibility; Northway still manages accounts and data; cloud does not remove ransomware risk on its own.
- Judgement: e.g. move to cloud in phases, starting with the tracking app, with UK data centres and a backup internet connection at each depot.
(Total for Question 9 = 12 marks)
TOTAL FOR SECTION B = 60 MARKS
TOTAL FOR PAPER = 90 MARKS
END OF PAPER