AECSC Semester 2 Exam Cheatsheet

01/09/2026

Computer Science Semester 2 COMPLETE STUDY GUIDE (Units 1&2 – A-Grade Sheet)

Read this once. It is everything that appears in every WACE/WATP/WAEP paper (2023 & 2025 Sem 2). Red = traps.

Exam Structure (same every year)

Section 1: Short answer, ~22 Q, ~82 marks, 40%, ~70 min – answer all questions in the booklet.
Section 2: Extended answer, 4 Q, ~118 marks, 60%, ~110 min – based on a source booklet (scenario: 2025 = Creature Keeper pet game; 2023 = ScootAround scooter rentals).
Total 100%. The extended questions are code-based (write your own functions/loops + SQL + ERD) and theory (networking + security + databases).

1. The TCP/IP Model (guaranteed every paper)

Purpose (1 mark): “The TCP/IP layered model provides a standardised framework that allows different devices and systems to communicate over a network.”

Four layers, top to bottom (4 marks – say in order): Application → Transport → Internet → Network (Link).

Match protocols to layers (3 marks):

Protocol	Layer
TCP	Transport
IP	Internet
HTTPS	Application

Application layer – provides network services directly to user apps (web browser). Enables email access via HTTP/HTTPS; works the same over mobile data or Wi-Fi. Protocols: HTTP/HTTPS, SMTP, FTP, DNS, Telnet/SSH.
Transport layer – reliable data transfer between devices. Breaks data into segments, delivers in correct order, retransmits lost data, flow control. Protocols: TCP (reliable, ordered, error-checked), UDP (fast, unreliable).
Internet layer – logical addressing (IP) and routing across networks. Protocols: IP (IPv4/IPv6), ICMP, ARP.
Network layer – physical transmission of data over media; MAC addresses. Protocols: Ethernet (802.3), Wi-Fi (802.11), PPP.

DNS (Application): “translates domain names into IP addresses.”

2. Networking Hardware (router / switch / modem)

Router: “Directs data between different networks, such as between the office LAN and the internet. Manages IP addresses and determines the best path for data packets.”
Switch: “Connects multiple wired devices within the same local network and forwards data only to the specific device it is intended for, improving efficiency and reducing unnecessary traffic.”
Modem: “Converts digital data into a signal suitable for transmission over the telephone/ISP network and back” (modulation + demodulation).

Router vs switch differences (3 marks): routers link networks, switches link devices; routers use Layer 3 (IP), switches use Layer 2 (MAC); routers handle traffic between networks, switches within a network; routers determine optimal paths; routers connect to the internet/WAN.

Subnet mask purpose: “Divides an IP address into network and host portions. Determines which devices are part of the same local network and which are external, helping route data and limit broadcast traffic.”

IPv4 vs IPv6 (2023): physical difference = IPv4 is 32-bit (4 groups of numbers), IPv6 is 128-bit (hexadecimal, 8 groups). Functional: IPv6 has a vastly larger address space; IPv6 has built-in security/encryption; IPv6 supports auto-configuration.

3. Network Traffic: Broadcast, Collisions, Performance

Broadcast traffic (define): “Network communication sent from one device and delivered to all devices on the same network segment – a single message transmitted to every device rather than a specific destination.”

Impact of excess broadcast traffic: “Uses up available bandwidth and slows down normal communication. Forces every device to process unnecessary packets, reducing overall efficiency.”

Data collisions: “Occur when two or more devices try to send data at the same time, causing packets to interfere. Packets not reaching their destination results in retransmissions, which increases traffic and reduces performance (delays/slowing).”

Factors affecting network performance (2023 WAP scenario): outdated technology (older 802.11 standards = slower data rates), device congestion (too many devices for the WAP), interference (older/single-band WAP more susceptible).

4. Wireless Networking (WAP)

WAP (Wireless Access Point): connects wireless devices to a wired LAN; broadcasts a Wi-Fi signal.
SSID: network name broadcast so devices can identify and connect.
Range: limited by frequency, walls/obstacles, and power; 5GHz is faster but shorter range than 2.4GHz.
Security: use WPA2/WPA3 encryption (not open/WEP); hide SSID or use MAC filtering only as an extra layer (never the only control).
Performance is degraded by an old single-band WAP and by too many simultaneous clients.

5. Ciphers & Encryption (cryptography)

Polyalphabetic cipher

Definition: “A method of encryption that uses multiple substitution alphabets to encode a message. The choice of substitution depends on a repeating keyword, making letter patterns less predictable.”

Why it beats a rotation/Caesar cipher: “Uses multiple substitution alphabets rather than shifting every letter by a fixed amount. This makes frequency analysis less effective, as the same letter can be encrypted differently depending on its position.” (Caesar = single fixed shift; the polyalphabetic “same letter → different ciphertext” is the key mark phrase.)

Vigenère cipher: “A polyalphabetic substitution cipher that uses a series of different Caesar ciphers based on the letters of a keyword. The keyword is repeated to match the message length; each letter is shifted forward based on the position of the corresponding keyword letter (A=0, B=1, etc.).” The same letter in the message can map to different ciphertext letters.

Cracking substitution ciphers (outline two)

Frequency analysis: “Study how often letters appear in the ciphertext and match them to common letters in English such as E, T, or A.”
Brute force: “Try every possible key/combination of substitutions until the correct message is revealed, often with automation software.”

Public key (asymmetric) vs private (symmetric) encryption

Public key process: “Customer uses the company’s public key to encrypt the data. Only the company’s private key can decrypt it.”
Compare: public = two different keys (one public to encrypt, one private to decrypt) so no need to share a secret key; symmetric = same key for both encrypt and decrypt, which must be securely shared beforehand.

Purpose of encryption (2023): “Protect sensitive information by transforming it into an unreadable format using a cipher and a key, ensuring confidentiality and preventing unauthorised access.”

6. Security Threats & Attacks

Man-in-the-middle (Wi-Fi scenario): “A malicious actor secretly intercepts and possibly alters communication between two parties. On unsecured public Wi-Fi the attacker can capture login credentials/personal data as the user checks email or shops; the user thinks they are talking directly to the website.”

XSS (cross-site scripting): “A cyber-attack where an attacker injects malicious scripts into a trusted website. When other users visit, the script runs in their browsers, stealing login details or session tokens – because the browser assumes the script is part of the trusted site.”

Phishing (fake login page): “A fraudulent email appears to be from a trustworthy source, containing a link to a fake login page that mimics the real one and asks the user to enter their credentials.” Identify = phishing. Reduce: educate users to spot fake senders/URLs; enable 2FA.

IP spoofing (2023): “Falsifying the source IP address of a packet to impersonate a trusted device and bypass access controls.”

DoS (Denial of Service): “Overwhelming a system/server with excessive traffic so legitimate users cannot access it.”

Malware types (outline each – 1 mark each):

Worm: “Self-replicating program that spreads through a network without needing to attach to a file.”
Trojan horse: “Disguises itself as legitimate software to trick users into installing it, often creating a backdoor for attackers.”
Ransomware: “Encrypts a user’s data and demands payment in exchange for the decryption key.”
Virus: “Self-replicating program that attaches itself to clean files and spreads.”

Zero-day vulnerability (2023): “A software vulnerability unknown to the vendor that has no patch yet – exploited before the vendor is aware / can fix it.” Stuxnet example.

7. Firewalls, OS Security, Penetration Testing, CIA Triad

Firewall (two ways to protect – describe each for full marks)

“Prevent external devices from accessing internal resources by blocking traffic from unknown/untrusted IP addresses.”
“Restrict access to specific ports/services, only allowing necessary ones (e.g. HTTP/HTTPS), blocking unused or vulnerable ports.” Also: filter by application/protocol, monitor and log traffic, prevent data exfiltration.

OS security (explain how)

Any of: built-in firewall (blocks unauthorised traffic); user account control/permissions (limit what users/apps can do); built-in antivirus/threat protection (detect, quarantine, remove malware); automatic security updates (patch known vulnerabilities).

Penetration testing

“A simulated attack on a system to identify vulnerabilities before real threats exploit them. It benefits the organisation by highlighting weaknesses for mitigation, reducing data-breach risk, and thereby protecting users’ data.”

CIA Triad (name all three + apply to scenario for 3 marks)

Confidentiality: sensitive data (emails, passwords) protected from unauthorised access.
Integrity: data (stats, purchase history) not tampered with or altered maliciously.
Availability: legitimate users can access the game/data when needed (threatened by repeated login attacks / DoS).

8. Authentication, Passwords, Physical Security

Password policy

“Rules that make passwords harder to guess or crack – minimum length, complexity (mixed case, numbers, symbols), and regular changes – protecting accounts from brute force and password reuse.”

Weak password trap (2023 “12june84”): lacks complexity (lowercase + numbers only, no special chars / mixed case); contains personal information (birthdate) that attackers can guess/obtain.

Authentication strategies (two, 2 marks each to describe)

2FA/MFA: “Requires two or more verification methods (password + SMS code), reducing the risk of unauthorised access even if a password is compromised.”
Biometrics: “Fingerprint or face recognition ensures only the authorised user can access the account.”

Physical security threat (explain)

“Any risk to digital systems caused by physical actions/events that damage or compromise hardware (theft, fire, water), resulting in data loss, unauthorised access, or downtime.”

Examples (outline two): theft of laptop/USB with project files; fire/water damaging servers; unauthorised person plugging a device into the network; logged-in workstation left unattended.

9. Privacy, Data Quality, Ethics

Privacy Act 1988 (outline two ways it protects personal data)

“Requires organisations to obtain consent before collecting personal data.”
“Gives individuals the right to access and correct their personal information.”
“Limits use/disclosure of personal data to the purpose it was collected for.”
“Requires organisations to take reasonable steps to secure personal data from misuse or loss.”

Australian Privacy Principles (2023, APP1/APP11): “develop and maintain a clear, accessible privacy policy detailing how they collect, use, store and disclose personal information” and “take appropriate measures to protect personal information from unauthorised access, modification, disclosure, loss or theft.”

Validity vs accuracy

Valid = conforms to pre-set rules/constraints (correct format/type/range).
Accurate = matches the true/actual value.
Valid but not accurate (email example): “The user enters an email in the correct format (e.g. [email protected]) which is valid, but if it doesn’t belong to the player, it is not accurate.”
Validity check on an email (1 mark): must contain @; at least one char before and after @; no spaces; no invalid special characters; valid domain suffix (.com/.org/.net); must not be blank.

Data cleaning & outliers

Outlier: “A data value that is much higher or lower than the other values in the dataset.”
Importance of data cleaning: “Removes errors, inconsistencies and outliers that can distort analysis, ensuring results are accurate and decisions based on the data are valid. Without cleaning, patterns may be misleading.”

Ethics – open-source code without attribution

“Using open-source code without proper attribution is unethical because it fails to acknowledge the original author – plagiarism – and may also violate the software licence terms, leading to legal or reputational consequences.”

Open-source vs proprietary licences: open-source lets developers “use, modify and distribute the code freely, but often requires attribution or sharing changes under the same licence”; proprietary “restricts access to the source code and controls distribution.” For a game: proprietary = keep full control; open-source = community development but others can copy/modify.

Software licensing (2023)

Define: “Software licensing is the legal agreement that sets out how software can be used, copied, modified and distributed.” (open-source vs proprietary vs freeware vs shareware).

10. Databases: RDBMS, Data Dictionary, SQL

RDBMS purpose

“Software that enables the creation, management and manipulation of a relational database, structured in tables. Data can be accessed or reassembled in many ways without reorganising the tables. RDBMS supports data integrity rules, security, robustness and multi-user access control.”

Controls user access (scenario): “Different users have different levels of access. E.g. the professor has full access to results, while data-entry analysts can only insert/update data, not delete or modify others’ work. Role-based access control ensures data integrity and security.”

Data independence: “Changes to how data is stored/structured won’t affect how users and applications interact with it. E.g. if a field is renamed or the schema reorganised, the applications still function.”

Data dictionary

“Describes the structure of a database by listing table names, field names, data types, field sizes and relationships/constraints. It standardises definitions and ensures consistency and agreement among team members.”

SQL statements (mark phrases)

INSERT (3 marks):

INSERT INTO FoodDelivery
VALUES (12343, 10918, '2025-02-16', 5.00, 3, TRUE);

(Column names optional if all values in correct order.)

UPDATE (3-4 marks – each clause a mark):

UPDATE Service
SET ServiceType = 'Routine'
WHERE ScooterID = 108
AND ServiceDate = '2023-07-15';

RED TRAP: never forget the WHERE clause in UPDATE/DELETE.

Leaderboard query – email + count sorted highest→lowest (5 marks, 1 mark each clause):

SELECT email, COUNT(*)
FROM GameplayLog
GROUP BY email
ORDER BY COUNT(*) DESC;

Most recent service with JOIN + MAX (2023, 5 marks):

SELECT Scooter.ScooterID, Scooter.City, MAX(Service.ServiceDate)
FROM Scooter JOIN Service
ON Scooter.ScooterID = Service.ScooterID
WHERE Service.ServiceType = 'Routine';

11. Normalisation & Data Anomalies

1NF, 2NF, 3NF (1 mark each)

1NF: “All fields contain only atomic values, no repeating groups, and each record is unique (have a primary key).”
2NF: “Must be in 1NF and all non-key attributes must be fully functionally dependent on the entire primary key (no partial dependencies).”
3NF: “Must be in 2NF and non-key attributes must depend only on the primary key (no transitive dependencies).”

Anomalies (concept + example each)

Insert anomaly: “Certain data cannot be added without including unrelated information. E.g. a new publisher cannot be added unless there is a book associated with it.”
Update anomaly: “A piece of data must be updated in multiple places, causing inconsistency if not all are updated. E.g. changing Penguin’s address in several rows.”
Delete anomaly: “Deleting one row unintentionally deletes other important data. E.g. deleting the book ‘1984’ also loses George Orwell’s information.”

RED TRAP (2025): update anomaly is triggered when a player’s email is updated in some records but not others → inconsistent data.

ERD crow’s feet notation

Entities: rectangles. PK underlined / denoted. FK in related tables.
Cardinalities (crow’s feet): one = single line; many = crow’s foot (three prongs). 1:M and M:1.
M:N must be resolved with an associative entity (e.g. Actor–Movie → Cast with FKs to both PKs). Leaving a direct M:N = no marks.
1 mark mark-bands: all entities correct; all PKs correct; all FKs correct; all cardinalities correct; correct crow’s feet notation. Non-key fields usually not required.

12. The Framework for Development / SDLC (project management)

Stages (investigate stage activities – 1 mark each): problem description, define requirements, development schedule (“Accept other relevant answers” but these are the canonical syllabus terms).

Define the requirements (describe, 2 marks): “Identifying what the system must do, who will use it, and any constraints such as budget or deadlines. It ensures the final product meets user needs and project goals.” (1 mark = superficial “write down what the system needs”).

Development schedule (explain, 3 marks): “Plans and organises the sequence of tasks to complete the project. It helps allocate time and resources efficiently so each stage is completed on time, allowing teams to monitor progress, identify delays and adjust priorities.”

RED TRAP – command words: Describe = what + how (2 marks); Explain = what + how + why it matters / benefit (3 marks). A superficial/vague comment is always 1 mark.

13. Python Essentials (extended-answer, big marks)

The big coding question is always real Python (no pseudocode). Write correct Python with descriptive names, and always include a print for the mark that tests the function.

Sum of a list (no built-in sum) – 5 marks

function definition + parameter (1), initialise total (1), iterate through all values (1), accumulate (1), return (1).

def count_array(numbers):
    total = 0
    for i in range(len(numbers)):
        total += numbers[i]
    return total

Modulo / looping position (song position) – 4 marks

define function + parameter (1), use modular arithmetic % 12 (1), handle the zero case (1), return (1).

def song_position(song_num):
    position = song_num % 12
    if position == 0:
        position = 12
    return position

RED TRAP: many students forget if position == 0: position = 12 – that’s 1 of 4 marks.

Multi-way selection (if/elif/else rewards) – 10 marks

parameters (1), initialise total (1), append current ride time to the list (1), correct for loop (1), accumulate (1), if/elif/else (1), correct cut-offs Bronze/Silver/Gold (1), selection to check level changed (1), output (1), return new level (1).

def update_ride_times(ride_times, current_ride_time, reward_level):
    total_hours = 0
    ride_times.append(current_ride_time)
    for minutes in ride_times:
        total_hours += minutes
    if total_hours <= 30:
        new_reward_level = "Bronze"
    elif total_hours <= 50:
        new_reward_level = "Silver"
    else:
        new_reward_level = "Gold"
    if new_reward_level != reward_level:
        print("Congratulations, you have moved up a level")
    return new_reward_level

Nested-selection cost function – 7 marks

all four parameters (1), selection for Gold unlock_fee (1), unlock_fee = 0 for Gold (1), selection for Silver OR Gold discount (1), apply discount (1), correct cost calc (1), return (1).

def calculate_cost(base_price, duration, membership_level, discount_applied):
    unlock_fee = 5 if membership_level != "Gold" else 0
    if membership_level in ("Silver", "Gold"):
        base_price *= 0.8
    total_cost = base_price + unlock_fee
    if discount_applied:
        total_cost *= 0.9
    return total_cost

RED TRAP — Python is indentation-based: no END IF/END FOR because indentation replaces them, but inconsistent indentation causes an IndentationError and code loses all marks.

14. SQL + Database Code (extended-answer, big marks)

Know these SQL statements cold — they recur every paper.

INSERT (3 marks)

INSERT INTO FoodDelivery (OrderID, CustomerID, OrderDate, Amount, Items, Status)
VALUES (12343, 10918, '2025-02-16', 5.00, 3, TRUE);

(Column names optional if all values are in the correct table order.)

UPDATE (3–4 marks – each clause is a mark)

UPDATE Service
SET ServiceType = 'Routine'
WHERE ScooterID = 108
  AND ServiceDate = '2023-07-15';

RED TRAP: never forget the WHERE clause in UPDATE/DELETE — otherwise every row is changed.

Leaderboard – email + count, highest first (5 marks)

SELECT email, COUNT(*) AS times_played
FROM GameplayLog
GROUP BY email
ORDER BY COUNT(*) DESC;

Most recent service with JOIN + MAX (2023, 5 marks)

SELECT Scooter.ScooterID, Scooter.City, MAX(Service.ServiceDate) AS last_service
FROM Scooter
JOIN Service ON Scooter.ScooterID = Service.ScooterID
WHERE Service.ServiceType = 'Routine'
GROUP BY Scooter.ScooterID, Scooter.City;

DELETE with subquery (only rows that match)

DELETE FROM GameplayLog
WHERE PlayerID IN (
    SELECT PlayerID FROM Player
    WHERE Email = '[email protected]'
);

Filtering basics

WHERE before GROUP BY; HAVING after GROUP BY (filters the grouped result).
Distinct: SELECT DISTINCT City FROM Service;
Wildcards: WHERE Email LIKE '%@gmail.com' (% = any number of chars, _ = exactly one).

15. Structure Charts & Desk Checks

Structure chart (5 marks)

Each sub-function drawn as a rectangle (not rounded/oval) (1).
Arrows down with parameter names alongside = data passed into each module.
Arrows up with return value = data passed back to main.
1 mark per correct flow to/from each of the sub-functions.
Marking key specifically checks “flow to and from” each function – show parameters going down and returns going up.

Errors & desk checks (trace table)

Runtime error: “An error that occurs while a program is executing, after it has successfully compiled – e.g. dividing by zero or accessing an invalid index, causing the program to crash or behave unexpectedly.”
Why harder to detect than a syntax error: “It doesn’t appear until the program is run and may only occur with specific inputs/conditions; a syntax error is identified immediately by the compiler/interpreter.”
Syntax error: caught by compiler/interpreter when writing (misspelled keyword, missing indentation, unbalanced bracket).
Logic error: “program runs but produces wrong output” – a trace table / desk check is most effective at finding logic errors (2023 1-mark answer).
Desk check (trace table): “Manually step through the code line by line, tracking changes to variable values, to observe the logic and pinpoint where the error occurs.” Apply it to the scenario for full marks.

Global vs local variables (2023)

Global = accessible everywhere (better for shared values) but concern: harder to track changes / risk of unintended modification, poor encapsulation. Local = only within the function (safer, reusable) but can’t be shared easily.

Meaningful variable names

Use descriptive names (e.g. total_marks, num_laps) not cryptic one-letter names, so code is self-documenting and easier to debug.

16. Data Types & Control Structures

Data types (2023 “state key characteristics”): Integer (whole numbers), Float/Real (decimal), String (text), Boolean (True/False), Date/Time.

Control structures:

Sequence – executes lines in order.
Selection – IF/ELSE, CASE (chooses a path based on a condition). Multi-way = CASE or nested IF.
Iteration/repetition – FOR (known count), WHILE (condition at top), REPEAT-UNTIL (condition at bottom).

Validation: Range check (age 0–120), type check (integer), presence check (not blank), length check, format check (email/phone), range check etc. A loop re-prompts until valid input is given.

API (2023): a set of defined rules/functions that lets one program request data/services from another; developer sends a request and receives structured data back.

Extended-Answer Scenarios (the 4 big ones)

Every year: a source booklet scenario (2025 = Creature Keeper pet game; 2023 = ScootAround scooters) → Q1 big Python coding task (write functions + a loop), Q2 database task (SQL + normalisation + ERD), Q3 networking task (TCP/IP layers, subnet, hardware, firewall), Q4 security task (CIA triad, auth, physical security, phishing).

The big coding question almost always wants:

A function that mutates/updates data (apply action → apply day-pass → clamp values to a range 0–10: “if below 0 set to 0, if above 10 set to 10”).
A can_evaluate / decision function using AND conditions (age AND stat AND skill).
The main gameplay loop (while wellbeing > 5: output day → display stats → get action → call functions → age+1 → check evolve → wellbeing → message) – you write only the loop, not the whole main.
A structure chart of the program.
An ethics sub-question (open-source/proprietary licences).

For the database question, always: normalise to 3NF, then draw the ERD with crow’s feet, resolve M:N, show PKs/FKs, then answer SQL (INSERT/UPDATE/GROUP BY ORDER BY) and data-dictionary/validity parts.

Final Checklist Before the Test

TCP/IP layers: learn the exact order Application → Transport → Internet → Network, and which layer TCP/IP/HTTPS belong to.
Keywords that earn marks: broadcast = “to all devices on the same network segment”; runtime error = “after it has successfully compiled”; peninsula testing = “simulated attack to find vulnerabilities before attackers do”; XSS = “injects script into a trusted site that runs in other users’ browsers”.
Encryption: public = two different keys; symmetric = same key, must be shared.
Explain ≠ describe: always add why it matters / the benefit for full marks; apply theory to the given scenario.
Normalisation: 1NF atomic/no repeating, 2NF no partial dependency, 3NF no transitive dependency.
ERD: resolve every M:N with an associative entity; show PKs + FKs + crow’s feet — or lose all marks.
SQL: never write UPDATE/DELETE without a WHERE; leaders query = GROUP BY + ORDER BY COUNT(*) DESC.
Structure chart: rectangles only; arrows for parameters down and return values up.
Python: use descriptive names, indent consistently (if: elif: else:), and always print the result that earns the mark.
Malware: worm = standalone network spreader; virus = attaches to files; trojan = disguised backdoor; ransomware = encrypts + demands payment.
Grep-style scan of every definition question: name the term, then the phrase that proves you understand it.