T-Levels Digital Production, Design and Development Syllabus

Differentiate physical, technical and administrative security controls with an example of each.

Physical: protect tangible assets, e.g. locks, CCTV, biometric door entry. Technical (logical): software/hardware controls, e.g. firewalls, encryption, antivirus. Administrative: policies and procedures, e.g. acceptable use policy, staff training.

Name the four broad functions security controls can perform.

Preventive (stop incidents, e.g. firewalls), Detective (identify incidents, e.g. IDS/logs), Corrective (recover after an incident, e.g. backups), and Deterrent (discourage attackers, e.g. warning signs/CCTV).

What is multi-factor authentication (MFA) and what three factor categories can it draw on?

MFA requires two or more independent credentials to verify identity. The factors are: something you know (password/PIN), something you have (token/phone), and something you are (biometrics such as a fingerprint).

Distinguish between symmetric and asymmetric encryption.

Symmetric encryption uses a single shared key for both encryption and decryption (fast, e.g. AES). Asymmetric encryption uses a public/private key pair — encrypt with one, decrypt with the other (e.g. RSA) — solving the key-distribution problem.

Under the UK GDPR/Data Protection Act 2018, list four of the data protection principles.

Any four of: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality (security); and accountability.

Which UK Act makes unauthorised access to computer material a criminal offence, and name one offence under it?

The Computer Misuse Act 1990. Offences include: unauthorised access to computer material; unauthorised access with intent to commit further offences; and unauthorised modification/impairment of computer data.

What is the purpose of the ISO/IEC 27001 standard?

It is the international standard specifying requirements for an Information Security Management System (ISMS) — a framework for managing and protecting information assets through risk-based controls.

State the qualitative risk formula used in risk assessment.

Risk is a function of likelihood and impact: $\text{Risk} = \text{Likelihood} \times \text{Impact}$, where each factor is rated (e.g. on a scale) and combined, often via a risk matrix, to prioritise risks.

Name the four common strategies for treating a risk after assessment.

Avoid (eliminate the activity causing the risk), Reduce/Mitigate (apply controls to lower it), Transfer (shift it to a third party, e.g. insurance), and Accept/Tolerate (acknowledge and take no further action).

Compare the Waterfall and Agile project methodologies.

Waterfall is sequential and plan-driven — each phase completes before the next, with fixed requirements; good for stable, well-understood projects. Agile is iterative and incremental, delivering working software in short sprints with continuous feedback; good for evolving requirements.

List the typical phases of the Software Development Life Cycle (SDLC) in order.

Planning/feasibility, Analysis (requirements), Design, Implementation (coding), Testing, Deployment, and Maintenance.

In Scrum, name three core roles and the standard length range of a sprint.

Roles: Product Owner, Scrum Master, and the Development Team. A sprint typically lasts 1–4 weeks (commonly 2 weeks).

Differentiate functional and non-functional requirements with an example of each.

Functional requirements describe what the system must do, e.g. 'the system shall let users reset their password'. Non-functional requirements describe how it performs/qualities, e.g. 'pages must load in under 2 seconds' (performance, security, usability).

Name four techniques for gathering requirements from stakeholders.

Interviews, questionnaires/surveys, observation (job shadowing), workshops/focus groups, and document/record analysis of existing systems.

What does the MoSCoW method prioritise requirements into?

Must have, Should have, Could have, and Won't have (this time) — a technique for ranking requirements by importance and agreeing scope.

Define a 'user story' and give its standard format.

A user story is a short, plain-language description of a feature from the user's perspective. Format: 'As a [type of user], I want [goal] so that [benefit/reason].'

What is a Gantt chart used for in project management?

A Gantt chart is a horizontal bar chart showing project tasks against a timeline, displaying start/end dates, durations, dependencies and milestones, used to schedule and track progress.

Distinguish between verification and validation in quality assurance.

Verification asks 'are we building the product right?' — checking it meets the specification (e.g. reviews, inspections). Validation asks 'are we building the right product?' — checking it meets the user's actual needs (e.g. acceptance testing).

Compare white-box and black-box testing.

White-box (structural) testing examines internal code/logic and paths, requiring knowledge of the implementation. Black-box (functional) testing checks inputs and outputs against requirements without knowledge of internal code.

Put these test levels in order from smallest to largest scope: integration, acceptance, unit, system.

Unit testing (individual components), Integration testing (combined modules), System testing (the whole application), then Acceptance testing (user confirms it meets requirements).

Name the three basic control structures used in structured programming.

Sequence (statements executed in order), Selection (decisions, e.g. if/else, switch), and Iteration (loops, e.g. for, while).

Differentiate the data types integer, float, Boolean and string.

Integer: whole numbers (e.g. 7). Float: numbers with a decimal/fractional part (e.g. 3.14). Boolean: a true/false value. String: a sequence of characters/text (e.g. "hello").

What is the difference between a local variable and a global variable (variable scope)?

A local variable is declared inside a function/block and is only accessible within it. A global variable is declared outside all functions and is accessible throughout the whole program.

Compare an array and a record (struct) as data structures.

An array stores multiple values of the same data type accessed by index. A record/struct stores multiple values of different data types (fields) grouped under one name and accessed by field name.

What is pseudocode and why is it used in the design stage?

Pseudocode is a structured, language-independent, plain-English description of an algorithm's logic. It is used to plan and communicate algorithms before coding, without worrying about specific syntax.

Name three benefits of following coding standards and conventions.

Improved readability and maintainability, easier collaboration/consistency across a team, fewer errors, and simpler debugging/onboarding. Examples include meaningful naming, indentation and commenting.

Differentiate a syntax error, a runtime error and a logic error.

Syntax error: breaks the language rules so code won't compile/run (e.g. missing bracket). Runtime error: occurs during execution and crashes the program (e.g. divide by zero). Logic error: code runs but produces incorrect results due to flawed logic.

List the four types of software maintenance.

Corrective (fix faults/bugs), Adaptive (adjust to a changed environment, e.g. new OS), Perfective (improve performance/add features), and Preventive (reduce future problems, e.g. refactoring).

In UX/UI design, what are the seven (Norman) usability principles often summarised as, and name three.

Principles guiding usable design; three examples are: visibility (users can see what actions are possible), feedback (the system responds to actions), consistency (similar elements behave similarly). Others include affordance, mapping, constraints and error tolerance.

What is a wireframe, and how does it differ from a prototype?

A wireframe is a low-fidelity, static skeletal layout showing structure and placement of elements without final styling. A prototype is an interactive, higher-fidelity model that simulates user flow and behaviour for testing.

Distinguish front-end from back-end development, naming a core technology for each.

Front-end (client-side) is what the user sees and interacts with — built with HTML, CSS and JavaScript. Back-end (server-side) handles logic, databases and processing — built with languages/runtimes like PHP, Python, Node.js, and databases such as MySQL.

In web development, what are the roles of HTML, CSS and JavaScript respectively?

HTML provides the structure/content of a page, CSS controls the presentation/styling and layout, and JavaScript adds interactivity and dynamic behaviour on the client side.

What is an API, and why is it important for back-end/database integration?

An API (Application Programming Interface) is a defined set of rules allowing software components to communicate. It lets the front-end request data and services from the back-end/database (e.g. via REST endpoints returning JSON) without exposing internal implementation.

Name the four main HTTP methods used in RESTful APIs and the CRUD operation each maps to.

GET (Read), POST (Create), PUT/PATCH (Update), and DELETE (Delete) — together implementing CRUD: Create, Read, Update, Delete.

Define 'responsive design' and name one technique used to achieve it.

Responsive design makes a web page adapt its layout to different screen sizes and devices. Techniques include CSS media queries, fluid/percentage-based grids, and flexible images.

What is the purpose of evaluating a digital product after deployment, and name two methods of doing so.

Evaluation checks whether the product meets requirements, user needs and success criteria, and identifies improvements. Methods: user feedback/surveys, usability testing, analytics on usage, A/B testing, and comparison against the original specification.