Loading…

Worked solutions

IB Computer Science SL · Paper 2

Computer Science, Standard Level

Timezone

TZ2TZ3

Session: May 2025
Marks: 180
Duration: 1 hour
Calculator: Not allowed
Questions: 12

Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8 Q9 Q10 Q11 Q12

Keep your copy of the paper open alongside. We don't reproduce the questions: each part below is labelled to match the May 2025 TZ2 paper, which your school or the IB can provide.

Practice mode

Hide our working until you've had a go.

Option A: Databases · Option

Questions 1–3 · 45 marks

Question 1

18 marks

Hospital staff relational schema, SQL inner joins, data types, and DBA privacy controls

Databases

(a)(i)

1 mark

Primary key in `STAFF`: `StaffID`.

Mentor tip

Identify the unique identifier attribute for each employee in the STAFF relation.

(a)(ii)

1 mark

Foreign key in `STAFF`: `RoleID` (or `DepartmentID`).

Mentor tip

State either RoleID or DepartmentID, which link STAFF to ROLE and DEPARTMENT respectively.

(b)

2 marks

`ROLE` to `STAFF`: One-to-many (1:M) relationship — a single role (such as nurse or radiologist) is held by many staff members, while each staff member holds only one role.
`DEPARTMENT` to `STAFF`: One-to-many (1:M) relationship in the depicted schema (or many-to-many conceptually across hospital departments).

Mentor tip

Clearly specify the cardinality for both pairs of linked tables.

(c)

2 marks

Data filtering and extraction: A query retrieves a customized subset of records and attributes from one or more tables that satisfy specified search criteria.
Data manipulation and aggregation: Enables users to sort, group, summarize (via `COUNT`, `AVG`, `SUM`), or update stored records.

Mentor tip

Explain that queries filter/retrieve specific subsets of data based on user-defined conditions.

(d)

4 marks

Step 1 - Project attributes: Select `STAFF.FirstName`, `STAFF.Surname`, and `ROLE.PayGrade`.
Step 2 - Join relations: Perform an `INNER JOIN` between `STAFF` and `ROLE`.
Step 3 - Specify join condition: Match foreign and primary keys using `ON STAFF.RoleID = ROLE.RoleID`.
Step 4 - Filter rows: Apply the `WHERE` condition `STAFF.Surname = 'Waters' AND ROLE.PayGrade = 17`.
SQL equivalent:
SELECT STAFF.FirstName, STAFF.Surname, ROLE.PayGrade FROM STAFF INNER JOIN ROLE ON STAFF.RoleID = ROLE.RoleID WHERE STAFF.Surname = 'Waters' AND ROLE.PayGrade = 17;

Mentor tip

Include the projection columns, the table join on RoleID, and both filtering conditions.

(e)

2 marks

Whole-number domain and compact storage: Pay grades are discrete whole numbers (e.g., 17), which require minimal memory when stored as binary integers.
Sorting and numerical comparisons: Integer representation allows direct numerical ordering (`ORDER BY PayGrade`) and range comparisons (`> `, `<`).

Mentor tip

Highlight that pay grades are whole numbers and integers enable numerical sorting/comparisons with low storage overhead.

(f)

6 marks

Method 1 - Role-Based Access Control (RBAC) and Database Views:
- Mechanism: The DBA assigns granular access permissions and constructs restricted SQL views that expose only non-sensitive attributes.
- Hospital application: A department manager can view staff names and schedules within their unit while being blocked from viewing confidential `PayGrade` or `DateOfBirth` columns.
Method 2 - Column-level / At-rest Encryption:
- Mechanism: Sensitive database fields are encrypted using cryptographic keys before being written to disk, converting plaintext into unreadable ciphertext.
- Hospital application: Even if unauthorized personnel or attackers gain physical access to storage media, personal staff records remain indecipherable without the decryption key.

Mentor tip

Provide two distinct methods (e.g., access control/views and encryption), explaining the mechanism and a concrete hospital staff example for each.

Question 2

15 marks

Conceptual vs logical schemas, DDL, data modelling, validation vs verification, and ACID integrity

Databases

(a)

2 marks

Conceptual schema ('what' model): A high-level, technology-independent abstraction that identifies core business entities and their broad relationships without implementation details.
Logical schema ('how' model): A detailed structural blueprint derived from the conceptual schema that specifies exact table structures, attribute names, data types, primary keys, and foreign keys.

Mentor tip

Contrast the high-level entity overview of a conceptual schema with the detailed attributes and keys of a logical schema.

(b)

2 marks

Physical schema instantiation: A Data Definition Language (DDL) translates the logical data model into physical database structures by defining tables, field data types, and key constraints.
Concrete command usage: Statements such as `CREATE TABLE`, `ALTER TABLE`, and `DROP TABLE` formally build and modify the relational schema.

Mentor tip

Explain that DDL defines the database schema structures and cite commands like CREATE TABLE or ALTER TABLE.

(c)

4 marks

Reason 1 - Eliminating redundancy and anomalies via normalization: Modelling identifies entities, attributes, and functional dependencies early, preventing data duplication, update anomalies, and wasted storage.
Reason 2 - Ensuring stakeholder alignment and query support: Visualizes table relationships and key links for analysts and programmers, ensuring the resulting database supports all required multi-table queries.

Mentor tip

Focus on avoiding data redundancy/anomalies and verifying that entities and relationships meet system requirements.

(d)

3 marks

Data validation: An automated rule check ensuring entered data is sensible, formatted properly, and within allowable boundaries (e.g., ensuring `DateOfBirth` is a valid past calendar date).
Data verification: Confirming via double-entry or visual proofreading that the input matches the original source document (e.g., checking that a patient's surname 'Waters' was not mistyped as 'Walters').
Synergy for correctness: Validation catches impossible values automatically, while verification catches human transcription errors that still pass syntax rules.

Mentor tip

Define both terms clearly and explain how combining them catches both out-of-range values and human typos.

(e)

2 marks

Atomicity and rollback: The DBMS treats a transaction as an 'all-or-nothing' unit; if any step fails, all uncommitted modifications are rolled back using the transaction log.
Isolation via locking: Concurrency locks prevent simultaneous transactions from reading or overwriting intermediate uncommitted states, avoiding lost updates and dirty reads.

Mentor tip

Reference ACID mechanisms: atomic rollback on failure and isolation locking during concurrent execution.

(f)

2 marks

Foreign-to-primary key enforcement: Referential integrity ensures every foreign key value in a child table matches an existing primary key in the parent table.
Cascading updates and orphan prevention: Automatically blocks the deletion of referenced parent records (or cascades updates/deletes), preventing dangling orphan records.

Mentor tip

Explain foreign key matching and preventing orphan records via cascading rules.

Question 3

12 marks

Derived age attributes, 1NF vs 2NF normalization, and 3NF patient appointment schema

Databases

(a)(i)

2 marks

Dynamic accuracy: Because `Age` changes over time, calculating it on the fly from `DateOfBirth` guarantees the value is always current without running daily batch updates.
Storage efficiency: Avoids storing redundant data on disk that can already be computed from existing fields.

Mentor tip

Mention both saving storage space and keeping time-sensitive values like age automatically up to date.

(a)(ii)

2 marks

Retrieve `DateOfBirth` from the `PATIENT` table.
Subtract the birth year/date from the current system date: e.g., `TIMESTAMPDIFF(YEAR, DateOfBirth, CURDATE())` or `YEAR(CurrentDate) - YEAR(DateOfBirth)`.

Mentor tip

Specify fetching DateOfBirth and subtracting it from the current system date.

(b)

2 marks

First Normal Form (1NF): Requires that all attributes contain only atomic (indivisible) values, eliminating repeating groups, with each record uniquely identified by a primary key.
Second Normal Form (2NF): Requires the relation to already be in 1NF and eliminates partial dependencies, ensuring every non-key attribute depends on the entire composite primary key.

Mentor tip

Contrast atomic values/no repeating groups in 1NF with full functional dependency on composite keys in 2NF.

(c)

6 marks

Decompose the appointment view into 3NF relations with underlined primary keys and asterisked foreign keys:
1. `PATIENT(PatientID, FirstName, Surname, PreferredName, DateOfBirth)` — PK: `PatientID`
2. `DEPARTMENT(DepartmentID, DepartmentName, Building, Room)` — PK: `DepartmentID`
3. `DOCTOR(DoctorID, DoctorFirstName, DoctorSurname, DepartmentID*)` — PK: `DoctorID`, FK: `DepartmentID`
4. `APPOINTMENT(AppointmentID, PatientID*, DoctorID*, AppDate, AppTime)` — PK: `AppointmentID` (or composite `(PatientID*, DoctorID*, AppDate, AppTime)`), FKs: `PatientID`, `DoctorID`

Mentor tip

Separate PATIENT, DOCTOR, DEPARTMENT, and APPOINTMENT into distinct tables linked by foreign keys so no transitive dependencies remain.

Option B: Modelling and simulation · Option

Questions 4–6 · 45 marks

Question 4

21 marks

Climate data spreadsheet graphing, sampling intervals, parallel arrays, and statistical pseudocode

Modelling and simulation

(a)

1 mark

Variables required: `DailyMaxTemperature` (or sum of daily maximum temperatures) and `NumberOfDays` (count of days in the period).

Mentor tip

State both the temperature readings/total and the number of days recorded.

(b)

3 marks

Step 1: Highlight the spreadsheet cell ranges containing the `Year` column (1970–2020) and the corresponding `Mean Daily Maximum Temperature` column.
Step 2: Insert a 2D Line Chart (with markers and a linear trendline).
Step 3: Configure chart labels by setting the horizontal x-axis title to `Year`, the vertical y-axis title to `Temperature (°C)` (scaled from 27 to 30), and adding the chart heading.

Mentor tip

Detail selecting the data columns, choosing a line chart, and labeling both axes properly.

(c)

2 marks

Visual trend recognition: Allows researchers and policymakers to immediately see the upward long-term warming trajectory across the 50-year span.
Rapid anomaly and cross-regional comparison: Makes it easier to spot outlier years and compare Nauru's warming rate against charts from other regions.

Mentor tip

Highlight easy visual identification of long-term warming trends and simpler comprehension than raw tables.

(d)

2 marks

Storage and processing efficiency: Hourly sampling generates only 24 readings per day instead of 1,440 minute-by-minute readings (a 60-fold reduction in storage and processing overhead).
Negligible ambient variance: Atmospheric temperature changes slowly over 60 seconds, so per-minute logging adds noise without improving climate study accuracy.

Mentor tip

Compare 24 vs 1,440 daily records and note that temperature barely fluctuates from minute to minute.

(e)

5 marks

Step 1: Declare two 1D arrays of size 24: `TIME` (string/time format) and `TEMP` (floating-point numbers).
Step 2: Populate the `TIME` array sequentially with hourly timestamps from `00:00` at index 0 through `23:00` at index 23.
Step 3: Initialize an index counter variable (e.g., `hourIndex`) from 0 to 23 to iterate 24 times.
Step 4: At each hourly interval `hourIndex`, read the automated sensor temperature and store it into `TEMP[hourIndex]`.
Step 5: Because both arrays share the exact same index `hourIndex`, any temperature `TEMP[k]` corresponds directly to timestamp `TIME[k]`.

Mentor tip

Describe creating two 24-element arrays (TIME and TEMP) and using a shared loop index from 0 to 23 to link each reading to its hour.

(f)

8 marks

Construct the pseudocode algorithm to compute daily max, min, overall mean, and night-time mean:
totalTemp = 0
nightTotal = 0
minTemp = TEMP[0]
maxTemp = TEMP[0]
loop i from 0 to 23
current = TEMP[i]
totalTemp = totalTemp + current
if current < minTemp then
minTemp = current
end if
if current > maxTemp then
maxTemp = current
end if
if TIME[i] >= "19:00" OR TIME[i] <= "06:59" then
nightTotal = nightTotal + current
end if
end loop
meanTemp = totalTemp / 24
meanNightTemp = nightTotal / 12
output "Max: ", maxTemp, " Min: ", minTemp
output "Mean: ", meanTemp, " Night Mean: ", meanNightTemp

Mean_{24h} = \frac{\sum _{i = 0}^{23} TEMP [ i ]}{24}, Mean_{night} = \frac{\sum _{night} TEMP [ i ]}{12}

Mentor tip

Initialize minTemp and maxTemp to TEMP[0] (or extreme bounds), check the night-time window (19:00 to 06:59), and divide totals by 24 and 12 outside the loop.

Question 5

16 marks

Climate models vs simulations, rule extraction, historical test validation, and policy decision-making

Modelling and simulation

(a)

2 marks

Model: A static mathematical or logical abstraction representing the variables and relationships of a real-world system (such as equations linking temperature to thermal ocean expansion).
Simulation: The dynamic execution of that model over time on a computer to observe how the system behaves under changing conditions.

Mentor tip

Define a model as the static mathematical abstraction and a simulation as running that model over time.

(b)

3 marks

Step 1 - Empirical correlation analysis: Collate historical pairs of annual mean temperature and mean sea level data to identify statistical correlations and rates of change.
Step 2 - Mathematical rule formulation: Derive mathematical formulas or conditional thresholds (e.g., how many millimetres sea level rises per $0. 1^{\circ} C$ warming and at what tide height coastal flooding triggers).
Step 3 - Verification against observed records: Test the proposed rules against historical flood logs to confirm they reproduce past events before coding them into the simulation.

Mentor tip

Explain analyzing historical data correlations, formulating mathematical relationships, and verifying rules against actual data.

(c)

6 marks

Validation procedure using test cases:
- Select clean historical baseline data (e.g., 1994–2005 temperature records) free from unmodeled external anomalies like volcanic tsunamis.
- Input these test cases into the simulation to generate predicted sea levels and flood frequencies for 2006–2015.
- Compare simulated predictions against actual recorded tide-gauge measurements from Nauru over that same period.
- Iteratively refine model weights and equations whenever discrepancies exceed tolerable error tolerances.
Evaluative conclusion: Historical test cases effectively calibrate baseline accuracy, though they cannot fully guarantee validity under unprecedented future climate tipping points.

Mentor tip

Detail running historical inputs, comparing predicted vs observed outputs, refining equations, and evaluating the limits of historical testing.

(d)

5 marks

Advantages for coastal decision-making:
- Safe, low-cost 'what-if' exploration: Policymakers can test sea-wall construction or relocation zones across multiple warming scenarios without waiting decades.
- Visual communication: Generates clear flood maps that help secure international climate aid and inform local zoning.
Disadvantages and limitations:
- Oversimplification of complex variables: Models focusing only on temperature and sea level omit king tides, storm surges, coral reef erosion, and socio-cultural attachment to ancestral land.
- Risk of flawed capital allocation: Inaccurate assumptions can cause governments to under-prepare for catastrophic inundation or waste scarce aid on misdirected defenses.
Conclusion: Simulations are indispensable planning aids for Pacific islands, provided their outputs are combined with local geological and socio-economic expertise.

Mentor tip

Balance cost-effective scenario forecasting against model oversimplification and omission of socio-cultural/local factors.

Question 6

8 marks

Geographic flood visualization, mathematical memory representations, and 3D animation constraints

Modelling and simulation

(a)

1 mark

Visualization is the graphical representation of numerical or abstract data to help users interpret patterns, trends, and spatial impacts.

Mentor tip

Define visualization concisely as representing data in a graphical or visual form.

(b)

2 marks

Mathematical wireframe representation: In memory, a 3D scene is stored as a mathematical model of 3D coordinates (vertices, polygons, elevation meshes, and surface textures).
Rendering transformation: The graphics pipeline renders these stored mathematical structures into 2D raster image frames for display as a 3D visualization.

Mentor tip

Explain that 3D models are stored mathematically in memory and rendered into visual frames.

(c)

5 marks

Time considerations:
- High computational rendering latency: Calculating dynamic water physics, lighting reflections, and terrain inundation across thousands of sequential frames requires intensive CPU/GPU processing time.
- Development complexity: Programming accurate 3D topographical meshes of Nauru takes significantly longer than creating static 2D maps.
Memory considerations:
- Substantial RAM and VRAM demands: Storing high-resolution terrain textures, multi-layered elevation grids, z-buffers, and sequential animation frames consumes gigabytes of fast primary and GPU memory.
- Secondary storage swapping penalties: If primary RAM is exceeded, paging data to slower secondary storage causes severe frame rate drops and rendering stutter.
Conclusion: Producing smooth 3D flood animations requires dedicated GPU hardware and ample high-speed VRAM to balance rendering time against visual fidelity.

Mentor tip

Address both time (rendering calculations, development effort) and memory (RAM/VRAM for textures/layers, secondary storage bottlenecks), ending with a conclusion.

Option C: Web science · Option

Questions 7–9 · 45 marks

Question 7

9 marks

Internet vs World Wide Web, URL structure, FTP dual connections, and browser operation

Web science

(a)

2 marks

The Internet: The global physical and logical network infrastructure of interconnected routers, servers, and client devices communicating via TCP/IP.
The World Wide Web (WWW): A software information service running on top of the Internet infrastructure that links hypertext documents and multimedia accessed via HTTP/HTTPS and web browsers.

Mentor tip

Distinguish the physical/IP hardware network (Internet) from the HTTP hypertext document service running over it (Web).

(b)

2 marks

Characteristic 1 - Protocol scheme: Specifies the application-layer transfer protocol used to fetch the resource (`https`).
Characteristic 2 - Domain/Host and file path: Identifies the specific web server host (`www.bbc.co.uk`) and the hierarchical directory path to the exact file (`/bytesize/index.htm`).

Mentor tip

Identify two structural components from the given URL: protocol (https), host/domain (www.bbc.co.uk), or file path (/bytesize/index.htm).

(c)

2 marks

Characteristic 1 - Dual TCP connections: Establishes two separate connections between client and server—one control connection (port 21) for commands/authentication and one data connection (port 20) for file contents.
Characteristic 2 - Client-server bulk transfer: Designed specifically for reliable uploading and downloading of complete files over TCP.

Mentor tip

Highlight the separation into two channels: a control connection (port 21) and a data transfer connection (port 20).

(d)

3 marks

DNS resolution and HTTP request: The browser resolves the URL's domain name into an IP address via a DNS server and transmits an HTTP/HTTPS request packet to the web server.
Resource retrieval and security verification: Receives the server's HTTP response containing HTML, CSS, JavaScript, and media, while verifying TLS/SSL certificates for encrypted HTTPS sessions.
Parsing and rendering: The browser's rendering engine parses the HTML/CSS markup and executes client-side scripts to display the formatted, interactive webpage.

Mentor tip

Mention DNS lookup + HTTP/HTTPS request/response, and parsing/rendering the returned HTML markup.

Question 8

20 marks

Search engine indexing, Black Hat SEO, Surface vs Deep Web, and PHP file upload processing

Web science

(a)

1 mark

A search engine is a software system that searches an index of web pages to retrieve and rank documents matching user-specified keywords and filters.

Mentor tip

Define as a software system that queries an indexed database of web resources based on user keywords.

(b)

2 marks

Seed traversal: An automated spider/bot starts from a list of known seed URLs, fetches page content, and extracts all outgoing hyperlinks to visit subsequent pages recursively.
Index updating and robots compliance: Parses titles, meta tags, and body text to update the search engine's index while respecting exclusions specified in `robots.txt`.

Mentor tip

Describe starting at seed URLs, following hyperlinks recursively, and copying content/keywords into the index.

(c)

2 marks

Relevance mapping: Crawlers extract keywords from `<title>`, `<meta>` tags, headings, and body text to categorize the topic of each webpage in the inverted index.
Ranking frequency calculation: The frequency and placement of keywords help the ranking algorithm match user queries to the most relevant indexed pages.

Mentor tip

Explain that keywords in meta tags and body text allow the indexer to categorize pages and rank query relevance.

(d)

6 marks

Black Hat SEO definition and techniques: Manipulating search engine algorithms against guidelines using keyword stuffing, invisible text, cloaking (showing different content to crawlers vs users), and paid link farms.
Short-term advantages:
- Rapidly inflates search engine rankings, driving an immediate spike in web traffic, ad impressions, and short-term sales revenue.
Long-term disadvantages and risks:
- Search engine detection algorithms penalize or permanently blacklist offending domains, wiping out organic visibility.
- Deceptive redirects or spammy content severely damage brand reputation and customer trust.
Conclusion: Legitimate organizations should reject black hat SEO; the severe risk of domain delisting and reputational harm far outweighs temporary traffic gains.

Mentor tip

Name specific black hat techniques (cloaking, keyword stuffing, link farms), weigh short-term traffic spikes against delisting/reputation loss, and give a clear conclusion.

(e)

2 marks

Surface Web: The portion of the World Wide Web consisting of static and publicly linked pages that are indexed by standard search engine crawlers.
Deep Web: Web content that is not indexed by conventional search engines, such as password-protected portals, academic databases, and dynamically generated query pages.

Mentor tip

Focus on search engine indexing: the surface web is indexed by standard crawlers, whereas the deep web (databases, authenticated pages) is not indexed.

(f)

4 marks

Step 1 - Upload detection and metadata extraction: Checks if a file `CV` was submitted via `POST` (`isset($_FILES['CV'])`) and extracts its name, byte size, temporary path, and lowercase file extension.
Step 2 - Extension validation: Checks whether the extracted extension is in the permitted list (`pdf`, `doc`, `docx`); if not, appends an extension error message to `$errors`.
Step 3 - File size validation: Checks whether ` $f i l e_{s} i z e > 2097152‘ (2 M B); i f e x cee d e d, a pp e n d s a s i z eer r or m ess a g e t o ‘$ errors`.
Step 4 - Conditional storage or error output: If ` $er r or s ‘ i se m pt y, m o v es t h e f i l e f r o m t e m p or a r y s t or a g e t o t h e ‘ C V /‘ d i r ec t or y an d o u tp u t s ‘" S u ccess "‘; o t h er w i se p r in t s t h eco n t e n t so f ‘$ errors`.

Mentor tip

Trace the four stages in code: extracting file attributes, checking extension, checking 2MB size limit, and moving the file or printing errors.

(g)

3 marks

Server-side execution concept: The PHP script executes entirely on the web server before sending only the resulting HTML output to the client browser.
Security of validation and file storage: Enforcing file size and extension checks on the server prevents malicious users from bypassing client-side JavaScript validation to upload executable malware.
Hardware independence and source protection: Guarantees consistent execution regardless of the client device's hardware capabilities while keeping proprietary backend logic hidden from end-users.

Mentor tip

Emphasize that server execution protects validation logic/files from client tampering and ensures consistent performance across client devices.

Question 9

16 marks

Lossless compression, open standards, decentralized web privacy, and global SaaS scalability

Web science

(a)

2 marks

Exact bitstream reconstruction: Lossless compression reduces file size without discarding any original data, allowing the exact bit-for-bit media file to be restored upon decompression.
Statistical redundancy encoding: Replaces repeating pixel patterns or common byte sequences with shorter tokens (using algorithms such as Run-Length Encoding or Huffman coding).

Mentor tip

Explain that no data is permanently discarded and repeating patterns are encoded with shorter tokens.

(b)

2 marks

Characteristic 1 - Publicly available and royalty-free: Technical specifications are openly documented and accessible for anyone to implement without proprietary licensing restrictions.
Characteristic 2 - Cross-platform interoperability: Collaboratively maintained by standards bodies to ensure media plays seamlessly across diverse operating systems and browsers.

Mentor tip

Mention open public access without proprietary ownership and cross-platform interoperability.

(c)

6 marks

Decentralized web architecture: Distributes data storage and operation across peer-to-peer (P2P) nodes or blockchains rather than centralized corporate servers.
Positive impacts on individual privacy:
- Eliminates corporate intermediaries: Users retain direct ownership and cryptographic control over their personal data, preventing tech monopolies from harvesting profiles for targeted surveillance advertising.
Negative impacts and 'Right to be Forgotten' challenges:
- Immutability and lack of central authority: Once private or defamatory information is replicated across hundreds of independent international peer nodes, there is no central administrator to enforce deletion requests.
- Inconsistent node security: Data replicated onto poorly secured peer nodes increases the attack surface for unauthorized leaks.
Conclusion: While decentralization empowers users against corporate surveillance, it severely undermines statutory privacy protections like the 'right to be forgotten' because permanently erasing distributed data is practically impossible.

Mentor tip

Contrast user control/freedom from corporate surveillance against the impossibility of enforcing the 'right to be forgotten' across peer-to-peer nodes.

(d)

6 marks

Factor 1 - Cloud Infrastructure and SaaS Delivery (Economic Efficiency):
- By hosting software on scalable cloud infrastructure (IaaS/PaaS) and delivering it via web browsers, Xero eliminates physical packaging, shipping, and local installation costs, lowering barriers for SMEs worldwide.
Factor 2 - Ubiquitous Broadband and Mobile Connectivity (Global Accessibility):
- Widespread high-speed internet and standardized web protocols allow customers in any time zone to access real-time accounting data 24/7 from any device.
Factor 3 - Digital Ecosystems, APIs, and Online Marketing:
- Search engine optimization (SEO), targeted digital advertising, online subscription payment gateways, and multi-currency bank APIs enable a small New Zealand firm to acquire, bill, and support international clients seamlessly.

Mentor tip

Cover three dimensions: cloud SaaS delivery (no physical distribution), 24/7 browser accessibility, and digital payment/API/marketing ecosystems.

Option D: Object-oriented programming · Option

Questions 10–12 · 45 marks

Question 10

17 marks

Healthcare product OOP model, encapsulation, UML diagrams, constructors, and language features

Object-oriented programming

(a)(i)

1 mark

`private` is an access modifier that restricts an attribute or method so it can only be accessed directly by code within the same class.

Mentor tip

State that private restricts direct visibility strictly to the declaring class.

(a)(ii)

1 mark

An accessor (getter) method is a public method that reads and returns the value of a private instance variable to external classes.

Mentor tip

Define an accessor as a method that returns the value of a private attribute.

(a)(iii)

2 marks

Construct the getter method in `Product`:
public String getProdDescription() {
return this.prodDescription;
}

Mentor tip

Ensure the return type is String and it returns prodDescription.

(b)(i)

3 marks

Construct a 3-compartment UML class box for `Product`:
Top compartment (Class Name): `Product`
Middle compartment (Private Attributes with `-` visibility):
- `- prodCode : String`
- `- prodType : String`
- `- prodDescription : String`
- `- prodBrand : Brand`
- `- prodSale : int`
Bottom compartment (Public Methods with `+` visibility):
- `+ Product(...)`
- `+ getProdSale() : int`
- `+ getProdBrand() : Brand`

Mentor tip

Include three compartments, '-' for private attributes with types, and '+' for public methods with return types.

(b)(ii)

3 marks

Construct the parameterized constructor for `Product`:
public Product(String prodCode, String prodType, String prodDescription, Brand prodBrand, int prodSale) {
this.prodCode = prodCode;
this.prodType = prodType;
this.prodDescription = prodDescription;
this.prodBrand = prodBrand;
this.prodSale = prodSale;
}

Mentor tip

Use the exact class name Product with no return type and initialize all five attributes.

(c)(i)

3 marks

Instantiate the `Brand` object:
Brand b = new Brand("Safesun", 2.17f);

Mentor tip

Declare a Brand reference variable, use the 'new' keyword, and pass "Safesun" and 2.17f.

(c)(ii)

2 marks

Class: A static blueprint or template that defines the structure of attributes and behaviors (methods) shared by all objects of that type.
Instance: A concrete object allocated in memory at runtime constructed from the class blueprint, holding its own specific attribute values.

Mentor tip

Contrast the abstract blueprint/template (class) with the concrete memory-allocated object holding specific values (instance).

(d)

2 marks

Feature 1: Native Unicode support (enabling internationalization across global character sets).
Feature 2: Built-in exception handling / Automatic garbage collection / Strong type checking / Rich standard class libraries.

Mentor tip

Name language-level features (e.g., Unicode support, exception handling, standard libraries) rather than IDE features like autocomplete.

Question 11

9 marks

Primitive data types and descending Selection Sort on object arrays

Object-oriented programming

(a)(i)

1 mark

A primitive data type is a fundamental, predefined data type built directly into the programming language (such as `int`, `float`, `boolean`, `char`) that stores a raw binary value in memory rather than an object reference.

Mentor tip

Define as a basic built-in language type that stores raw values directly in memory.

(a)(ii)

2 marks

Memory and CPU efficiency: Primitive types like `int` occupy a fixed, compact memory footprint (4 bytes) on the stack without object header or pointer overhead.
Direct hardware arithmetic: Processed directly in CPU registers, making arithmetic calculations and comparisons significantly faster than wrapper objects.

Mentor tip

Highlight compact memory usage (no object overhead) and faster direct CPU processing.

(b)

6 marks

Construct `sortProducts()` using Selection Sort to order `allProducts` in descending order of `prodSale`:
public void sortProducts() {
int n = allProducts.length;
for (int i = 0; i < n - 1; i++) {
int maxIndex = i;
for (int j = i + 1; j < n; j++) {
if (allProducts[j].getProdSale() > allProducts[maxIndex].getProdSale()) {
maxIndex = j;
}
}
Product temp = allProducts[maxIndex];
allProducts[maxIndex] = allProducts[i];
allProducts[i] = temp;
}
}

Mentor tip

Use getProdSale() to compare sales, track maxIndex in the inner loop, and swap entire Product object references.

Question 12

19 marks

OOP principles evaluation, Invoice array management, chained object pricing, and modularity

Object-oriented programming

(a)(i)

2 marks

Code reusability and extensibility: Polymorphism allows a single method interface or superclass reference to operate seamlessly on objects of different subclasses.
Simplified control flow: Eliminates complex `if-else` type-checking chains because the appropriate overridden method is resolved dynamically at runtime.

Mentor tip

Explain how a common interface/method works across diverse subclasses, improving extensibility.

(a)(ii)

2 marks

Data protection and validation: Declaring attributes `private` shields internal object state from accidental corruption by external code.
Controlled mutator access: Changes must pass through public setter methods where validation rules can enforce state consistency.

Mentor tip

Highlight hiding internal state from outside interference and enforcing validation via getters/setters.

(a)(iii)

2 marks

Tight coupling (fragile base class problem): Subclasses are tightly coupled to their superclass implementation.
Cascading maintenance risk: Modifying attributes or logic in the parent class can unintentionally break dependent child classes across deep hierarchies.

Mentor tip

Explain tight coupling between parent and child classes, where parent modifications risk breaking subclasses.

(b)

2 marks

Private attribute bundling: `Invoice` declares its state variables (`invoiceID`, `products`, `prodQuantity`, `qualifiesForDiscount`, `numOfProducts`) as `private`, blocking external classes from altering them directly.
Controlled public interface: External interaction is restricted to public methods such as `getInvoiceID()`, `addProduct()`, and `setQualifiesForDiscount()`.

Mentor tip

Reference the specific private variables in Invoice and its public methods like getInvoiceID().

(c)

3 marks

Construct `addProduct(Product product, int quantity)` using `numOfProducts` as the next available index:
public void addProduct(Product product, int quantity) {
products[numOfProducts] = product;
prodQuantity[numOfProducts] = quantity;
numOfProducts++;
}

Mentor tip

Insert both product and quantity at index [numOfProducts], then increment numOfProducts by 1.

(d)

6 marks

Construct `setQualifiesForDiscount()` by iterating up to `numOfProducts` and chaining `getProdBrand().getBrandPrice()`:
public void setQualifiesForDiscount() {
float totalValue = 0.0f;
for (int i = 0; i < numOfProducts; i++) {
float unitPrice = products[i].getProdBrand().getBrandPrice();
totalValue += unitPrice * prodQuantity[i];
}
if (totalValue > 3000) {
qualifiesForDiscount = true;
}
}

Mentor tip

Access each product's price via products[i].getProdBrand().getBrandPrice(), multiply by prodQuantity[i], and check if totalValue > 3000.

(e)

2 marks

Independent parallel development and easier debugging: Dividing a program into self-contained modules allows separate developer teams to build, unit-test, and debug components simultaneously without interfering with other parts of the system.

Mentor tip

Explain how smaller independent modules enable parallel team development or isolated debugging.

Our analysis

Where the marks are

Each part sorted by the topic it mostly tests. Databases carries the most marks on this paper.

Databases45 marks · 25%
Q1, Q2, Q3
Modelling and simulation45 marks · 25%
Q4, Q5, Q6
Web science45 marks · 25%
Q7, Q8, Q9
Object-oriented programming45 marks · 25%
Q10, Q11, Q12

Mentor insights

Traps to watch for

01
Omitting the join condition when querying across STAFF and ROLE · Q1
Selecting FirstName, Surname, and PayGrade without joining STAFF.RoleID = ROLE.RoleID produces a Cartesian product rather than matching each employee to their actual pay grade.
02
Using AND instead of OR for overnight time window filtering · Q4
Night-time spans 19:00 to 06:59 across midnight. Writing TIME[i] >= '19:00' AND TIME[i] <= '06:59' is logically impossible for a single timestamp; use OR (or check outside 07:00 to 18:59) and divide the night total by 12 rather than 24.
03
Swapping sales integers instead of Product object references · Q11
In sortProducts(), swapping only the prodSale values corrupts the objects; the temporary variable must be of type Product to swap allProducts[maxIndex] and allProducts[i].
04
Forgetting object navigation chaining for brandPrice · Q12
The Product class does not have a direct getPrice() method; you must navigate through the associated Brand object using products[i].getProdBrand().getBrandPrice().

Solutions and tips are GeorgeTheTutor's own; the questions are not reproduced here. Not affiliated with or endorsed by the International Baccalaureate Organization.

Want someone to go through your paper with you?

Our maths mentors took these exams recently. One-to-one, they'll find where your marks are going and fix it before May.

Find your maths mentor More past papers

Worked solutions

IB Computer Science SL · Paper 2

Computer Science, Standard Level

Timezone

TZ2TZ3

Session: May 2025
Marks: 180
Duration: 1 hour
Calculator: Not allowed
Questions: 12

Q1 Q2 Q3 Q4 Q5 Q6 Q7 Q8 Q9 Q10 Q11 Q12

Keep your copy of the paper open alongside. We don't reproduce the questions: each part below is labelled to match the May 2025 TZ2 paper, which your school or the IB can provide.

Practice mode

Hide our working until you've had a go.

Option A: Databases · Option

Questions 1–3 · 45 marks

Question 1

18 marks

Hospital staff relational schema, SQL inner joins, data types, and DBA privacy controls

Databases

(a)(i)

1 mark

Primary key in `STAFF`: `StaffID`.

Mentor tip

Identify the unique identifier attribute for each employee in the STAFF relation.

(a)(ii)

1 mark

Foreign key in `STAFF`: `RoleID` (or `DepartmentID`).

Mentor tip

State either RoleID or DepartmentID, which link STAFF to ROLE and DEPARTMENT respectively.

(b)

2 marks

`ROLE` to `STAFF`: One-to-many (1:M) relationship — a single role (such as nurse or radiologist) is held by many staff members, while each staff member holds only one role.
`DEPARTMENT` to `STAFF`: One-to-many (1:M) relationship in the depicted schema (or many-to-many conceptually across hospital departments).

Mentor tip

Clearly specify the cardinality for both pairs of linked tables.

(c)

2 marks

Data filtering and extraction: A query retrieves a customized subset of records and attributes from one or more tables that satisfy specified search criteria.
Data manipulation and aggregation: Enables users to sort, group, summarize (via `COUNT`, `AVG`, `SUM`), or update stored records.

Mentor tip

Explain that queries filter/retrieve specific subsets of data based on user-defined conditions.

(d)

4 marks

Step 1 - Project attributes: Select `STAFF.FirstName`, `STAFF.Surname`, and `ROLE.PayGrade`.
Step 2 - Join relations: Perform an `INNER JOIN` between `STAFF` and `ROLE`.
Step 3 - Specify join condition: Match foreign and primary keys using `ON STAFF.RoleID = ROLE.RoleID`.
Step 4 - Filter rows: Apply the `WHERE` condition `STAFF.Surname = 'Waters' AND ROLE.PayGrade = 17`.
SQL equivalent:
SELECT STAFF.FirstName, STAFF.Surname, ROLE.PayGrade FROM STAFF INNER JOIN ROLE ON STAFF.RoleID = ROLE.RoleID WHERE STAFF.Surname = 'Waters' AND ROLE.PayGrade = 17;

Mentor tip

Include the projection columns, the table join on RoleID, and both filtering conditions.

(e)

2 marks

Whole-number domain and compact storage: Pay grades are discrete whole numbers (e.g., 17), which require minimal memory when stored as binary integers.
Sorting and numerical comparisons: Integer representation allows direct numerical ordering (`ORDER BY PayGrade`) and range comparisons (`> `, `<`).

Mentor tip

Highlight that pay grades are whole numbers and integers enable numerical sorting/comparisons with low storage overhead.

(f)

6 marks

Method 1 - Role-Based Access Control (RBAC) and Database Views:
- Mechanism: The DBA assigns granular access permissions and constructs restricted SQL views that expose only non-sensitive attributes.
- Hospital application: A department manager can view staff names and schedules within their unit while being blocked from viewing confidential `PayGrade` or `DateOfBirth` columns.
Method 2 - Column-level / At-rest Encryption:
- Mechanism: Sensitive database fields are encrypted using cryptographic keys before being written to disk, converting plaintext into unreadable ciphertext.
- Hospital application: Even if unauthorized personnel or attackers gain physical access to storage media, personal staff records remain indecipherable without the decryption key.

Mentor tip

Provide two distinct methods (e.g., access control/views and encryption), explaining the mechanism and a concrete hospital staff example for each.

Question 2

15 marks

Conceptual vs logical schemas, DDL, data modelling, validation vs verification, and ACID integrity

Databases

(a)

2 marks

Conceptual schema ('what' model): A high-level, technology-independent abstraction that identifies core business entities and their broad relationships without implementation details.
Logical schema ('how' model): A detailed structural blueprint derived from the conceptual schema that specifies exact table structures, attribute names, data types, primary keys, and foreign keys.

Mentor tip

Contrast the high-level entity overview of a conceptual schema with the detailed attributes and keys of a logical schema.

(b)

2 marks

Physical schema instantiation: A Data Definition Language (DDL) translates the logical data model into physical database structures by defining tables, field data types, and key constraints.
Concrete command usage: Statements such as `CREATE TABLE`, `ALTER TABLE`, and `DROP TABLE` formally build and modify the relational schema.

Mentor tip

Explain that DDL defines the database schema structures and cite commands like CREATE TABLE or ALTER TABLE.

(c)

4 marks

Reason 1 - Eliminating redundancy and anomalies via normalization: Modelling identifies entities, attributes, and functional dependencies early, preventing data duplication, update anomalies, and wasted storage.
Reason 2 - Ensuring stakeholder alignment and query support: Visualizes table relationships and key links for analysts and programmers, ensuring the resulting database supports all required multi-table queries.

Mentor tip

Focus on avoiding data redundancy/anomalies and verifying that entities and relationships meet system requirements.

(d)

3 marks

Data validation: An automated rule check ensuring entered data is sensible, formatted properly, and within allowable boundaries (e.g., ensuring `DateOfBirth` is a valid past calendar date).
Data verification: Confirming via double-entry or visual proofreading that the input matches the original source document (e.g., checking that a patient's surname 'Waters' was not mistyped as 'Walters').
Synergy for correctness: Validation catches impossible values automatically, while verification catches human transcription errors that still pass syntax rules.

Mentor tip

Define both terms clearly and explain how combining them catches both out-of-range values and human typos.

(e)

2 marks

Atomicity and rollback: The DBMS treats a transaction as an 'all-or-nothing' unit; if any step fails, all uncommitted modifications are rolled back using the transaction log.
Isolation via locking: Concurrency locks prevent simultaneous transactions from reading or overwriting intermediate uncommitted states, avoiding lost updates and dirty reads.

Mentor tip

Reference ACID mechanisms: atomic rollback on failure and isolation locking during concurrent execution.

(f)

2 marks

Foreign-to-primary key enforcement: Referential integrity ensures every foreign key value in a child table matches an existing primary key in the parent table.
Cascading updates and orphan prevention: Automatically blocks the deletion of referenced parent records (or cascades updates/deletes), preventing dangling orphan records.

Mentor tip

Explain foreign key matching and preventing orphan records via cascading rules.

Question 3

12 marks

Derived age attributes, 1NF vs 2NF normalization, and 3NF patient appointment schema

Databases

(a)(i)

2 marks

Dynamic accuracy: Because `Age` changes over time, calculating it on the fly from `DateOfBirth` guarantees the value is always current without running daily batch updates.
Storage efficiency: Avoids storing redundant data on disk that can already be computed from existing fields.

Mentor tip

Mention both saving storage space and keeping time-sensitive values like age automatically up to date.

(a)(ii)

2 marks

Retrieve `DateOfBirth` from the `PATIENT` table.
Subtract the birth year/date from the current system date: e.g., `TIMESTAMPDIFF(YEAR, DateOfBirth, CURDATE())` or `YEAR(CurrentDate) - YEAR(DateOfBirth)`.

Mentor tip

Specify fetching DateOfBirth and subtracting it from the current system date.

(b)

2 marks

First Normal Form (1NF): Requires that all attributes contain only atomic (indivisible) values, eliminating repeating groups, with each record uniquely identified by a primary key.
Second Normal Form (2NF): Requires the relation to already be in 1NF and eliminates partial dependencies, ensuring every non-key attribute depends on the entire composite primary key.

Mentor tip

Contrast atomic values/no repeating groups in 1NF with full functional dependency on composite keys in 2NF.

(c)

6 marks

Decompose the appointment view into 3NF relations with underlined primary keys and asterisked foreign keys:
1. `PATIENT(PatientID, FirstName, Surname, PreferredName, DateOfBirth)` — PK: `PatientID`
2. `DEPARTMENT(DepartmentID, DepartmentName, Building, Room)` — PK: `DepartmentID`
3. `DOCTOR(DoctorID, DoctorFirstName, DoctorSurname, DepartmentID*)` — PK: `DoctorID`, FK: `DepartmentID`
4. `APPOINTMENT(AppointmentID, PatientID*, DoctorID*, AppDate, AppTime)` — PK: `AppointmentID` (or composite `(PatientID*, DoctorID*, AppDate, AppTime)`), FKs: `PatientID`, `DoctorID`

Mentor tip

Separate PATIENT, DOCTOR, DEPARTMENT, and APPOINTMENT into distinct tables linked by foreign keys so no transitive dependencies remain.

Option B: Modelling and simulation · Option

Questions 4–6 · 45 marks

Question 4

21 marks

Climate data spreadsheet graphing, sampling intervals, parallel arrays, and statistical pseudocode

Modelling and simulation

(a)

1 mark

Variables required: `DailyMaxTemperature` (or sum of daily maximum temperatures) and `NumberOfDays` (count of days in the period).

Mentor tip

State both the temperature readings/total and the number of days recorded.

(b)

3 marks

Step 1: Highlight the spreadsheet cell ranges containing the `Year` column (1970–2020) and the corresponding `Mean Daily Maximum Temperature` column.
Step 2: Insert a 2D Line Chart (with markers and a linear trendline).
Step 3: Configure chart labels by setting the horizontal x-axis title to `Year`, the vertical y-axis title to `Temperature (°C)` (scaled from 27 to 30), and adding the chart heading.

Mentor tip

Detail selecting the data columns, choosing a line chart, and labeling both axes properly.

(c)

2 marks

Visual trend recognition: Allows researchers and policymakers to immediately see the upward long-term warming trajectory across the 50-year span.
Rapid anomaly and cross-regional comparison: Makes it easier to spot outlier years and compare Nauru's warming rate against charts from other regions.

Mentor tip

Highlight easy visual identification of long-term warming trends and simpler comprehension than raw tables.

(d)

2 marks

Storage and processing efficiency: Hourly sampling generates only 24 readings per day instead of 1,440 minute-by-minute readings (a 60-fold reduction in storage and processing overhead).
Negligible ambient variance: Atmospheric temperature changes slowly over 60 seconds, so per-minute logging adds noise without improving climate study accuracy.

Mentor tip

Compare 24 vs 1,440 daily records and note that temperature barely fluctuates from minute to minute.

(e)

5 marks

Step 1: Declare two 1D arrays of size 24: `TIME` (string/time format) and `TEMP` (floating-point numbers).
Step 2: Populate the `TIME` array sequentially with hourly timestamps from `00:00` at index 0 through `23:00` at index 23.
Step 3: Initialize an index counter variable (e.g., `hourIndex`) from 0 to 23 to iterate 24 times.
Step 4: At each hourly interval `hourIndex`, read the automated sensor temperature and store it into `TEMP[hourIndex]`.
Step 5: Because both arrays share the exact same index `hourIndex`, any temperature `TEMP[k]` corresponds directly to timestamp `TIME[k]`.

Mentor tip

Describe creating two 24-element arrays (TIME and TEMP) and using a shared loop index from 0 to 23 to link each reading to its hour.

(f)

8 marks

Construct the pseudocode algorithm to compute daily max, min, overall mean, and night-time mean:
totalTemp = 0
nightTotal = 0
minTemp = TEMP[0]
maxTemp = TEMP[0]
loop i from 0 to 23
current = TEMP[i]
totalTemp = totalTemp + current
if current < minTemp then
minTemp = current
end if
if current > maxTemp then
maxTemp = current
end if
if TIME[i] >= "19:00" OR TIME[i] <= "06:59" then
nightTotal = nightTotal + current
end if
end loop
meanTemp = totalTemp / 24
meanNightTemp = nightTotal / 12
output "Max: ", maxTemp, " Min: ", minTemp
output "Mean: ", meanTemp, " Night Mean: ", meanNightTemp

Mean_{24h} = \frac{\sum _{i = 0}^{23} TEMP [ i ]}{24}, Mean_{night} = \frac{\sum _{night} TEMP [ i ]}{12}

Mentor tip

Initialize minTemp and maxTemp to TEMP[0] (or extreme bounds), check the night-time window (19:00 to 06:59), and divide totals by 24 and 12 outside the loop.

Question 5

16 marks

Climate models vs simulations, rule extraction, historical test validation, and policy decision-making

Modelling and simulation

(a)

2 marks

Model: A static mathematical or logical abstraction representing the variables and relationships of a real-world system (such as equations linking temperature to thermal ocean expansion).
Simulation: The dynamic execution of that model over time on a computer to observe how the system behaves under changing conditions.

Mentor tip

Define a model as the static mathematical abstraction and a simulation as running that model over time.

(b)

3 marks

Step 1 - Empirical correlation analysis: Collate historical pairs of annual mean temperature and mean sea level data to identify statistical correlations and rates of change.
Step 2 - Mathematical rule formulation: Derive mathematical formulas or conditional thresholds (e.g., how many millimetres sea level rises per $0. 1^{\circ} C$ warming and at what tide height coastal flooding triggers).
Step 3 - Verification against observed records: Test the proposed rules against historical flood logs to confirm they reproduce past events before coding them into the simulation.

Mentor tip

Explain analyzing historical data correlations, formulating mathematical relationships, and verifying rules against actual data.

(c)

6 marks

Validation procedure using test cases:
- Select clean historical baseline data (e.g., 1994–2005 temperature records) free from unmodeled external anomalies like volcanic tsunamis.
- Input these test cases into the simulation to generate predicted sea levels and flood frequencies for 2006–2015.
- Compare simulated predictions against actual recorded tide-gauge measurements from Nauru over that same period.
- Iteratively refine model weights and equations whenever discrepancies exceed tolerable error tolerances.
Evaluative conclusion: Historical test cases effectively calibrate baseline accuracy, though they cannot fully guarantee validity under unprecedented future climate tipping points.

Mentor tip

Detail running historical inputs, comparing predicted vs observed outputs, refining equations, and evaluating the limits of historical testing.

(d)

5 marks

Advantages for coastal decision-making:
- Safe, low-cost 'what-if' exploration: Policymakers can test sea-wall construction or relocation zones across multiple warming scenarios without waiting decades.
- Visual communication: Generates clear flood maps that help secure international climate aid and inform local zoning.
Disadvantages and limitations:
- Oversimplification of complex variables: Models focusing only on temperature and sea level omit king tides, storm surges, coral reef erosion, and socio-cultural attachment to ancestral land.
- Risk of flawed capital allocation: Inaccurate assumptions can cause governments to under-prepare for catastrophic inundation or waste scarce aid on misdirected defenses.
Conclusion: Simulations are indispensable planning aids for Pacific islands, provided their outputs are combined with local geological and socio-economic expertise.

Mentor tip

Balance cost-effective scenario forecasting against model oversimplification and omission of socio-cultural/local factors.

Question 6

8 marks

Geographic flood visualization, mathematical memory representations, and 3D animation constraints

Modelling and simulation

(a)

1 mark

Visualization is the graphical representation of numerical or abstract data to help users interpret patterns, trends, and spatial impacts.

Mentor tip

Define visualization concisely as representing data in a graphical or visual form.

(b)

2 marks

Mathematical wireframe representation: In memory, a 3D scene is stored as a mathematical model of 3D coordinates (vertices, polygons, elevation meshes, and surface textures).
Rendering transformation: The graphics pipeline renders these stored mathematical structures into 2D raster image frames for display as a 3D visualization.

Mentor tip

Explain that 3D models are stored mathematically in memory and rendered into visual frames.

(c)

5 marks

Time considerations:
- High computational rendering latency: Calculating dynamic water physics, lighting reflections, and terrain inundation across thousands of sequential frames requires intensive CPU/GPU processing time.
- Development complexity: Programming accurate 3D topographical meshes of Nauru takes significantly longer than creating static 2D maps.
Memory considerations:
- Substantial RAM and VRAM demands: Storing high-resolution terrain textures, multi-layered elevation grids, z-buffers, and sequential animation frames consumes gigabytes of fast primary and GPU memory.
- Secondary storage swapping penalties: If primary RAM is exceeded, paging data to slower secondary storage causes severe frame rate drops and rendering stutter.
Conclusion: Producing smooth 3D flood animations requires dedicated GPU hardware and ample high-speed VRAM to balance rendering time against visual fidelity.

Mentor tip

Address both time (rendering calculations, development effort) and memory (RAM/VRAM for textures/layers, secondary storage bottlenecks), ending with a conclusion.

Option C: Web science · Option

Questions 7–9 · 45 marks

Question 7

9 marks

Internet vs World Wide Web, URL structure, FTP dual connections, and browser operation

Web science

(a)

2 marks

The Internet: The global physical and logical network infrastructure of interconnected routers, servers, and client devices communicating via TCP/IP.
The World Wide Web (WWW): A software information service running on top of the Internet infrastructure that links hypertext documents and multimedia accessed via HTTP/HTTPS and web browsers.

Mentor tip

Distinguish the physical/IP hardware network (Internet) from the HTTP hypertext document service running over it (Web).

(b)

2 marks

Characteristic 1 - Protocol scheme: Specifies the application-layer transfer protocol used to fetch the resource (`https`).
Characteristic 2 - Domain/Host and file path: Identifies the specific web server host (`www.bbc.co.uk`) and the hierarchical directory path to the exact file (`/bytesize/index.htm`).

Mentor tip

Identify two structural components from the given URL: protocol (https), host/domain (www.bbc.co.uk), or file path (/bytesize/index.htm).

(c)

2 marks

Characteristic 1 - Dual TCP connections: Establishes two separate connections between client and server—one control connection (port 21) for commands/authentication and one data connection (port 20) for file contents.
Characteristic 2 - Client-server bulk transfer: Designed specifically for reliable uploading and downloading of complete files over TCP.

Mentor tip

Highlight the separation into two channels: a control connection (port 21) and a data transfer connection (port 20).

(d)

3 marks

DNS resolution and HTTP request: The browser resolves the URL's domain name into an IP address via a DNS server and transmits an HTTP/HTTPS request packet to the web server.
Resource retrieval and security verification: Receives the server's HTTP response containing HTML, CSS, JavaScript, and media, while verifying TLS/SSL certificates for encrypted HTTPS sessions.
Parsing and rendering: The browser's rendering engine parses the HTML/CSS markup and executes client-side scripts to display the formatted, interactive webpage.

Mentor tip

Mention DNS lookup + HTTP/HTTPS request/response, and parsing/rendering the returned HTML markup.

Question 8

20 marks

Search engine indexing, Black Hat SEO, Surface vs Deep Web, and PHP file upload processing

Web science

(a)

1 mark

A search engine is a software system that searches an index of web pages to retrieve and rank documents matching user-specified keywords and filters.

Mentor tip

Define as a software system that queries an indexed database of web resources based on user keywords.

(b)

2 marks

Seed traversal: An automated spider/bot starts from a list of known seed URLs, fetches page content, and extracts all outgoing hyperlinks to visit subsequent pages recursively.
Index updating and robots compliance: Parses titles, meta tags, and body text to update the search engine's index while respecting exclusions specified in `robots.txt`.

Mentor tip

Describe starting at seed URLs, following hyperlinks recursively, and copying content/keywords into the index.

(c)

2 marks

Relevance mapping: Crawlers extract keywords from `<title>`, `<meta>` tags, headings, and body text to categorize the topic of each webpage in the inverted index.
Ranking frequency calculation: The frequency and placement of keywords help the ranking algorithm match user queries to the most relevant indexed pages.

Mentor tip

Explain that keywords in meta tags and body text allow the indexer to categorize pages and rank query relevance.

(d)

6 marks

Black Hat SEO definition and techniques: Manipulating search engine algorithms against guidelines using keyword stuffing, invisible text, cloaking (showing different content to crawlers vs users), and paid link farms.
Short-term advantages:
- Rapidly inflates search engine rankings, driving an immediate spike in web traffic, ad impressions, and short-term sales revenue.
Long-term disadvantages and risks:
- Search engine detection algorithms penalize or permanently blacklist offending domains, wiping out organic visibility.
- Deceptive redirects or spammy content severely damage brand reputation and customer trust.
Conclusion: Legitimate organizations should reject black hat SEO; the severe risk of domain delisting and reputational harm far outweighs temporary traffic gains.

Mentor tip

Name specific black hat techniques (cloaking, keyword stuffing, link farms), weigh short-term traffic spikes against delisting/reputation loss, and give a clear conclusion.

(e)

2 marks

Surface Web: The portion of the World Wide Web consisting of static and publicly linked pages that are indexed by standard search engine crawlers.
Deep Web: Web content that is not indexed by conventional search engines, such as password-protected portals, academic databases, and dynamically generated query pages.

Mentor tip

Focus on search engine indexing: the surface web is indexed by standard crawlers, whereas the deep web (databases, authenticated pages) is not indexed.

(f)

4 marks

Step 1 - Upload detection and metadata extraction: Checks if a file `CV` was submitted via `POST` (`isset($_FILES['CV'])`) and extracts its name, byte size, temporary path, and lowercase file extension.
Step 2 - Extension validation: Checks whether the extracted extension is in the permitted list (`pdf`, `doc`, `docx`); if not, appends an extension error message to `$errors`.
Step 3 - File size validation: Checks whether ` $f i l e_{s} i z e > 2097152‘ (2 M B); i f e x cee d e d, a pp e n d s a s i z eer r or m ess a g e t o ‘$ errors`.
Step 4 - Conditional storage or error output: If ` $er r or s ‘ i se m pt y, m o v es t h e f i l e f r o m t e m p or a r y s t or a g e t o t h e ‘ C V /‘ d i r ec t or y an d o u tp u t s ‘" S u ccess "‘; o t h er w i se p r in t s t h eco n t e n t so f ‘$ errors`.

Mentor tip

Trace the four stages in code: extracting file attributes, checking extension, checking 2MB size limit, and moving the file or printing errors.

(g)

3 marks

Server-side execution concept: The PHP script executes entirely on the web server before sending only the resulting HTML output to the client browser.
Security of validation and file storage: Enforcing file size and extension checks on the server prevents malicious users from bypassing client-side JavaScript validation to upload executable malware.
Hardware independence and source protection: Guarantees consistent execution regardless of the client device's hardware capabilities while keeping proprietary backend logic hidden from end-users.

Mentor tip

Emphasize that server execution protects validation logic/files from client tampering and ensures consistent performance across client devices.

Question 9

16 marks

Lossless compression, open standards, decentralized web privacy, and global SaaS scalability

Web science

(a)

2 marks

Exact bitstream reconstruction: Lossless compression reduces file size without discarding any original data, allowing the exact bit-for-bit media file to be restored upon decompression.
Statistical redundancy encoding: Replaces repeating pixel patterns or common byte sequences with shorter tokens (using algorithms such as Run-Length Encoding or Huffman coding).

Mentor tip

Explain that no data is permanently discarded and repeating patterns are encoded with shorter tokens.

(b)

2 marks

Characteristic 1 - Publicly available and royalty-free: Technical specifications are openly documented and accessible for anyone to implement without proprietary licensing restrictions.
Characteristic 2 - Cross-platform interoperability: Collaboratively maintained by standards bodies to ensure media plays seamlessly across diverse operating systems and browsers.

Mentor tip

Mention open public access without proprietary ownership and cross-platform interoperability.

(c)

6 marks

Decentralized web architecture: Distributes data storage and operation across peer-to-peer (P2P) nodes or blockchains rather than centralized corporate servers.
Positive impacts on individual privacy:
- Eliminates corporate intermediaries: Users retain direct ownership and cryptographic control over their personal data, preventing tech monopolies from harvesting profiles for targeted surveillance advertising.
Negative impacts and 'Right to be Forgotten' challenges:
- Immutability and lack of central authority: Once private or defamatory information is replicated across hundreds of independent international peer nodes, there is no central administrator to enforce deletion requests.
- Inconsistent node security: Data replicated onto poorly secured peer nodes increases the attack surface for unauthorized leaks.
Conclusion: While decentralization empowers users against corporate surveillance, it severely undermines statutory privacy protections like the 'right to be forgotten' because permanently erasing distributed data is practically impossible.

Mentor tip

Contrast user control/freedom from corporate surveillance against the impossibility of enforcing the 'right to be forgotten' across peer-to-peer nodes.

(d)

6 marks

Factor 1 - Cloud Infrastructure and SaaS Delivery (Economic Efficiency):
- By hosting software on scalable cloud infrastructure (IaaS/PaaS) and delivering it via web browsers, Xero eliminates physical packaging, shipping, and local installation costs, lowering barriers for SMEs worldwide.
Factor 2 - Ubiquitous Broadband and Mobile Connectivity (Global Accessibility):
- Widespread high-speed internet and standardized web protocols allow customers in any time zone to access real-time accounting data 24/7 from any device.
Factor 3 - Digital Ecosystems, APIs, and Online Marketing:
- Search engine optimization (SEO), targeted digital advertising, online subscription payment gateways, and multi-currency bank APIs enable a small New Zealand firm to acquire, bill, and support international clients seamlessly.

Mentor tip

Cover three dimensions: cloud SaaS delivery (no physical distribution), 24/7 browser accessibility, and digital payment/API/marketing ecosystems.

Option D: Object-oriented programming · Option

Questions 10–12 · 45 marks

Question 10

17 marks

Healthcare product OOP model, encapsulation, UML diagrams, constructors, and language features

Object-oriented programming

(a)(i)

1 mark

`private` is an access modifier that restricts an attribute or method so it can only be accessed directly by code within the same class.

Mentor tip

State that private restricts direct visibility strictly to the declaring class.

(a)(ii)

1 mark

An accessor (getter) method is a public method that reads and returns the value of a private instance variable to external classes.

Mentor tip

Define an accessor as a method that returns the value of a private attribute.

(a)(iii)

2 marks

Construct the getter method in `Product`:
public String getProdDescription() {
return this.prodDescription;
}

Mentor tip

Ensure the return type is String and it returns prodDescription.

(b)(i)

3 marks

Construct a 3-compartment UML class box for `Product`:
Top compartment (Class Name): `Product`
Middle compartment (Private Attributes with `-` visibility):
- `- prodCode : String`
- `- prodType : String`
- `- prodDescription : String`
- `- prodBrand : Brand`
- `- prodSale : int`
Bottom compartment (Public Methods with `+` visibility):
- `+ Product(...)`
- `+ getProdSale() : int`
- `+ getProdBrand() : Brand`

Mentor tip

Include three compartments, '-' for private attributes with types, and '+' for public methods with return types.

(b)(ii)

3 marks

Construct the parameterized constructor for `Product`:
public Product(String prodCode, String prodType, String prodDescription, Brand prodBrand, int prodSale) {
this.prodCode = prodCode;
this.prodType = prodType;
this.prodDescription = prodDescription;
this.prodBrand = prodBrand;
this.prodSale = prodSale;
}

Mentor tip

Use the exact class name Product with no return type and initialize all five attributes.

(c)(i)

3 marks

Instantiate the `Brand` object:
Brand b = new Brand("Safesun", 2.17f);

Mentor tip

Declare a Brand reference variable, use the 'new' keyword, and pass "Safesun" and 2.17f.

(c)(ii)

2 marks

Class: A static blueprint or template that defines the structure of attributes and behaviors (methods) shared by all objects of that type.
Instance: A concrete object allocated in memory at runtime constructed from the class blueprint, holding its own specific attribute values.

Mentor tip

Contrast the abstract blueprint/template (class) with the concrete memory-allocated object holding specific values (instance).

(d)

2 marks

Feature 1: Native Unicode support (enabling internationalization across global character sets).
Feature 2: Built-in exception handling / Automatic garbage collection / Strong type checking / Rich standard class libraries.

Mentor tip

Name language-level features (e.g., Unicode support, exception handling, standard libraries) rather than IDE features like autocomplete.

Question 11

9 marks

Primitive data types and descending Selection Sort on object arrays

Object-oriented programming

(a)(i)

1 mark

Mentor tip

Define as a basic built-in language type that stores raw values directly in memory.

(a)(ii)

2 marks

Memory and CPU efficiency: Primitive types like `int` occupy a fixed, compact memory footprint (4 bytes) on the stack without object header or pointer overhead.
Direct hardware arithmetic: Processed directly in CPU registers, making arithmetic calculations and comparisons significantly faster than wrapper objects.

Mentor tip

Highlight compact memory usage (no object overhead) and faster direct CPU processing.

(b)

6 marks

Construct `sortProducts()` using Selection Sort to order `allProducts` in descending order of `prodSale`:
public void sortProducts() {
int n = allProducts.length;
for (int i = 0; i < n - 1; i++) {
int maxIndex = i;
for (int j = i + 1; j < n; j++) {
if (allProducts[j].getProdSale() > allProducts[maxIndex].getProdSale()) {
maxIndex = j;
}
}
Product temp = allProducts[maxIndex];
allProducts[maxIndex] = allProducts[i];
allProducts[i] = temp;
}
}

Mentor tip

Use getProdSale() to compare sales, track maxIndex in the inner loop, and swap entire Product object references.

Question 12

19 marks

OOP principles evaluation, Invoice array management, chained object pricing, and modularity

Object-oriented programming

(a)(i)

2 marks

Code reusability and extensibility: Polymorphism allows a single method interface or superclass reference to operate seamlessly on objects of different subclasses.
Simplified control flow: Eliminates complex `if-else` type-checking chains because the appropriate overridden method is resolved dynamically at runtime.

Mentor tip

Explain how a common interface/method works across diverse subclasses, improving extensibility.

(a)(ii)

2 marks

Data protection and validation: Declaring attributes `private` shields internal object state from accidental corruption by external code.
Controlled mutator access: Changes must pass through public setter methods where validation rules can enforce state consistency.

Mentor tip

Highlight hiding internal state from outside interference and enforcing validation via getters/setters.

(a)(iii)

2 marks

Tight coupling (fragile base class problem): Subclasses are tightly coupled to their superclass implementation.
Cascading maintenance risk: Modifying attributes or logic in the parent class can unintentionally break dependent child classes across deep hierarchies.

Mentor tip

Explain tight coupling between parent and child classes, where parent modifications risk breaking subclasses.

(b)

2 marks

Private attribute bundling: `Invoice` declares its state variables (`invoiceID`, `products`, `prodQuantity`, `qualifiesForDiscount`, `numOfProducts`) as `private`, blocking external classes from altering them directly.
Controlled public interface: External interaction is restricted to public methods such as `getInvoiceID()`, `addProduct()`, and `setQualifiesForDiscount()`.

Mentor tip

Reference the specific private variables in Invoice and its public methods like getInvoiceID().

(c)

3 marks

Construct `addProduct(Product product, int quantity)` using `numOfProducts` as the next available index:
public void addProduct(Product product, int quantity) {
products[numOfProducts] = product;
prodQuantity[numOfProducts] = quantity;
numOfProducts++;
}

Mentor tip

Insert both product and quantity at index [numOfProducts], then increment numOfProducts by 1.

(d)

6 marks

Construct `setQualifiesForDiscount()` by iterating up to `numOfProducts` and chaining `getProdBrand().getBrandPrice()`:
public void setQualifiesForDiscount() {
float totalValue = 0.0f;
for (int i = 0; i < numOfProducts; i++) {
float unitPrice = products[i].getProdBrand().getBrandPrice();
totalValue += unitPrice * prodQuantity[i];
}
if (totalValue > 3000) {
qualifiesForDiscount = true;
}
}

Mentor tip

Access each product's price via products[i].getProdBrand().getBrandPrice(), multiply by prodQuantity[i], and check if totalValue > 3000.

(e)

2 marks

Mentor tip

Explain how smaller independent modules enable parallel team development or isolated debugging.

Our analysis

Where the marks are

Each part sorted by the topic it mostly tests. Databases carries the most marks on this paper.

Databases45 marks · 25%
Q1, Q2, Q3
Modelling and simulation45 marks · 25%
Q4, Q5, Q6
Web science45 marks · 25%
Q7, Q8, Q9
Object-oriented programming45 marks · 25%
Q10, Q11, Q12

Mentor insights

Traps to watch for

01
Omitting the join condition when querying across STAFF and ROLE · Q1
Selecting FirstName, Surname, and PayGrade without joining STAFF.RoleID = ROLE.RoleID produces a Cartesian product rather than matching each employee to their actual pay grade.
02
Using AND instead of OR for overnight time window filtering · Q4
Night-time spans 19:00 to 06:59 across midnight. Writing TIME[i] >= '19:00' AND TIME[i] <= '06:59' is logically impossible for a single timestamp; use OR (or check outside 07:00 to 18:59) and divide the night total by 12 rather than 24.
03
Swapping sales integers instead of Product object references · Q11
In sortProducts(), swapping only the prodSale values corrupts the objects; the temporary variable must be of type Product to swap allProducts[maxIndex] and allProducts[i].
04
Forgetting object navigation chaining for brandPrice · Q12
The Product class does not have a direct getPrice() method; you must navigate through the associated Brand object using products[i].getProdBrand().getBrandPrice().

Solutions and tips are GeorgeTheTutor's own; the questions are not reproduced here. Not affiliated with or endorsed by the International Baccalaureate Organization.

Want someone to go through your paper with you?

Our maths mentors took these exams recently. One-to-one, they'll find where your marks are going and fix it before May.

Find your maths mentor More past papers