Question Bank · Chapter I (2016–2026)

⬆️ Back to: P-I.I. Introduction to Computing

🧭

Page Outline — every Introduction-to-Computing question from CSS 2016–2026 (40 written parts + 15 MCQs), each linked to the topic page that holds its model answer. No subpages.

1. Written questions (year-wise)

2. MCQs (2024–2026)

3. Asked in the same Section-A slot but belonging to other chapters

• These sat next to Introduction-to-Computing questions in the paper, but their content is from later chapters. Revise them there.

• Lesson: Q2 of Section-A is a mixed bag. Revise the OS and COA basics alongside this chapter.

4. Improved model answers — marks-wise revision edition

These answers supplement the original question index. Each response is scaled to the paper's allotted marks; calculations and scenarios show the essential working. For a 6-mark response, favour a brief introduction and six substantive points rather than an oversized essay.

CSS 2016

Q2(b) — Suitable computer for an individual (6 marks)

Quick revision — key points

• Microcomputer is suitable for one person
• Affordable, compact and easy to maintain
• Adequate for office work, study and programming
• Supercomputers/mainframes serve specialised or large-scale needs

Exam-ready answer — structured

Direct answer / introduction

Answer: A microcomputer, such as a desktop or laptop, is the suitable choice.

Explanation — key points

• A microcomputer is a relatively compact, affordable computer built around a microprocessor and designed for personal use.
• It provides sufficient processing power for documents, browsing, programming, video calls and entertainment.
• Its hardware, software and maintenance costs are comparatively low; it is easy to operate and can be upgraded for specific needs. A supercomputer is built for massive scientific calculations, a mainframe supports large-scale organisational transactions, and the traditional minicomputer serves multiple users.
• None is a cost-effective personal substitute.
• Conclusion: select a microcomputer, then tailor its processor, RAM and storage to the individual's workload.

Q3(b) — Volatile and non-volatile memory (6 marks)

Quick revision — key points

• Volatile loses contents without power; non-volatile retains them
• RAM/cache versus SSD/HDD/ROM
• Active processing versus persistent storage
• Give a document-loading example

Exam-ready answer — structured

Direct answer / introduction

Volatile memory loses its stored information when electrical power is removed; non-volatile memory retains it without continuous power.

Explanation — key points

• RAM and CPU cache are volatile, whereas ROM, flash memory, SSDs and hard drives are non-volatile.
• RAM provides rapid, temporary access to active programs and data; SSDs and HDDs store the operating system and files persistently.
• Volatile and non-volatile are categories of data retention, not synonyms for fast and slow or for primary and secondary storage.
• For example, on opening a document, the operating system loads its data from an SSD into RAM; after saving, the updated file remains on the SSD even when the machine is switched off.

Q4(b) — Binary to decimal, octal and hexadecimal (6 marks)

Quick revision — key points

• Binary-to-decimal: sum powers of 2
• Binary-to-octal: group 3 bits from right
• Binary-to-hex: group 4 bits from right
• Show each given number's full working

Exam-ready answer — structured

Explanation — key points

• Decimal: Add the place values of set bits, using powers of 2.
• Octal: Group binary bits into sets of three from the right, padding the left with zeros if necessary.
• Hexadecimal: Group bits into sets of four from the right; hexadecimal uses A–F for 10–15.

Q2(a) — Technical control of cybercrime without sacrificing privacy (8 marks)

Quick revision — key points

• Control crime through MFA, encryption and network defence
• Use CERT, digital forensics and secure logging
• Respect privacy through minimisation and targeted access
• Oversight, legality and education complete the response

Exam-ready answer — structured

Direct answer / introduction

Cybercrime includes phishing, unauthorised access, ransomware, fraud and identity theft.

Explanation — key points

• Governments should reduce criminal opportunity while protecting lawful communication and personal data.
• First, enforce strong authentication, especially multifactor authentication, on sensitive systems.
• Second, encrypt data in transit and at rest, while keeping encryption keys secure.
• Third, deploy firewalls, intrusion detection/prevention systems and centrally managed endpoint protection.
• Fourth, establish CERT/CSIRT incident-response arrangements and prompt vulnerability reporting.
• Fifth, use narrowly scoped forensic investigation, audit trails and court-authorised access rather than indiscriminate surveillance.
• Sixth, promote secure software development, patching, backups and user awareness.
• Seventh, adopt data minimisation, access controls, retention limits and independent oversight.
• In Pakistan, PECA 2016 forms part of the statutory cybercrime framework, but investigatory powers must be exercised subject to applicable safeguards.
• Judgement: security is strongest when targeted technical protection is paired with due process, transparency and proportionality.

Q2(b) — Harvard versus Von Neumann architecture (6 marks)

Quick revision — key points

• Von Neumann shares instruction/data path and address space
• Harvard separates instruction/data pathways
• Compare simultaneous access, cost and bottleneck
• Modern processors often use modified Harvard caches

Exam-ready answer — structured

Direct answer / introduction

Von Neumann: instructions and data occupy a common address space and commonly share the same memory path.

Explanation — key points

• It is flexible and easier to program, but competing instruction fetches and data transfers can produce the Von Neumann bottleneck.
• Harvard: instructions and data use separate memories and access paths; the processor can fetch an instruction and access data concurrently, improving predictable throughput.
• Harvard designs may require more hardware and complicate moving data between the two memory spaces.
• Application: classic Harvard systems are common in small embedded controllers and DSPs; general-purpose computers present a largely unified programming address space.
• Nuance: many modern processors use modified Harvard L1 instruction and data caches while maintaining a unified address space in main memory.

Q3(a) — Machine, assembly and high-level languages; translation (8 marks)

Quick revision — key points

• Machine code executes directly
• Assembly mnemonics require an assembler
• High-level source requires compilation or runtime execution
• Explain phases, linker and loader with a translation flow

Exam-ready answer — structured

Direct answer / introduction

Machine language consists of the processor's directly executable binary instructions.

Explanation — key points

• It is hardware-specific and difficult for humans to read.
• Assembly language represents those instructions through mnemonics such as MOV and ADD; an assembler translates assembly into object/machine code.
• High-level languages such as C, C++ and Python provide abstractions, readable constructs and libraries, improving productivity and portability. A compiler analyses high-level source code (lexical, syntactic and semantic analysis), optimises where applicable, and generates target code; an assembler may process generated assembly before linking produces an executable.
• An interpreter executes source or an intermediate representation through a runtime rather than necessarily creating a stand-alone native executable.
• Pipeline: high-level source → compiler → object files → linker → executable → CPU; alternatively assembly source → assembler → object code.
• Cross-compilation means producing binaries for a different target machine or environment.

Q8(b) — Protecting intellectual property online (5 marks)

Quick revision — key points

• Define copyright, patents, trademarks and trade secrets
• Identify piracy, copying and code theft
• Use clear licences, access controls and lawful enforcement
• Balance rights with permitted use

Exam-ready answer — structured

Direct answer / introduction

Intellectual property law protects particular forms of human creativity and commercial identity: copyright for original expression such as software source code; patents for qualifying inventions; trademarks for identifying brands; and trade secrets for confidential business knowledge.

Explanation — key points

• In the digital domain, infringement may take the form of unauthorised copying, software piracy, source-code theft or redistribution of licensed media.
• Practical measures include clear licensing and attribution, access controls, watermarking or DRM where appropriate, repository access restrictions, evidence preservation and lawful takedown/enforcement procedures.
• In Pakistan, relevant instruments include copyright legislation and intellectual-property institutions.
• Balance: enforcement should protect creators without unnecessarily restricting lawful use, research or open-source collaboration.

Q2(a) — TCP/IP layers (4 marks)

Quick revision — key points

• Four-layer TCP/IP: Application
• Transport: TCP/UDP
• Internet: IP routing
• Network Access: Ethernet/Wi-Fi

Exam-ready answer — structured

Direct answer / introduction

The conventional four-layer TCP/IP model comprises: Application (HTTP, DNS), Transport (TCP, UDP), Internet (IP, ICMP) and Network Access/Link (Ethernet, Wi-Fi).

Explanation — key points

• A message moves down these layers before transmission and up the receiving system's stack.
• Some textbooks divide link responsibilities into two layers and teach a five-layer Internet model; state the four-layer model when the question specifically says TCP/IP stack.

Q2(b) — Preservation of digital evidence (4 marks)

Quick revision — key points

• Secure, record and photograph the crime scene
• Assess volatile evidence before powering down
• Image storage, hash it and use write blockers
• Document chain of custody; give device examples

Exam-ready answer — structured

Direct answer / introduction

First secure the scene, document device condition, visible screens and connected peripherals, and prevent unauthorised access.

Explanation — key points

• If a powered-on system contains volatile evidence, a trained examiner should assess live collection before shutdown; otherwise preserve it in the least altering manner.
• Create a forensic bit-for-bit image of storage media using write-blocking where applicable, and compute cryptographic hashes (e.g., SHA-256) to verify integrity.
• Maintain an unbroken chain of custody recording who collected, transferred and examined each item.
• Examples include mobile phones, computers, USB drives, DVR/CCTV systems and cloud-account logs.
• Analyse a verified copy rather than modifying the original.

Q2(f) — Does MSB 1 prove two's complement? (2 marks)

Quick revision — key points

• False: MSB 1 is not exclusive to two's complement
• Sign-magnitude and ones' complement also use 1 for negative
• Unsigned bit patterns can begin with 1

Exam-ready answer — structured

Direct answer: False. An MSB of 1 does not prove that a number uses two's complement.

Explanation — key points

• Two's complement: the most significant bit represents a negative sign for an interpreted signed value.
• Other signed encodings: sign-magnitude and ones' complement also use a leading 1 for negative values.
• Unsigned representation: even a positive unsigned value may begin with 1.

Conclusion: The encoding convention must be known before interpreting the bit pattern.

CSS 2019

Q2(a) — Revised BSD 3-Clause Licence (10 marks)

Quick revision — key points

• Name all three BSD licence conditions
• Explain permissive use and disclaimer
• Contrast BSD and copyleft obligations
• Five qualifying software/component examples with licence caveat

Exam-ready answer — structured

Direct answer / introduction

The BSD 3-Clause “New” or “Revised” Licence is a permissive open-source licence allowing source or binary redistribution, modification and commercial use, including incorporation into proprietary products.

Explanation — key points

• It has three principal conditions: (1) source-code redistributions retain the copyright notice, licence conditions and disclaimer; (2) binary redistributions reproduce those notices and disclaimer in documentation or accompanying materials; (3) the original organisation's or contributors' names cannot be used to endorse or promote derivative products without written permission.
• Its warranty disclaimer places the software “as is” and disclaims specified liabilities.
• Unlike GPL-style copyleft, BSD 3-Clause does not generally require derivative source code to be distributed under the same licence.
• Its strengths are compatibility and low obligations; the trade-off is that companies may make modified products proprietary without releasing source.
• Examples historically using BSD 3-Clause for at least some components/releases: FreeBSD, NetBSD, OpenBSD-related code, LLVM components, and NumPy.
• Qualification: verify the exact version and component licence; an entire project's current licensing cannot safely be inferred from a historical example.

Q2(b) — AI for cybersecurity (5 marks)

Quick revision — key points

• AI detects anomalies and malicious files
• It flags phishing and suspicious transactions
• AI prioritises incident-response alerts
• Discuss false positives, adversarial threats and privacy

Exam-ready answer — structured

Direct answer / introduction

AI helps defenders analyse more events than human teams can inspect manually.

Explanation — key points

• Anomaly detection flags unusual logins and network traffic; malware classification identifies suspicious files or behaviour; phishing detection analyses messages, links and domains; fraud analytics finds abnormal transactions; and security orchestration prioritises alerts for rapid response.
• For example, a bank may flag a login from a new device followed by atypical transfers.
• However, false positives, adversarial manipulation, biased training data and privacy concerns make human supervision necessary.
• AI supplements, rather than replaces, sound access controls and incident response.

Q2(c) — Parts and phases of a virus (5 marks)

Quick revision — key points

• Virus attaches to a host and replicates
• Parts: infection mechanism, trigger and payload
• Phases: dormant, propagation, triggering, execution
• A worm differs because it does not need a host file

Exam-ready answer — structured

Direct answer / introduction

A computer virus is malicious code that attaches to a host program or file and replicates when that host is executed or activated.

Explanation — key points

• Its conceptual parts include an infection mechanism (how it attaches or spreads), trigger condition (when the malicious behaviour begins) and payload (what it does, such as altering or deleting information).
• Its commonly taught phases are: dormant (waiting, if applicable), propagation (infecting further hosts), triggering (condition becomes true) and execution (payload runs).
• Not every virus exhibits a distinct dormant phase. A worm, by contrast, can self-propagate without attaching to another host file.

Q5(a) — Security risks in cloud computing (10 marks)

Quick revision — key points

• Threats: exposed storage, weak identity, insecure APIs
• Also breaches, ransomware, insider risks and outages
• Use IAM, MFA, encryption, backups and monitoring
• Explain shared responsibility across IaaS/PaaS/SaaS

Exam-ready answer — structured

Direct answer / introduction

Cloud computing supplies network-accessible infrastructure, platforms and applications, but outsourcing infrastructure does not outsource security accountability.

Explanation — key points

• Key risks are: (1) public exposure caused by misconfigured storage and access policies; (2) compromised identities, credentials and API keys; (3) insecure APIs and application vulnerabilities; (4) loss of confidentiality through breaches or insider misuse; (5) ransomware, data deletion and weak backup arrangements; (6) insecure multi-tenancy or isolation failures; (7) distributed-denial-of-service attacks; (8) limited visibility, monitoring and incident-response readiness; (9) compliance, data-residency and jurisdictional concerns; and (10) vendor lock-in and availability disruption.
• Mitigations: least-privilege IAM and MFA, encryption and key management, private networking, logging, continuous configuration auditing, immutable/off-site backups and tested recovery plans.
• Explain the shared-responsibility model: providers secure the cloud infrastructure; customers remain responsible for their data, identities, configuration and other controls according to the service model (IaaS/PaaS/SaaS).
• Conclusion: select controls by risk and verify them continuously.

Q5(c) — Image representation and feature extraction (5 marks)

Quick revision — key points

• Raster image is pixel matrix
• Explain grayscale and RGB channel values
• Mention bit depth and pixel dimensions
• Algorithms: Sobel/Canny, Harris, SIFT/ORB/HOG

Exam-ready answer — structured

Direct answer / introduction

A digital image is a two-dimensional array of pixels.

Explanation — key points

• A monochrome image may store one intensity per pixel, while RGB images commonly store red, green and blue channel values; an 8-bit-per-channel RGB pixel offers 256 intensity levels per channel.
• Resolution (width × height) indicates pixel count, while bit depth determines available intensity precision.
• Feature extraction turns raw pixels into useful descriptors.
• Examples include Sobel or Canny edge detection, Harris corner detection, SIFT, SURF, ORB and HOG features.
• Convolutional neural networks learn hierarchical image features automatically.
• Example: edge and corner features can help distinguish a road sign from the background.

Q2(a) — C++ implementation of AND, OR and NOT (8 marks)

Quick revision — key points

• Provide AND/OR/NOT truth tables
• Read and validate 0/1 inputs
• Use conditional or switch logic in C++
• Demonstrate one sample run

Exam-ready answer — structured

Direct answer / introduction

Truth tables: AND: 00→0, 01→0, 10→0, 11→1.

Explanation — key points

• OR: 00→0, 01→1, 10→1, 11→1.
• NOT: 0→1, 1→0.
• Dry run: gate &, a=1, b=0 produces 0.
• Gate !, a=0 produces 1.

Q3(a) — Standard port numbers (4 marks)

Quick revision — key points

• HTTP 80 and HTTPS 443
• FTP control 21; active-mode data 20
• SMTP 25; submission 587
• DNS port 53 via UDP or TCP

Exam-ready answer — structured

Standard service ports

• HTTP: TCP 80.
• FTP: TCP 21 for control; traditionally TCP 20 for active-mode data.
• SMTP: TCP 25 for server-to-server mail transfer; TCP 587 commonly for authenticated submission.
• HTTPS: TCP 443.
• DNS: UDP 53 for common queries; TCP 53 for operations such as zone transfers and some responses.

Exam note: Ports identify transport-layer service endpoints; FTP data ports depend on transfer mode.

Q3(b) — Citizen Portal interface (8 marks)

Quick revision — key points

• Design login, dashboard and complaint form
• Provide confirmation/reference ID
• Add status tracking, notifications and feedback
• Ensure accessible, secure bilingual interface

Exam-ready answer — structured

Direct answer / introduction

A useful citizen-complaint mobile interface should minimise the effort needed to submit and track a case.

Explanation — key points

• Screen 1 — registration/login: phone or email, authentication, language preference and privacy notice.
• Screen 2 — dashboard: “Register Complaint”, “Track Status”, “My Complaints” and “Help” clearly displayed.
• Screen 3 — new complaint: category, department, location, description, supporting photo or document and optional contact preferences.
• Screen 4 — confirmation: complaint reference number, submission timestamp and expected next step.
• Screen 5 — tracking: status timeline (submitted → assigned → in progress → resolved), messages and escalation or feedback controls.
• Screen 6 — profile/help: language, notification settings, accessibility support and contact information.
• Simple wireframe: [Dashboard] → [New complaint form] → [Confirmation ID] → [Status timeline].
• Use readable labels, large touch targets, input validation, Urdu/English options, accessible colour contrast and protection of sensitive data.
• Design principle: users should always know what happened, what happens next and how to correct an error.

Q3(c) — TCP or UDP for file transfer? (4 marks)

Quick revision — key points

• Choose TCP for file completeness
• ACKs and retransmission recover loss
• Sequence numbers preserve correct order
• Flow and congestion controls; example FTP/SFTP

Exam-ready answer — structured

Direct answer / introduction

Choose TCP for ordinary file transfer because it provides reliable, ordered delivery of a byte stream, detects loss, retransmits missing segments and uses flow/congestion control.

Explanation — key points

• Receiving a damaged or incomplete file would be unacceptable even if transfers took slightly longer.
• FTP and conventional HTTP(S) transfers commonly use TCP.
• Qualification: modern QUIC-based HTTP/3 provides reliability over UDP, but when comparing the native properties of TCP and UDP, TCP is the expected answer.

Q3(d) — TCP or UDP for live audio? (4 marks)

Quick revision — key points

• Choose UDP for latency-sensitive live audio
• Avoid retransmission and in-order blocking
• Small transport header, application jitter buffer
• Example RTP over UDP and qualify limitations

Exam-ready answer — structured

Direct answer / introduction

Choose UDP for latency-sensitive real-time audio because a late packet may be less useful than a lost one.

Explanation — key points

• UDP avoids the retransmission and in-order blocking inherent in TCP and lets the application use jitter buffers, conceal missing audio and adjust bitrate.
• It does not itself guarantee low latency or reliability; the application implements the needed timing and error controls.
• Protocols such as RTP are commonly carried over UDP for real-time media.

Q2(a) — Two office productivity tools (7 marks)

Quick revision — key points

• Define productivity tools
• Word processor for reports, letters and revision
• Spreadsheet for budgets, formulas and charts
• Give concrete home/work examples

Exam-ready answer — structured

Direct answer / introduction

Office productivity tools are applications that help create, edit, analyse, present, organise and exchange workplace information.

Explanation — key points

• Word processor (MS Word/Google Docs): drafts letters, reports, CVs and meeting minutes; provides spelling checks, templates, tables, references and collaborative review.
• Spreadsheet (Excel/Google Sheets): maintains budgets, attendance or inventory; supports formulas, sorting, filtering, charts and data summaries.
• Home example: track monthly household spending in a spreadsheet while drafting an application in a word processor.
• Work example: maintain payroll or inventory records in Excel and prepare a formal policy memo in Word.
• The two tools complement each other: one produces structured prose; the other performs tabular calculations and analysis.

Q2(b) — Computer crimes and ethical challenges (7 marks)

Quick revision — key points

• Define computer crimes and give categories
• Separate unlawful conduct from ethical concerns
• Explain fraud, malware, privacy and IP
• Apply prevention, education and legal safeguards

Exam-ready answer — structured

Direct answer / introduction

A computer crime is an unlawful act involving computers, networks or digital information as a target or instrument.

Explanation — key points

• Examples include unauthorised access, identity theft, financial fraud, data theft, malicious software deployment and cyberstalking.
• Ethical challenges extend beyond offences: consent in data collection, employee monitoring, discriminatory algorithms, intellectual-property misuse, plagiarism and irresponsible disclosure of vulnerabilities.
• Illustrate the distinction: phishing to steal banking credentials is criminal; collecting more customer data than a service needs may be unethical even where legal obligations differ.
• Practical remedies include security-by-design, least privilege, staff training, transparent privacy policies, auditability and responsible vulnerability disclosure.
• Pakistan's cybercrime legislation, including PECA, provides legal context, but ethics also demands proportionality, fairness and respect for rights.

Q2(c) — Types of computers and miniaturisation (6 marks)

Quick revision — key points

• Classify supercomputer, mainframe, server, personal and embedded
• Optionally analog/digital/hybrid
• Miniaturisation improves portability and efficiency
• Mention heat and repairability as trade-offs

Exam-ready answer — structured

Direct answer / introduction

By scale and use, computers include supercomputers (high-performance scientific simulation), mainframes (high-volume reliable transaction processing), midrange/server systems (enterprise services), microcomputers (desktops and laptops) and embedded/mobile systems (phones, controllers and wearables).

Explanation — key points

• By data processing, traditional classifications also include analog, digital and hybrid computers.
• Miniaturisation benefits: reduced size and weight; lower energy consumption per operation; improved portability; potentially lower manufacturing cost; and integration of more functions on one chip.
• It has enabled smartphones, medical wearables and compact sensors.
• Trade-off: smaller systems can face thermal constraints and repairability challenges.

Q3(a) — Any two: ISP, HTML, SSD, cloud computing (6 marks)

Quick revision — key points

• Choose any two only (3 marks each)
• ISP gives connectivity; HTML structures websites
• SSD provides non-volatile flash storage
• Cloud provides on-demand scalable services with examples

Exam-ready answer — structured

Direct answer / introduction

Choose any two and give definition, working/use and example.

Explanation — key points

• ISP: a company supplying Internet connectivity to homes or organisations through fibre, mobile networks or other access technologies; e.g., a local fibre broadband provider.
• HTML: HyperText Markup Language, the standard markup that structures web content using elements such as headings, links and forms; it is not itself a programming language.
• SSD: a non-volatile storage device using flash memory, offering low access latency, no moving parts and rapid application loading.
• Cloud computing: on-demand network access to shared configurable computing resources such as storage, servers and services; e.g., a collaborative cloud drive.
• Answer only two on the exam unless extra examples are required.

Q3(c) — IDEs in software development (5 marks)

Quick revision — key points

• Define IDE as integrated developer toolkit
• Editing, syntax checking and completion
• Build, debugging, testing and version control
• Name only IDEs actually used

Exam-ready answer — structured

Direct answer / introduction

An Integrated Development Environment (IDE) combines tools for writing, building, testing and debugging software in one interface.

Explanation — key points

• Typical facilities include syntax highlighting and completion, project management, compiler/interpreter or build-system integration, breakpoints and variable inspection, refactoring and version-control integration.
• It reduces repetitive setup and helps diagnose defects early.
• Examples: Visual Studio, IntelliJ IDEA, Eclipse, PyCharm and Android Studio. A candidate may name the IDEs they have genuinely used; do not claim personal experience falsely.

Q3(d) — Decimal-to-hexadecimal C++ program (4 marks)

Quick revision — key points

• Repeatedly divide decimal by 16
• Map remainders 10–15 to A–F
• Reverse the remainder order
• C++ program and dry run, handle zero

Exam-ready answer — structured

Direct answer / introduction

Dry run: 254 ÷ 16 = 15 remainder 14 (E); 15 ÷ 16 = 0 remainder 15 (F).

Explanation — key points

• Reading remainders backward gives FE₁₆.
• The sample handles non-negative integers; negative values require a specified representation.

Q2(b) — Six computing disciplines (6 marks)

Quick revision — key points

• CS: algorithms and computational foundations
• SE: systematic software development
• IT: deploy and maintain infrastructure
• IS: business alignment; CE: hardware; bioinformatics: biology

Exam-ready answer — structured

Direct answer / introduction

Computer Science (CS) studies computation, algorithms, data structures and foundations.

Explanation — key points

• Software Engineering (SE) develops reliable software through systematic requirements, design, testing and maintenance.
• Information Technology (IT) deploys, secures and administers organisational computing infrastructure.
• Information Systems (IS) aligns people, processes and information technology to support organisational decisions.
• Computer Engineering (CE) integrates hardware and software, including digital circuits, processors and embedded systems.
• Bioinformatics uses computing, statistics and algorithms to analyse biological data, such as genomic sequences.
• Illustration: building a hospital platform involves CS algorithms, SE development, IT operations, IS workflow analysis, CE medical-device interfaces and bioinformatics for genetic research.

Q3(b) — Information security and privacy principles (6 marks)

Quick revision — key points

• Define CIA triad: confidentiality, integrity, availability
• Identity authentication and least privilege
• Auditability and non-repudiation
• Privacy: minimisation, purpose and retention

Exam-ready answer — structured

Direct answer / introduction

Security is commonly organised around the CIA triad: confidentiality (only authorised persons can read data), integrity (data is not altered without authorisation) and availability (systems and information remain accessible when required).

Explanation — key points

• Supporting principles include authentication (verify identity), authorisation/least privilege (grant only needed rights), accountability/auditing (record and attribute actions) and non-repudiation (evidence against falsely denying particular actions).
• Privacy adds purpose limitation, data minimisation, informed transparency, limited retention and secure disposal.
• Example: a bank uses MFA for identity, access controls for customer records, integrity controls for transactions, backups for availability and clear retention rules for privacy.

Q2(a) — Three supercomputing technologies (8 marks)

Quick revision — key points

• CPU clusters support distributed parallel work
• GPU HPC accelerates massively parallel workloads
• Heterogeneous/Arm designs emphasise efficiency
• Compare processors, interconnects, workload and power

Exam-ready answer — structured

Explanation — key points

• 1. Massively parallel CPU clusters: thousands of multicore processors work together over high-speed interconnects, with jobs divided using MPI and related frameworks.
• Strengths: scalability and suitability for weather, engineering and scientific simulation.
• GPU-accelerated HPC: many-core GPUs execute large numbers of arithmetic operations concurrently, especially matrix, simulation and AI workloads.
• Strengths: high throughput and strong performance per watt for parallel tasks; limitations include data-movement and software-porting costs.
• Energy-efficient heterogeneous/Arm-based HPC: combines efficient CPU architectures and specialised accelerators, stressing memory bandwidth and energy consumption.
• Strengths: good efficiency for suitable workloads and adaptable system design.
• Examples: Frontier demonstrates GPU acceleration; Fugaku illustrates Arm-based HPC.
• Key characteristics to compare: processor design, degree of parallelism, memory/interconnect, workloads, power demand and software ecosystem.

Q2(b) — Supercomputer performance measures (6 marks)

Quick revision — key points

• FLOPS measures numerical throughput
• LINPACK/HPL rates sustained dense linear algebra
• HPCG and bandwidth capture memory limitations
• Green500 assesses energy efficiency

Exam-ready answer — structured

Direct answer / introduction

FLOPS counts floating-point operations per second; tera-, peta- and exaFLOPS indicate increasing orders of magnitude.

Explanation — key points

• HPL/LINPACK measures sustained performance on dense linear algebra and underlies TOP500 rankings.
• HPCG emphasises sparse operations and memory/system behaviour closer to some scientific workloads.
• Memory bandwidth and latency show how efficiently processors are supplied with data.
• Interconnect throughput and latency matter for communication among compute nodes.
• Energy efficiency (FLOPS per watt) is assessed by Green500.
• Conclusion: peak FLOPS alone is not enough; sustained workload performance, memory movement and power consumption determine practical capacity.

Q2(c) — Crawling, indexing and searching (6 marks)

Quick revision — key points

• Crawling discovers pages and links
• Indexing extracts content into searchable data structures
• Query processing retrieves matches
• Ranking orders relevant results

Exam-ready answer — structured

Direct answer / introduction

A search engine first crawls reachable web pages: automated bots follow links and discover content, subject to access rules and technical limits.

Explanation — key points

• Next it indexes useful pages by parsing their text, metadata and links and constructing efficient lookup structures such as inverted indexes.
• On a query, the search/ranking stage retrieves matching documents, assesses relevance and other signals, and displays ranked results and snippets.
• Pipeline: URLs → crawler → content processing → searchable index → user query → ranking → results. A page that has not been discovered or indexed may not appear even when it exists online.
• Ranking and indexing are distinct: indexing determines searchable candidates; ranking orders the candidates for a particular query.

Q2(a) — Future of IT in Pakistan (6 marks)

Quick revision — key points

• Explain IT exports, jobs and remote work
• Digital payments, education and healthcare
• NADRA, e-government and agriculture use cases
• Infrastructure, skills, cybersecurity and inclusion

Exam-ready answer — structured

Direct answer / introduction

Information technology can improve Pakistan's economy and everyday services through digital payments and fintech, IT-enabled exports and remote work, telemedicine and remote education, e-government and digital identity, agritech and logistics, and AI-supported business productivity.

Explanation — key points

• For example, digital payments can help small merchants maintain transaction histories and reach customers beyond their locality; telemedicine can help connect remote patients to clinicians.
• Major obstacles include unreliable connectivity and power, uneven digital literacy, cybersecurity risks, skills mismatches and exclusion of underserved communities.
• Way forward: invest in reliable broadband, practical technical education, digital public services, cybersecurity and clear data-governance safeguards.
• Judgement: inclusion and dependable infrastructure will determine whether Pakistan receives broad social benefits rather than merely adopting fashionable technologies.

Q2(b) — Virus, worm and Trojan (6 marks)

Quick revision — key points

• Virus needs an infected host to replicate
• Worm spreads independently across systems
• Trojan disguises itself and need not replicate
• Compare propagation and prevention

Exam-ready answer — structured

Direct answer / introduction

A virus attaches to a host file or program and reproduces when the infected host is run.

Explanation — key points

• A worm is a standalone self-replicating program capable of spreading across computers or networks, often through vulnerabilities. A Trojan horse disguises malicious software as something desirable or legitimate; it typically depends on users installing or running it and does not inherently self-replicate.
• Compare them by host requirement (virus yes; worm no; Trojan usually disguised package), self-replication (virus and worm yes; Trojan not by definition), and common spread (infected files, network propagation, social engineering respectively).
• All can cause data loss, spyware installation or unauthorised access.
• Protection includes patching, endpoint security, software provenance checks and avoiding suspicious attachments.

Q2(c) — LaTeX versus other document processors (8 marks)

Quick revision — key points

• LaTeX offers strong maths and cross-references
• Templates, bibliography and consistent structure
• Learning curve and collaboration drawbacks
• Contrast Word/WYSIWYG and identify use cases

Exam-ready answer — structured

Direct answer / introduction

LaTeX is a markup-based typesetting system suited to academic and technical documents.

Explanation — key points

• Compared with WYSIWYG word processors such as MS Word, it excels at mathematical notation, consistent styles, cross-references, bibliographies, large structured manuscripts and text-based version control.
• Its separation of content from formatting encourages consistent page layouts, and journal templates help standardise submissions.
• However, it has a steeper learning curve, requires a compilation workflow, can be awkward for visually intensive layouts and collaboration with non-LaTeX users, and may need troubleshooting for specialised packages or fonts.
• Word offers immediate on-screen editing, familiar review tools and a lower entry barrier, especially for routine letters and forms.
• Examples: choose LaTeX for a thesis with many equations, citations and numbered figures; choose Word for a short administrative report shared with nontechnical staff.
• Conclusion: neither is universally better; document complexity and collaborators determine the choice.

Q2(a) — Generative AI's benefits and social challenges (6 marks)

Quick revision — key points

• Define generative AI and its output types
• Benefits: productivity, education and accessibility
• Risks: misinformation, errors, privacy, bias, IP and jobs
• Use examples and responsible oversight

Exam-ready answer — structured

Direct answer / introduction

Generative AI produces new text, images, audio or code based on learned patterns.

Explanation — key points

• It can support education through personalised explanations, improve productivity by drafting and summarising routine work, assist programming with code suggestions, expand creativity and improve language access by translation and speech systems.
• In Pakistan it may help SMEs draft customer material and help students study in Urdu or regional languages.
• Risks include confidently incorrect outputs, fabricated citations, deepfakes and misinformation, plagiarism and copyright disputes, bias, exposure of confidential data and disruption of some occupations.
• Responsible use requires verification of high-stakes results, source disclosure, data protections, digital literacy and human accountability.
• Judgement: the social value of generative AI depends on how carefully people verify and govern its outputs.

Q2(b) — Comparison of storage devices (6 marks)

Quick revision — key points

• Registers/cache fastest but tiny and costly
• RAM is volatile and fast
• SSD persistent with low latency
• HDD slower/cheaper; tape for archives

Exam-ready answer — structured

Direct answer / introduction

CPU registers/cache: extremely fast, tiny capacity, lowest latency and high cost per byte; volatile.

Explanation — key points

• RAM: nanosecond-scale access, usually gigabytes, fast and volatile.
• NVMe SSD: persistent solid-state storage, often hundreds of GB to TB, microsecond-scale access, high throughput and moderate cost/GB.
• SATA SSD: persistent flash storage, generally slower than high-end NVMe but far faster random access than HDD.
• HDD: persistent, large TB capacity, mechanical millisecond-scale seek latency and comparatively low cost/GB.
• Optical discs/tape: removable or archival media; typically slower access, often with low archival cost per stored byte at scale.
• Rule: distinguish access latency from sequential transfer speed, and specify that actual price/speed varies by device generation.
• Use RAM for active work, SSD for responsive daily computing and HDD/tape for bulk or archival storage.

Q2(c) — Two's complement and uses (8 marks)

Quick revision — key points

• n-bit signed range −2^(n−1) to 2^(n−1)−1
• Negate: invert bits then add 1
• Show binary addition/subtraction example
• Explain ALU use, unique zero and overflow

Exam-ready answer — structured

Direct answer / introduction

Two's complement is the standard fixed-width binary representation of signed integers.

Explanation — key points

• For an n-bit pattern, the range is −2^(n−1) to 2^(n−1)−1.
• To obtain −x from the n-bit representation of +x, invert every bit and add 1. 8-bit example: +5 = 00000101; invert → 11111010; add 1 → 11111011 = −5.
• Addition example: 5 + (−3): 00000101 + 11111101 = 1 00000010; discard carry beyond eight bits → 00000010 = 2.
• The same adder hardware thus handles signed addition and subtraction, making two's complement valuable in processors, ALUs, compilers and low-level programming.
• It has a single zero representation.
• Overflow warning: exceeding the n-bit signed range invalidates the mathematical result; signed overflow must be considered separately from the final carry.

Q2(a) — Sharing large files when email rejects attachments (6 marks)

Quick revision — key points

• Cloud storage allows link-based sharing
• Upload once and assign team permissions
• Bypasses email attachment-size limits
• Version history, access revocation and MFA

Exam-ready answer — structured

Direct answer / introduction

Use cloud storage with link-based file sharing, such as an organisational document-sharing service.

Explanation — key points

• Upload the large file once to cloud storage; generate a restricted-access link and send that link through email or a team messenger.
• Recipients download or collaborate on the same copy, so the email's attachment-size limit is bypassed.
• Permissions can restrict access to named users or the organisation, with expiry dates and revocation where supported.
• Version history and synchronisation reduce duplicated outdated copies.
• For confidential files, use encryption, multifactor authentication and least-privilege sharing, avoiding public “anyone with the link” access.
• Conclusion: cloud link-sharing is convenient and scalable, but access settings must match the sensitivity of the data.

Q2(b) — Email demanding banking details (6 marks)

Quick revision — key points

• Identify phishing/social engineering
• Spot suspicious sender, links and OTP requests
• Do not click; independently verify and report
• If exposed, contact bank and secure accounts immediately

Exam-ready answer — structured

Direct answer / introduction

This is most likely phishing, a social-engineering attack intended to steal banking credentials, payment details or one-time codes.

Explanation — key points

• Warning signs include urgency, threatening language, suspicious sender domains, lookalike links, unexpected attachments and requests for passwords or OTPs.
• Do not reply, click the link, open attachments or supply details. Verify the request independently using the bank's official application, website typed manually or known helpline.
• Report the message through the bank's official channel, mark it as phishing and delete it.
• If details have already been entered, immediately contact the bank to secure the account, change compromised credentials, revoke suspicious sessions and monitor transactions.
• Principle: legitimate verification takes place through independently established bank channels, not unsolicited links.

Q2(c) — Advising office staff on hardware upgrades (8 marks)

Quick revision — key points

• Assess CPU and core performance for workload
• RAM capacity and SSD speed
• GPU, motherboard/ports and networking
• Power/cooling, upgrade compatibility and office scenarios

Exam-ready answer — structured

Direct answer / introduction

The best upgrade depends on the work performed, not simply the most expensive specification.

Explanation — key points

• CPU: assess generation, cores and responsiveness; more cores help sustained parallel workloads, while per-core performance matters for everyday apps.
• RAM: sufficient capacity prevents slowing caused by swapping; office multitasking typically benefits from adequate RAM and upgrade headroom.
• Storage: prefer an SSD for the operating system and applications; add capacity according to files and workloads.
• Motherboard/chipset: check compatibility, memory slots, expansion and suitable ports.
• GPU: integrated graphics is usually adequate for documents and video conferencing; dedicated GPUs make sense for 3D design, AI and demanding graphics.
• Display/input/networking: choose a clear ergonomic display, reliable peripherals, Wi-Fi/Ethernet and ports needed by staff.
• PSU/cooling: require stable power, safe wattage headroom and appropriate ventilation.
• Backup/security/UPS: include recovery and electrical protection in the decision.
• Recommended bundles: ordinary clerical office → modern midrange CPU, sufficient RAM and SSD; developer/analyst → stronger CPU, additional RAM and larger SSD; designer → powerful CPU/GPU, ample RAM and colour-accurate display.
• Conclusion: profile employees' tasks, inspect compatibility and prioritise upgrades that remove observed bottlenecks.

5. MCQ reasoning and examiner traps (2024–2026)

The answer letter depends on the original option order; remember the concept rather than the letter alone.

2024

• MCQ 1 — USB: Universal Serial Bus connects many external peripherals, including printers, scanners and cameras. HDMI is primarily a video/audio interface, whereas an Ethernet port provides network connectivity.
• MCQ 2 — OLED (given paper's intended answer): self-emitting pixels deliver wide viewing angles and strong contrast. Caution: IPS LCD panels also offer wide viewing angles and often excellent colour accuracy; the sweeping assertion that OLED is always the most colour-accurate is not universally true. Follow the question's actual choices.
• MCQ 3 — Power Supply Unit: converts incoming electrical power into suitable regulated DC voltages for PC components; the motherboard distributes much of that power but is not the PSU.
• MCQ 4 — Windows: an operating system is system software that manages processes, files, devices and resources; a word processor is application software.
• MCQ 9 — Reaper: commonly described as an early antivirus program that removed the Creeper program on ARPANET-era systems. Historical “first” claims depend on definition.
• MCQ 10 — Least privilege: a user receives only the rights necessary for authorised tasks; routine staff should not be given unrestricted root access.
• MCQ 11 — Complete mediation: access to a protected resource should be checked on every relevant request. A session-expiry or reauthentication prompt reinforces this principle, although session management is the more immediately descriptive mechanism; avoid equating the principle solely with a 30-minute timer.
• MCQ 12 — Trojan: malware disguised as legitimate software; self-replication is not what defines a Trojan.
• MCQ 14 — Cross compiler: the compiler runs on a host platform but generates code for a different target platform, for example compiling an ARM executable on an x86 development workstation.

2025

• MCQ 4 — Teraflops: floating-point operations per second measure computational throughput; present-day HPC also uses peta- and exaFLOPS, with benchmarks such as LINPACK.
• MCQ 9 — Trojan and password theft: credential stealing is one common malicious objective of Trojan malware, but not its universal or sole purpose; Trojans may also deliver ransomware or provide remote access. Answer within the choices shown in the paper.

2026

• MCQ 1 — SSD: compared with HDDs and optical storage, SSDs generally offer lower access latency. If RAM/cache were among the options, they would be faster in access latency but serve different storage roles.
• MCQ 2 — Plagiarism: presenting another person's original code, design or writing as one's own is an ethical breach; licence compliance and attribution matter in software work.
• MCQ 6 — Hardware and software: architectural progress arose through interactions among transistor/IC technology, memory, processors, programming systems, operating systems and networking.
• MCQ 20 — Vulnerable open-source components: unpatched dependencies can permit exploitation and create security or compliance exposure; an open-source licence does not guarantee that software is secure. Maintain a dependency inventory, review advisories and patch promptly.

---

Revision strategy: practise the 40 written answers by the marks shown in section 1, then attempt the 15 MCQs without looking at the key. Treat historical licence examples, ambiguous MCQs and rapidly changing performance specifications as items requiring verification before quoting them as absolute facts.