Computer science in practice
Domain 3 - Computer science in practice
This domain tests whether you can carry a project from brief to evaluation and reason about computing’s effect on people. It is where the applied learning tasks live and where the long-answer security, legal and ethics questions come from.
From brief to artefact
From a brief, produce functional and non-functional requirements, a design (inputs, processes, outputs, interface sketch, data model), an implementation, a test plan, and an evaluation judged against the original requirements with evidence rather than opinion. Keep artefacts that show process - drafts, commit history, revised designs - because marks reward iteration, not just the finished program.
Security
Phishing is countered by link inspection, multi-factor authentication and training; SQL injection by parameterised queries, never string concatenation; XSS by output encoding. Symmetric encryption uses one shared key - fast, but the key must be distributed. Asymmetric encryption uses a public/private pair, solving key exchange at the cost of speed. Hashing is one-way and salted for password storage; hashing is not encryption.
Legal and ethical
GDPR requires a lawful basis, data minimisation, purpose and storage limitation, rights of access and erasure, and breach notification. Also weigh copyright and licensing of code and assets, accessibility, the digital divide, algorithmic bias, and automation’s effect on employment.
Worked example
Design tests for a grade function: below 40 Fail, 40–59 Pass, 60–79 Merit, 80+ Distinction. Boundaries are where behaviour changes, so test 39/40, 59/60 and 79/80, plus invalid inputs −1 and 101, plus a normal value such as 72. A single typical test would still pass if every boundary were wrong, which is why boundary tests earn the marks.
Traps
An evaluation that lists features instead of judging them against requirements; testing only typical data; answering ethics with “it’s wrong” rather than naming the principle, the stakeholder and the consequence; treating hashing as encryption; claiming HTTPS protects data at the endpoints rather than in transit between client and server.