The units and topics, one by one
Each area below lists the concepts named in the syllabus, what the QCAA exam asks of them, and the mistake that most often costs marks.
- Unit 4 Topic 1 — Digital methods for exchanging data — encryption, authentication and privacy
- Unit 4 Topic 1 — Digital methods for exchanging data — networks and data exchange
- Unit 4 Topic 2 — Complex digital data exchange problems and solution requirements
- Unit 4 Topic 3 — Prototype digital data exchanges
- Unit 4 Topic 1 (built on Unit 3) — Useability principles, visual communication and user-interface prototypes
- Unit 3 — Digital innovation (internal assessment)
Area 1 of 6
Unit 4 Topic 1 — Digital methods for exchanging data — encryption, authentication and privacy
Know the features of the symmetric algorithms (DES, Triple DES, AES, Blowfish, Twofish) and why RSA's key pair solves the key-distribution problem. Analyse Caesar, Vigenère, Gronsfeld and one-time pad ciphers by key space and resistance to brute force and frequency analysis. Explain where hashing, checksums, compression and encryption act in storage and transfer, compare authentication factors, and apply the Australian Privacy Principles to a scenario's personal or sensitive data.
What the exam asks
Examined in the external assessment (Unit 4 subject matter).
Where marks go missing
Calling hashing 'encryption' (a hash cannot be reversed) or naming an APP without explaining how the organisation in the stimulus would implement it.
Area 2 of 6
Unit 4 Topic 1 — Digital methods for exchanging data — networks and data exchange
Explain TCP/IP, HTTP/HTTPS, FTP and VPNs, packet switching, routing and forwarding, error detection and correction, flow and congestion control and QoS, and use latency, jitter, guarantee and timeliness of delivery to judge a real-time exchange. Describe how REST APIs move JSON or XML between front-end and back-end sub-systems, and write correctly structured JSON and XML with sensible naming conventions. Know basic definitions of machine learning, deep learning, neural networks, NLP and reinforcement learning and how each processes data.
What the exam asks
Examined in the external assessment (Unit 4 subject matter).
Where marks go missing
Treating latency and jitter as the same thing, or writing XML/JSON with mismatched tags, missing quotes around keys, or no parent element.
Area 3 of 6
Unit 4 Topic 2 — Complex digital data exchange problems and solution requirements
Decompose a data exchange problem into scope, constraints, limitations, requirements and measurable success criteria. Determine and justify risks to confidentiality, integrity, availability and privacy in the stimulus, then recommend a strategy that targets each risk. Check data for completeness, consistency and integrity, choose data types in a data dictionary, and symbolise or explain data flow diagrams that link external entities, processes and data stores.
What the syllabus lists under this area · 10 points
- Identify, describe and determine the scope and usage of local and global variables
- Analyse problems to determine scope, constraints and limitations, requirements of solution components, necessary coded modularity and features
- Factors and risks that affect data security, including confidentiality, integrity, availability and privacy
- Existing code within inbuilt libraries, and success criteria to appraise implementation (e.g. protection, security and interactions)
- The potential role of emerging technologies such as machine learning in data exchange solutions
- Analyse, evaluate and refine data to ensure completeness, consistency and integrity
- Analyse and explain a system's data process with data flow diagrams linking external entities, data sources, processes and data storage
- Determine manageable aspects of a problem by decomposing constraints, risks, available tools, code libraries and frameworks, data storage and output requirements, and the data interface
- Determine data sources required to generate data components; develop algorithmic steps with pseudocode; explain code with comments and annotations
- Communicate with digital technologies-specific language, annotations, sketches and diagrams
What the exam asks
Examined in the external assessment (Unit 4 subject matter).
Where marks go missing
Giving generic risks that ignore the scenario, or drawing a flowchart (decisions and arrows without labelled data) when a data flow diagram is asked for.
19 real QCAA questions indexed on this area →
Area 4 of 6
Unit 4 Topic 3 — Prototype digital data exchanges
Use the algorithm constructs (assignment, sequence, selection, condition, iteration, modularisation) and the five features of programming in clear generic pseudocode. Desk check algorithms variable by variable, correct errors in cipher or data-processing algorithms, and write pseudocode that reads JSON, calculates and displays results using library functions. Write SQL (CREATE, ALTER, INSERT, UPDATE, SELECT with WHERE, GROUP BY, HAVING, ORDER BY, sub-selections and inner joins), and evaluate solutions and impacts against criteria.
What the syllabus lists under this area · 10 points
- Basic algorithm constructs: assignment, sequence, selection, condition, iteration and modularisation
- The five basic features of programming: variables, control structures, data structures, syntax, libraries and classes
- Good programming practices: dependability, efficiency, testing, debugging, error correction, coding conventions including commenting, consistent naming, code simplicity and portability
- Pseudocode for simple Caesar, polyalphabetic (Vigenère and Gronsfeld) and one-time pad encryption algorithms, and well-ordered unambiguous algorithms for defined problems
- Receiving data from an external source, processing it and displaying it in an appropriate format; incorporating existing code libraries; exchanging data in JSON or XML
- SQL: CREATE, DROP, ALTER, INSERT, UPDATE, SELECT, WHERE, GROUP BY, HAVING, ORDER BY, sub-selection and inner joins
- Programmed methods: single and nested, simple and compound selection; nested iteration; arithmetic, comparison and logical operators including real division, integer division and modulus; data types, error-checking functions and conversions; one-dimensional arrays and lists
- Desk checks to predict output for a given input, identify and fix errors and validate algorithms
- Evaluate personal, social and economic impacts of the exchange, storage, accuracy and ownership of data and of emerging technologies such as AI
- Evaluate solutions against success criteria and by testing accuracy, reliability, maintainability, efficiency, effectiveness and useability; make justified security recommendations
What the exam asks
Examined in the external assessment (Unit 4 subject matter).
Where marks go missing
Desk checking only the final output instead of every value each variable takes, or using WHERE to filter aggregated groups instead of HAVING.
16 real QCAA questions indexed on this area →
Area 5 of 6
Unit 4 Topic 1 (built on Unit 3) — Useability principles, visual communication and user-interface prototypes
Evaluate interfaces against accessibility, effectiveness, safety, utility and learnability, naming the principle and tying it to a specific user error or delay. Apply the elements and principles of visual communication (for example hierarchy, proximity, alignment and contrast) in annotated low-fidelity mock-ups that meet every stated criterion.
What the syllabus lists under this area · 4 points
- How useability principles (accessibility, effectiveness, safety, utility and learnability) inform solution development
- How the elements (space, line, colour, shape, texture, tone, form, proportion, scale) and principles (balance, contrast, proximity, harmony, alignment, repetition, hierarchy) of visual communication inform user-interface development
- Low-fidelity user-interface prototypes: sketches, wireframes and annotated mock-ups (Unit 3 foundations applied in Unit 4 data exchange contexts)
- Evaluating existing interfaces against useability principles and recommending justified improvements
What the exam asks
Examined in the external assessment (Unit 4 subject matter). Unit 3 prototyping skills are assumed.
Where marks go missing
Annotating a mock-up without actually drawing the features (symbolising marks need the visual), or confusing accessibility with general ease of use.
11 real QCAA questions indexed on this area →
Area 6 of 6
Unit 3 — Digital innovation (internal assessment)
Unit 3 develops technical proposals and prototypes in a technology context (web applications, mobile applications, interactive media or intelligent systems), with project management, low-fidelity prototyping and SQL. Its skills underpin Unit 4 but its context-specific subject matter is assessed through IA1 and IA2, not the external paper.
What the exam asks
Assessed internally (IA1 Technical proposal 25%, IA2 Digital solution 25%); IA3 (Unit 4 digital solution) is also internal.
Where marks go missing
Revising technology-context component lists for the external paper instead of Unit 4 data exchange and security.
Common questions
Does the external assessment examine Unit 3?
No. The syllabus says the examination consists of questions relating to Unit 4 (Digital impacts). Unit 3 is assessed internally, although its foundations such as useability principles, visual communication, DFDs, SQL and pseudocode reappear in Unit 4 subject matter.
How many marks is the Digital Solutions external assessment?
The syllabus fixes no total. Published papers were 72 (2021), 69 (2022), 69 (2023), 66 (2024) and 67 (2025) marks. Section 1 has always been 10 one-mark multiple choice questions. The practice papers here use 67 marks, the most recent real total.
How much perusal time is there, and can I use a calculator?
From 2026 perusal is 5 minutes (it was 15 minutes on the 2021-2025 papers) and working time is 120 minutes. A QCAA-approved non-programmable scientific calculator is permitted.
Which pseudocode style should I use?
Generic pseudocode suitable for any language: BEGIN/END, clear indentation, keywords such as IF/THEN/ELSE/ENDIF, FOR/ENDFOR and WHILE/ENDWHILE, meaningful variable names and comments. Marking guides reward unambiguous control structures and correct logic, not one language's syntax.
Which ciphers do I need to be able to work with?
Analyse, evaluate and write pseudocode for Caesar, Vigenère, Gronsfeld and one-time pad ciphers. For DES, Triple DES, AES, Blowfish, Twofish and RSA you need to recognise and describe features and differences, not implement them.
Are the 2021-2025 past papers still useful?
Yes for question style, command words and marking expectations, but they were set under the 2019 syllabus. The 2025 v1.4 syllabus adds APIs to methods of data exchange and revises some terminology, so practise API and REST questions as well.
How does Digital Solutions scale?
In QTAC's ATAR Report 2025, Digital Solutions had a median raw result of 78 and a median scaled result of 80.34 out of 100; at the 90th percentile a raw 94 corresponded to a scaled 92.86. That describes one cohort, not a formula for your own result.