Computer Science ATAR Course Year 12 Syllabus (for teaching from 2026)
Units 3 and 4 are assessed through school-based tasks (Project 40%, Theory test 10%, Practical test 10%, Examination 40% of the school mark) and one ATAR course examination (10 minutes reading time, 3 hours working time) that is combined with the moderated school mark. The examination has two compulsory sections weighted 40/60 of the exam mark regardless of raw marks: Section One - Short answer (20 questions on the 2026 cover, 83 marks, 70 minutes suggested, 40%) and Section Two - Extended answer (4 questions on the 2026 cover, 111 marks, 110 minutes suggested, 60%), with case-study stimulus in a separate Source booklet. The design brief allows 20-30 short-answer and 4-6 extended-answer questions, and raw marks change every year (94/110 in 2025, 108/87 in 2024). Permitted: standard writing items, up to three calculators that cannot store programs or text, Mathomat/Mathaid and a system flowchart template.
Past papers on this subject span more than one syllabus. Papers written under an older one still work as practice, but the units and content areas they test have changed — the index labels every paper with the syllabus it was set under.
Year 12 syllabus for teaching from 2024 (current; minor changes for 2026, v4 effective 1 January 2026) · 2024–2026Previous Year 12 syllabus (examined to 2023) · 2021–2023
The units and content areas, one by one
Each area below lists the concepts named in the syllabus, what the SCSA exam asks of them, and the mistake that most often costs marks.
- Programming (Unit 3)
- Good practice, testing and debugging (Unit 3)
- Network communications (Unit 3)
- Cyber security (Unit 4)
- Ethics and law (Units 3 and 4)
- Data management (Unit 4)
Area 1 of 6
Programming (Unit 3)
Sequence, selection and fixed, pre-test and post-test iteration; integer, float, string and Boolean data; arithmetic, relational and logical operators and Boolean precedence; functions with parameters, local and global scope, pass by value and by reference; one- and two-dimensional arrays and dictionaries; linear and binary search, bubble, insertion and selection sort and their Big O; classes, objects, inheritance, encapsulation, abstraction and polymorphism. The exam asks for working Python and clear pseudocode, often on 2D arrays and dictionaries in unfamiliar scenarios.
What the syllabus lists under this area · 7 points
- Control structures, data types, operators and Boolean logic
- Functions, parameters, scope and parameter passing
- Arrays (1D/2D) and dictionaries
- Search and sort algorithms and Big O
- Object-oriented programming
- Development framework and good programming practice
- Testing, error types, debugging and trace tables
What the exam asks
Where marks go missing
18 real SCSA questions indexed on this area →
Area 2 of 6
Good practice, testing and debugging (Unit 3)
The investigate-design-develop-evaluate framework, Gantt charts, linear vs iterative development, and good practice such as validating input, a clear mainline, one task per subroutine, stubs, version control, backups and exception handling. Testing covers unit, acceptance and live-data testing (large files, transaction mix, response times, load); debugging covers syntax, logic and runtime errors (division by zero, index out of range), breakpoints, print statements and trace tables.
What the exam asks
Where marks go missing
Area 3 of 6
Network communications (Unit 3)
Compare the OSI and DoD TCP/IP models and the role of each layer; MAC-based switching at layer 2 and IP routing at layer 3; TCP vs UDP; ports, DNS and default gateways; IPv4 vs IPv6 and private vs public addressing; subnet masks, CIDR and subnetting; the PDU at each layer (data, segment, packet, frame, bits); routers, switches, modems, gateways, wireless access points and firewalls; Cisco-convention network diagrams with IP plans; ping and traceroute for troubleshooting.
What the syllabus lists under this area · 4 points
- OSI and DoD TCP/IP models and packet architecture
- Protocols, ports, DNS, gateways and IP versions
- IP addressing, subnetting and CIDR
- Network components, Cisco diagrams and performance tools
What the exam asks
Where marks go missing
8 real SCSA questions indexed on this area →
Area 4 of 6
Cyber security (Unit 4)
External threats (phishing, DoS/DDoS, back doors, IP spoofing, SQL injection, man-in-the-middle, cross-site scripting, malware types, physical threats, zero day vulnerabilities) and internal threats (lost devices, compromised credentials, employee misuse), matched to solutions such as log analysis, anti-malware, firewall filtering, ACLs, intrusion prevention, VPNs, training, codes of conduct and physical security. Analyse incidents with the CIA triad and audit with the AAA framework; explain symmetric and asymmetric encryption, certificates, hybrid secure communication and red vs blue teams.
What the syllabus lists under this area · 3 points
- Network threats
- Security solutions, CIA triad, AAA and ethical hacking
- Cryptography
What the exam asks
Where marks go missing
8 real SCSA questions indexed on this area →
Area 5 of 6
Ethics and law (Units 3 and 4)
Impacts of software and developers' responsibilities (intellectual property, quality, responding to users, codes of conduct, ergonomics, inclusivity, privacy), plus the Privacy Act 1988, APP5, APP8, APP10, APP11 and APP12, and the Notifiable Data Breaches scheme, applied to supplied case studies about collecting, storing and securing personal data.
What the syllabus lists under this area · 2 points
- Impacts of software and developer responsibilities
- Privacy Act 1988, APPs and Notifiable Data Breaches
What the exam asks
Where marks go missing
5 real SCSA questions indexed on this area →
Area 6 of 6
Data management (Unit 4)
Entities, attributes and 1:1, 1:M and M:N relationships; primary, foreign and composite keys; insert, update and delete anomalies; ACID and open database connectivity; data dictionaries, crow's foot ER diagrams and relational notation; referential, domain and entity integrity and data quality; normalisation to 3NF; and SQL to create, modify and query tables, including constraints, cascading deletes, aggregates, GROUP BY, inner joins across up to four tables, calculated and concatenated fields and aliases.
What the syllabus lists under this area · 4 points
- Relational concepts, anomalies, ACID and ODBC
- ER diagrams, relational notation and data dictionaries
- Data integrity, data quality and normalisation
- SQL
What the exam asks
Where marks go missing
11 real SCSA questions indexed on this area →
Common questions
Which syllabus applies to the 2026 exam?
The Year 12 syllabus for teaching from 2026 (2022/39860 v4, effective 1 January 2026). It is the syllabus first examined in 2024 with minor 2026 changes: Python is named as the language, arithmetic overflow is removed from runtime errors, 'collision domains' becomes 'broadcast domains', and SQL querying explicitly includes searching, sorting and filtering.
How is the 2026 exam structured?
Ten minutes reading and three hours working. Section One has 20 compulsory short-answer questions worth 83 marks (40% of the exam, about 70 minutes); Section Two has 4 compulsory extended-answer questions worth 111 marks (60%, about 110 minutes). A Source booklet holds the case-study material.
Can I take a calculator?
Yes. Up to three calculators that cannot create or store programs or text are permitted, along with a Mathomat, Mathaid or system flowchart template.
Do I have to write real Python?
Yes, when the question says so. Python is the prescribed language for exam programming questions; other questions accept pseudocode, which should follow the support booklet conventions (capitalised keywords, indentation, explicit END statements).
Is there multiple choice?
No. Every question is written. The multiple-choice items in this hub are revision drills only.
What does Section Two usually contain?
Recent papers have had one large database question (anomalies, normalisation, a crow's foot ER diagram, SQL), one network design question (subnetting, a Cisco diagram, ping or traceroute analysis) and two programming questions on lists, 2D arrays and dictionaries, with cyber security or encryption parts mixed in.
What did examiners say candidates found hardest in 2025?
Multi-step programming with lists and dictionaries, subnetting and assigning IP addresses to router interfaces and devices, interpreting network performance data, correct SQL joins and applying encryption concepts; answers to 'explain', 'compare' and 'discuss' often lacked depth.