Markscheme: Practice Paper 1, HL, set 1

Mark your own answers point by point. The number in brackets after each point is what it is worth.

Section A

Answer all questions.

Question 1

A bike-share docking station's processor runs a loop millions of times a day. Each time round, it reads the same few instructions and the same few variables (such as the number of free docks) from memory.

Explain how CPU cache memory speeds up this loop, referring to a cache hit and a cache miss. [3]

p1 [1]
Cache is a small amount of very fast memory close to (or on) the CPU that holds copies of data or instructions that are used often.
p2 [1]
A cache hit is when the data the CPU needs is found in the cache, so it is read quickly without going to the slower main memory (RAM).
p3 [1]
A cache miss is when the data is not in the cache, so it must be fetched from main memory (slower), and it is usually copied into the cache so the next request for it is a hit.

Also accept

For p1, "faster than RAM but smaller" earns the mark when linked to holding frequently used data.
For p3, linking the loop's repeated reads to a high hit rate earns the mark if a miss is also described.

No marks for

Describing cache as a part of the hard drive or SSD.
Saying a cache miss causes an error or crashes the program. It only makes that access slower.
Saying cache is bigger than RAM.

A full-marks answer

Cache is a small, very fast memory on or next to the CPU that keeps copies of instructions and data that are used often, such as the loop's instructions and the free-docks count. When the CPU needs one of these and it is already in the cache, that is a cache hit, and it is read much faster than from main memory. When it is not in the cache, that is a cache miss: it has to be fetched from the slower main memory, and a copy is put into the cache so the next read is a hit. Because the loop reads the same few items again and again, almost every read after the first time round is a hit.

Question 2

A barcode scanner is plugged into a school library computer. Instead of the processor checking the scanner over and over (polling), the scanner sends an interrupt each time a book is scanned.

(a) Explain how the processor handles this interrupt. [3]

(b) State one advantage of using interrupts rather than polling for the scanner. [1]

[4]

p1 [1]
(a) The processor checks for interrupts (at the end of each fetch, decode and execute cycle) and finishes its current instruction before responding.
p2 [1]
(a) The state of the current task (the program counter and other register contents) is saved, for example onto a stack.
p3 [1]
(a) The interrupt service routine (handler) for the scanner runs to read the barcode, then the saved state is restored so the interrupted task carries on where it stopped.
p4 [1]
(b) The processor does not waste time repeatedly checking a scanner that is usually idle, so it can get on with other work and only responds when a book is actually scanned.

Also accept

For p3, describing the interrupt vector step (the source of the interrupt is identified and the address of its ISR is loaded into the PC) earns the mark if the return to the interrupted task is also stated.
For p4, "the scan is dealt with straight away instead of waiting for the next poll" earns the mark.
For p1, saying the processor compares the interrupt's priority with the current task and only responds if it is higher earns the mark.
For p3, "interrupt handler" or "ISR" in place of interrupt service routine earns the mark.

No marks for

Saying the current program is stopped and has to start again from the beginning.
For (b), "interrupts are faster" with no reason.
Saying, for (a), the processor keeps asking the scanner whether a book has been scanned. That is polling, which the stem says is not used.

A full-marks answer

(a) When the scanner sends an interrupt, the processor finishes the instruction it is on and, at the end of that cycle, sees the interrupt. It saves the state of the current task, such as the program counter and register contents, onto a stack. It then runs the interrupt service routine for the scanner, which reads the barcode. When the routine ends, the saved values are loaded back into the registers and the interrupted task carries on from where it stopped.

(b) The processor does not waste time checking a scanner that is idle most of the time. It can run other tasks and only stops when a book is actually scanned.

Question 3

A games console's processor splits each instruction into three stages: fetch, decode and execute. Each stage takes one clock cycle.

(a) Explain how pipelining raises the number of instructions completed per second. [2]

(b) Calculate how many clock cycles it takes to complete 6 instructions without pipelining and with a three-stage pipeline. Assume the pipeline never stalls. [2]

[4]

p1 [1]
(a) The stages of different instructions overlap, so while one instruction is executed the next is decoded and the one after is fetched.
p2 [1]
(a) Once the pipeline is full, one instruction finishes every clock cycle instead of one every three cycles, so throughput rises (each single instruction still takes three cycles).
p3 [1]
(b) Without pipelining, 6 instructions take 18 clock cycles (6 x 3).
p4 [1]
(b) With the pipeline, they take 8 clock cycles (3 cycles for the first instruction, then 1 more for each of the other 5).

Also accept

For p2, "the processor's parts are never idle waiting, so more instructions finish per second" earns the mark if overlap is clear from p1.
For p4, a correct cycle-by-cycle diagram ending at cycle 8 earns the mark.

No marks for

For (a), "each instruction runs faster". Pipelining does not make one instruction quicker; it finishes more instructions in the same time.
For (a), "it uses more cores". Pipelining happens inside one core.
For (b), 6 cycles with the pipeline. The first instruction still needs all three stages before anything finishes.

A full-marks answer

(a) With pipelining the stages of different instructions overlap: while instruction 1 is executed, instruction 2 is decoded and instruction 3 is fetched. Once the pipeline is full, one instruction completes every clock cycle instead of one every three cycles, so throughput rises, even though each instruction still takes three cycles.

(b) Without pipelining: 6 x 3 = 18 clock cycles. With the pipeline: the first instruction finishes after 3 cycles and each of the other 5 finishes one cycle later, so 3 + 5 = 8 clock cycles.

Question 4

A school coding club writes small programs during lunch, testing and changing them every few minutes. At the end of the year, the club will give its finished timetable app to every student, on many different kinds of computer.

Evaluate the use of an interpreter, rather than a compiler, for the club's work. [6]

p1 [1]
Describes that an interpreter translates and runs the program one statement at a time, while a compiler translates the whole program into machine code (an executable) before it runs.
p2 [1]
Interpreter strength, development. A change can be run straight away with no separate compile step, which suits testing every few minutes.
p3 [1]
Interpreter strength, errors. It stops at the line with the error and reports it, and the program runs up to that point, which helps beginners find bugs.
p4 [1]
Gives any one weakness of an interpreter for this club, with its reason. Any one of: the program usually runs more slowly because each statement is translated every time it runs; every student who uses the app needs the interpreter installed; the source code has to be handed out with the app.
p5 [1]
Gives any one strength of a compiler for the finished app, with its reason. Any one of: the executable runs faster because translation was done once in advance; it needs no translator on the student's computer; the source code is not handed out; all syntax errors are reported before the app is released.
p6 [1]
Reaches a justified conclusion, for example an interpreter for development and a compiler (or compiled build per platform) for release, or explains how portability across many kinds of computer affects the choice.

Also accept

For p3, "a compiler reports all errors only after translating the whole program, which can be a long list for a beginner" earns the mark as the contrast.
For p5, noting that a compiled executable is tied to one processor and operating system, so the club would need a separate build for each kind of computer, earns the mark if linked to the timetable app.
The portability of an interpreter (the same source code runs on every kind of computer that has the interpreter, with no separate build for each) earns p2 or p3 in place of either of those, if linked to the many kinds of computer the students use.
For p6, a conclusion that a bytecode language with a virtual machine (such as Java) gives portability earns the mark if it is justified for this scenario.

No marks for

Saying an interpreter produces an executable file. It does not.
Saying a compiler finds logic errors. Neither translator can find logic errors.
A conclusion with no reason, such as "so an interpreter is better".

A full-marks answer

An interpreter translates and runs the program one statement at a time, while a compiler translates the whole program into machine code before any of it runs.

For the lunchtime work an interpreter is a strong choice. A change can be run at once, with no compile step, which suits testing every few minutes. When there is an error, the interpreter stops at that line and reports it, so beginners can see exactly where the program went wrong.

However, interpreted programs usually run more slowly, because each statement is translated again every time it runs, and every student would need the interpreter installed to use the app. A compiler produces an executable that runs faster, needs no translator on the student's computer, and keeps the source code private. The catch is that an executable only runs on one kind of processor and operating system, so the club would need a separate build for each kind of computer.

Overall, the club should use an interpreter while writing and testing, because quick feedback matters most there, and compile the finished timetable app, once for each platform the students use, so it runs quickly without anything extra installed.

Question 5

The TCP/IP model describes network communication as four layers.

(a) State the names of the four layers, in order from the top. [1]

(b) State the layer that adds port numbers, so the data reaches the right program on the destination computer. [1]

[3]

p1 [1]
(a) Gives Application, Transport, Internet, Link, in that order from the top.
p2 [1]
(b) States the transport layer.
p3 [1]
(c) States the internet layer.

Also accept

For p1, "network access", "network interface" or "data link" for the link layer earns the mark, and so does "network layer" for the internet layer.
For p3, "network layer" earns the mark.

No marks for

For (a), the four layers in the right set but the wrong order. The question asks for the order from the top.
For (a), the seven layers of the OSI model (such as presentation and session). The question is about the four-layer TCP/IP model.
For (a), "physical" for the bottom layer. Physical is an OSI layer; the TCP/IP bottom layer is the link (network access) layer.
For (c), the link layer. The link layer moves frames within one network; routing between networks is the internet layer's job.

A full-marks answer

(a) Application, Transport, Internet, Link.

(b) The transport layer.

Question 6

A school keeps student devices on their own subnet, written in CIDR notation as 10.20.30.64/26.

(a) State how many bits of the address identify the network. [1]

(b) State the first and last addresses in this block, including the network and broadcast addresses. [1]

[3]

p1 [1]
(a) States that 26 bits identify the network.
p2 [1]
(b) Gives 10.20.30.64 as the first address and 10.20.30.127 as the last.
p3 [1]
(c) States it is not on the subnet, with a correct reason, such as 130 being outside the range 64 to 127.

Also accept

For p2, "64 addresses from 10.20.30.64 to 10.20.30.127" earns the mark.
For p2, giving 10.20.30.65 to 10.20.30.126 earns the mark only when it is labelled as the usable host range and .64 and .127 are named as the network and broadcast addresses.
For p3, "no, its first 26 bits do not match those of 10.20.30.64" earns the mark.
For p3, "no, it is on the next subnet, 10.20.30.128/26" earns the mark.
For p3, follow through from (b). If the range given in (b) is wrong, award p3 for a yes or no that is correct for that wrong range, with the reason. The mark is for using a range to decide, which the student has done.

No marks for

For (a), 6. That is the number of bits left for hosts.
For (b), 10.20.30.0 to 10.20.30.255. That is the range of a /24 network.
For (c), "yes, because it starts 10.20.30". The first 26 bits must match, not just the first three numbers.

A full-marks answer

(a) 26 bits.

(b) 32 - 26 = 6 host bits gives 2^6 = 64 addresses, starting at 10.20.30.64, so the block runs from 10.20.30.64 (the network address) to 10.20.30.127 (the broadcast address).

Question 7

A student types the address of a school sports club's website, clubs.harbourview.example, into a browser for the first time. The browser needs the website's IP address before it can request the page.

(a) Describe how the domain name is resolved to an IP address. [3]

[3]

p1 [1]
(a) The computer sends a query for the name to its configured DNS server (a resolver, such as the school's or the internet provider's).
p2 [1]
(a) If the resolver does not already know the answer, it asks a root server, which refers it to the server for the .example top-level domain.
p3 [1]
(a) The authoritative server for harbourview.example returns the IP address, and the resolver passes it back to the computer.

Also accept

For p1, "first checks its own DNS cache and, finding nothing, asks the DNS server" earns the mark.
For p1, "asks the DNS server set by DHCP" earns the mark.
For p2 and p3 together, "the resolver asks other DNS servers in turn until the one holding the record replies with the IP address, which is returned to the computer" earns p2 and p3 only if the root, top-level domain and authoritative servers are named; without them it earns p3 only.
For p3, an answer that also says the address is cached for later lookups still earns the mark.

No marks for

For (a), "the router looks up the name". A home or school router may forward the query, but the lookup is answered by DNS servers.
For (a), "the web server tells the browser its IP address". The browser cannot reach the web server until it already knows the address.
For (a), "DHCP gives the IP address of the website". DHCP gives a device its own address, not the address of a website.

A full-marks answer

(a) Since this is the first visit, the computer has no stored answer, so it sends a query to its DNS resolver, for example the school's DNS server. If the resolver has no cached answer, it asks a root server, which refers it to the server for the .example top-level domain, which in turn refers it to the authoritative server for harbourview.example. That server replies with the IP address of clubs.harbourview.example, and the resolver passes it back to the computer, which can now request the page.

Question 8

A student at home uploads a large photo of a science poster to the school's file server. The photo is sent across the internet using packet switching.

(a) State one item, other than part of the photo itself, that each packet carries. [1]

(b) Explain why the packets can arrive at the file server in a different order from the one they were sent in. [2]

[3]

p1 [1]
(a) Names one header or trailer item, such as the destination IP address, the source IP address, a sequence number, a time to live (hop limit), or a checksum.
p2 [1]
(b) Each router decides where to send each packet separately, based on current conditions such as congestion or failed links, so packets from one photo can take different routes.
p3 [1]
(b) Different routes have different delays, so a packet sent later can arrive before one sent earlier (the server then uses sequence numbers to put them back in order).

Also accept

For p1, "the address it is going to", "the packet's number in the sequence", "the protocol" or "an error check" earns the mark.
For p3, "some routes are busier or longer than others, so packets are overtaken" earns the mark.
For p3, "a lost packet is sent again, so it arrives after packets that were sent later" earns the mark.

No marks for

For (a), "the file name". That is part of the data being sent, not packet information.
For (b), "packets are sent in a random order". The sender sends them in order; the order changes on the way.
For (b), "the switch mixes them up". Packets cross the internet through routers, which choose routes independently.

A full-marks answer

(a) The destination IP address.

(b) Each router along the way decides independently where to forward each packet, using current conditions such as how busy each link is, so packets from the same photo can travel by different routes. Those routes have different delays, so a packet sent later can overtake one sent earlier; the file server uses the sequence numbers to rebuild the photo in the right order.

Question 9

A member of a school's office staff receives an email that looks as if it comes from the school's IT team. It links to a fake login page, and they type their password there. The next day, an attacker logs in to the staff member's account from another country and reads student records.

(a) Identify the type of attack that was used. [1]

(b) Suggest three countermeasures of different kinds (for example technical, procedural and detection) that together would protect the school against this kind of attack. Justify each one, and justify using more than one. [4]

[5]

p1 [1]
(a) Identifies phishing.
p2 [1]
(b) Multi-factor authentication for staff accounts, justified because a stolen password alone would then not be enough to log in (the attacker would also need, for example, a code from the staff member's phone).
p3 [1]
(b) Staff training (for example in checking sender addresses and links, and reporting suspicious emails), justified because it makes staff less likely to type a password into a fake page in the first place.
p4 [1]
(b) A detection or filtering measure, such as an email filter that blocks known phishing messages and links, or login monitoring or an intrusion detection system that alerts on logins from unusual places, justified by how it stops or exposes this attack.
p5 [1]
(b) Justifies using several measures together, since none is perfect, so when one fails (a staff member still clicks) another (MFA or an alert) still stops or reveals the attack.

Also accept

The kinds named in (b) are a prompt. p2 to p4 are awarded for three different valid, justified countermeasures whether or not they are of different kinds.
For p1, "spear phishing" earns the mark.
For p3, simulated phishing tests (security testing) that show staff what to look for earn the mark if justified.
For p4, blocking or flagging logins from outside the expected country earns the mark if justified.
Any other valid countermeasure with a justification tied to this attack earns one of p2 to p4 in place of a missing one, up to three countermeasures.

No marks for

For (a), "hacking" or "a virus". Neither names how the password was obtained.
For (b), "install a firewall" with no link to this attack. The staff member gave the password away, and the attacker used a normal login that a firewall would allow.
For (b), "use a stronger password". A long password typed into a fake page is stolen just as easily.
For (b), a list of measures with no justification. The command verb asks why each one helps.

A full-marks answer

(a) Phishing.

(b) First, a technical measure, multi-factor authentication on staff accounts: even with the stolen password, the attacker could not log in without the code sent to the staff member's phone. Second, a procedural measure, staff training in spotting fake emails, such as checking the sender's address and where a link really goes, and reporting anything suspicious: fewer staff would type their password into a fake page at all. Third, a detection measure, login monitoring that alerts on logins from unusual countries, together with an email filter that blocks known phishing messages: a login like this one is spotted quickly, and many fake emails never arrive. More than one measure is needed because none is perfect: if a staff member is still fooled, MFA stops the login, and if that also fails, the unusual login is detected.

Question 10

A school café records orders in one table, OrderLine. Its primary key is the composite key (order_id, item_code). The table is already in first normal form.

order_id	item_code	order_date	customer_id	customer_name	item_name	unit_price	quantity
501	C1	2026-10-12	77	Lena	Flat white	3.20	2
501	P4	2026-10-12	77	Lena	Croissant	2.50	1
502	C1	2026-10-12	80	Sam	Flat white	3.20	1
503	T2	2026-10-13	77	Lena	Mint tea	2.80	2

Assume that each order is placed by one customer on one date, and that an item's unit_price is its current price, which is the same on every order.

(a) Identify one partial dependency in OrderLine. [1]

(b) Identify one transitive dependency in OrderLine. [1]

(c) Construct a set of tables in third normal form that holds the same data as OrderLine. For each table, give its name and attributes, and state its primary key and any foreign keys. [4]

[6]

p1 [1]
(a) Names a non-key attribute that depends on only part of the composite key, with the part it depends on, for example order_date depends on order_id alone.
p2 [1]
(b) Says customer_name depends on customer_id, which is a non-key attribute. Saying that customer_id in turn depends on order_id is welcome but not required.
p3 [1]
(c) A Customer table with customer_id as its primary key and customer_name.
p4 [1]
(c) An order table with order_id as its primary key, order_date, and customer_id as a foreign key to the Customer table.
p5 [1]
(c) An Item table with item_code as its primary key, item_name and unit_price.
p6 [1]
(c) An order line table with the composite primary key (order_id, item_code), each of which is a foreign key, and quantity as its only other attribute.

Also accept

For p1, any of these earns the mark - order_date, customer_id or customer_name on order_id; item_name or unit_price on item_code.
For p2, written as an arrow chain, order_id -> customer_id -> customer_name, earns the mark.
For p4, a table called Orders or CafeOrder earns the mark. (Order is a reserved word in SQL, which a student may avoid.)
For p6, the composite key may be written as two underlined attributes, or as "PK (order_id, item_code)".

No marks for

For (a), quantity depends on order_id. Quantity needs both parts of the key, because one order has different quantities of different items.
For (b), item_name depends on item_code. That is a partial dependency on part of the key, not a transitive one.
For (b), customer_id depends on order_id. That is a dependency on the whole of order_id, not a dependency through a non-key attribute.
For (c), keeping customer_name in the order table. That leaves the transitive dependency, so the design is in second normal form only.
For (c), adding a new single-field key such as line_id to OrderLine without the foreign keys order_id and item_code.

A full-marks answer

(a) order_date depends only on order_id, which is part of the key. (p1)

(b) customer_name depends on customer_id, and customer_id depends on order_id, so customer_name depends on the key only through another non-key attribute. (p2) (c) Customer(customer_id, customer_name). Primary key customer_id. (p3) CafeOrder(order_id, order_date, customer_id). Primary key order_id; customer_id is a foreign key to Customer. (p4) Item(item_code, item_name, unit_price). Primary key item_code. (p5) OrderLine(order_id, item_code, quantity). Primary key (order_id, item_code); order_id is a foreign key to CafeOrder and item_code is a foreign key to Item. (p6)

Question 11

A school canteen records every sale in a table, Sale.

sale_id	item	quantity	sale_date
1	Wrap	4	2026-10-19
2	Soup	3	2026-10-19
3	Wrap	5	2026-10-19
4	Salad	2	2026-10-20
5	Soup	6	2026-10-20
6	Wrap	3	2026-10-20
7	Salad	4	2026-10-21
8	Soup	2	2026-10-21

(a) Construct an SQL query that shows each item with the total quantity sold of it, but only for items whose total quantity is more than 10. [3]

(b) State the rows returned by this query. [2]

SELECT item, COUNT(*)
FROM Sale
WHERE quantity >= 3
GROUP BY item;

[5]

p1 [1]
(a) Selects item and SUM(quantity) from Sale.
p2 [1]
(a) Groups the rows with GROUP BY item.
p3 [1]
(a) Filters the groups with HAVING SUM(quantity) > 10, after the GROUP BY.
p4 [1]
(b) Gives the rows Wrap with 3 and Soup with 2.
p5 [1]
(b) Gives the row Salad with 1.

Also accept

For p1, giving the total a name, such as SUM(quantity) AS total, earns the mark.
For p3, HAVING total > 10 after naming the column total earns the mark (some database systems allow it).
For (b), the rows may be given in any order.

No marks for

For (a), WHERE SUM(quantity) > 10. An aggregate cannot be used in WHERE, which filters single rows before grouping.
For (a), WHERE quantity > 10. It tests each sale, not each total, and no single sale has more than 10.
For (a), COUNT(quantity) in place of SUM(quantity). That counts sales rather than adding up quantities.
For (b), Soup with 3 and Salad with 2. That counts every sale and ignores the WHERE.

A full-marks answer

(a)

SELECT item, SUM(quantity)
FROM Sale
GROUP BY item
HAVING SUM(quantity) > 10;

The SELECT line earns p1, GROUP BY earns p2 and HAVING earns p3. On this data it returns Soup 11 and Wrap 12; Salad (6) is left out.

(b) The WHERE keeps only sales with a quantity of 3 or more, which removes sales 4 and 8. The rows are Wrap 3 and Soup 2 (p4), and Salad 1 (p5).

Question 12

A school canteen app lets students send credit to each other. When Mia (student_id 31) sends 5 credits to Leo (student_id 42), the app runs these two statements on the Wallet table.

UPDATE Wallet SET balance = balance - 5
WHERE student_id = 31;
UPDATE Wallet SET balance = balance + 5
WHERE student_id = 42;

(a) Explain why the two statements must be run as a single transaction. [2]

(b) The server crashes after the first statement has run but before the second. Outline what ROLLBACK does in this situation. [1]

(c) After COMMIT, the server loses power. State the ACID property that guarantees the transfer is still recorded when it restarts. [1]

[4]

p1 [1]
(a) Says that if only the first statement runs, 5 credits leave Mia's wallet and never reach Leo's, so credit disappears.
p2 [1]
(a) Says a transaction makes both statements happen or neither happen (atomicity), so the total credit stays correct.
p3 [1]
(b) Says ROLLBACK undoes the first statement, so Mia's balance goes back to its value before the transfer and the database is as if the transfer never started.
p4 [1]
(c) States durability.

Also accept

For p1, the case where only the second statement takes effect, so Leo gains 5 credits that came from nowhere, earns the mark.
For p2, "they succeed or fail as a unit" earns the mark.
For p3, "the database returns to the state it was in before the transaction began" earns the mark.

No marks for

For (a), "so that it is faster". A transaction is about correctness, not speed.
For (b), "ROLLBACK runs the second statement" or "it finishes the transfer". ROLLBACK undoes; it does not complete.
For (c), atomicity or consistency. The property that keeps committed changes after a crash is durability.

A full-marks answer

(a) If the server stopped between the two statements, Mia would lose 5 credits that Leo never received, so credit would disappear from the system. (p1) Run as one transaction, either both updates happen or neither does (atomicity), so the total amount of credit is always right. (p2)

(b) ROLLBACK undoes the first update, so Mia's balance goes back to what it was before, as if the transfer had never started. (p3)

Question 13

A school tests a new filter that labels each email as phishing or genuine. It runs the filter on 1000 emails whose true class is already known. The results are shown.

Actual class	Labelled phishing	Labelled genuine
Phishing (20 emails)	5	15
Genuine (980 emails)	10	970

(a) Calculate the accuracy of the filter. Show your working. [2]

(b) Explain why the accuracy is misleading as a measure of how good this filter is. [2]

[4]

p1 [1]
(a) Adds the correct predictions, 5 + 970 = 975, and divides by the 1000 emails.
p2 [1]
(a) Gives the accuracy as 97.5% (or 0.975).
p3 [1]
(b) Says phishing emails are rare (20 of 1000), so a filter that labels every email genuine would score 980 / 1000 = 98%, higher than this filter, while catching nothing.
p4 [1]
(b) Says the filter catches only 5 of the 20 phishing emails (25%), so it misses most of the class that matters, which the high accuracy hides.

Also accept

For p2, 97.5% given with no working earns p2 but not p1.
For p3, "the classes are imbalanced, so accuracy is dominated by the genuine emails" earns the mark.
For p4, "the recall for phishing is 25%" or "15 phishing emails get through" earns the mark.
For p4, pointing out that accuracy also hides the 10 genuine emails wrongly labelled phishing (which students might never see) earns the mark, if it says the single figure does not show these errors.

No marks for

For (a), 5 / 20 = 25%. That is the share of phishing caught, not the accuracy.
For (a), 970 / 980. That only counts the genuine emails.
For (b), "97.5% is too low to be useful". The problem is that the figure looks good, not that it is low.

A full-marks answer

(a) Correct predictions = 5 + 970 = 975. Accuracy = 975 / 1000 = 97.5%.

(b) Phishing is rare here: only 20 of the 1000 emails. A filter that labelled every email genuine would be right 980 times, an accuracy of 98%, while catching no phishing at all. This filter catches only 5 of the 20 phishing emails, so 15 of them, 75%, reach students, and the 97.5% figure hides that.

Question 14

A student trains a decision tree to predict whether a library book will be returned late. She tries three values for the maximum depth of the tree and measures the accuracy each time, on the training data and on separate test data.

Maximum depth	Accuracy on training data	Accuracy on test data
2	71%	70%
6	86%	84%
20	100%	68%

(a) State whether the maximum depth is a hyperparameter or a learned parameter, and give a reason. [1]

(b) Explain which maximum depth causes overfitting, and how the table shows it. [2]

[3]

p1 [1]
(a) A hyperparameter, because the student chooses it before training rather than the model learning it from the data.
p2 [1]
(b) Identifies a maximum depth of 20 as the one that overfits.
p3 [1]
(b) Explains that at depth 20 training accuracy is 100% but test accuracy falls to 68%, the lowest of the three, so the tree has fitted the training data too closely (learned its noise) and does not generalise to new books.

Also accept

For p3, "a large gap between training and test accuracy (32 percentage points)" earns the mark when linked to failing on unseen data.

No marks for

For (a), "a hyperparameter" with no reason. The reason is required.
For (b), choosing depth 2 because its accuracy is lowest on training data. Depth 2 is closer to underfitting.
For (b), "depth 20 is best because it scores 100%". That score is on data the tree has already seen.

A full-marks answer

(a) It is a hyperparameter: the student sets it before training, it is not learned from the data.

(b) A maximum depth of 20 overfits. Its accuracy on the training data is 100%, but on the test data it drops to 68%, worse than both smaller trees. The deep tree has memorised the training books, including their noise, so it does not generalise to books it has not seen.

Section B: practice scenario

Section B is in the case-study format, on a practice scenario written by Spine. It is not the IB's case study for your exam year. Read the scenario first. Each question refers to it.

Practice scenario (written by Spine, not an IB case study):

Larkford is a small city with a community bike-share called LarkBikes. It has 40 docking stations, each with between 10 and 20 docks. Each dock has a sensor that detects whether a bike is locked in it and reads the bike's ID tag. Every station sends its sensor readings to a central server over the mobile phone network every 5 minutes.

Riders register in the LarkBikes app with their name, email address, home postcode and date of birth. When a rider unlocks a bike, a trip starts. The server keeps riders, bikes, stations and trips in a relational database. Each trip record holds the rider, the bike, the start station, the end station, and the start and end times. The database now holds two years of trips.

Every evening, a machine learning model is trained on the trip records together with the hour of the day, the day of the week, whether it is a school holiday, and the weather. For each station, it predicts how many bikes will be taken in each hour of the next day. A van crew uses these predictions to move bikes to stations that are expected to run out.

The 28 stations in the city centre are busy. The 12 stations in the outer districts were added last year and record far fewer trips.

Question 15

(a) State whether the LarkBikes model performs classification or regression, and give a reason. [2]

(b) Identify one feature the model uses and the label it learns to predict. [2]

[4]

p1 [1]
(a) States that the model performs regression.
p2 [1]
(a) Gives the reason that it predicts a number (how many bikes will be taken), not one of a fixed set of categories.
p3 [1]
(b) Gives one feature named in the scenario, such as the hour of the day, the day of the week, whether it is a school holiday, the weather, or the station.
p4 [1]
(b) Gives the label as the number of bikes actually taken from a station in a given hour, counted from the trip records.

Also accept

For p2, "the output is a quantity or a count" earns the mark.
For p3, "the temperature" or "whether it is raining" earns the mark as part of the weather.
For p4, "the number of trips starting at that station in that hour" earns the mark.

No marks for

For (a), "classification, because it sorts stations into ones that will run out and ones that will not". The model outputs a number of bikes; the van crew makes that decision.
For (b), "the number of bikes taken" given as the feature. It is what the model predicts, so it is the label.
For (b), "the rider's name" as a feature. The model predicts demand per station, and a name tells it nothing about demand.

A full-marks answer

(a) Regression, because the model outputs a number, how many bikes will be taken from a station in an hour, rather than choosing a category.

(b) One feature is the hour of the day. The label is the number of bikes actually taken from that station in that hour, counted from the trip records.

Question 16

(a) Suggest a primary key for the Trip table, and explain why the rider's ID would not work as the primary key on its own. [2]

(b) Describe how the Trip table is linked to the Station table, and identify the relationship between Station and Trip. [2]

[4]

p1 [1]
(a) Suggests a trip ID that is unique to each trip, for example a number the database gives each new trip.
p2 [1]
(a) Explains that one rider makes many trips, so the rider's ID repeats in the Trip table and cannot identify a single trip.
p3 [1]
(b) Describes the Trip table holding the station ID (the Station table's primary key) as a foreign key, for the start station and for the end station.
p4 [1]
(b) Identifies a one-to-many relationship, one station to many trips (each trip starts at one station, and a station has many trips).

Also accept

For p1, a composite key of bike ID and start time earns the mark, since one bike cannot start two trips at the same moment.
For p1, a composite key of rider ID and start time earns the mark, since one rider cannot start two trips at the same moment, as long as the answer says both fields are needed together.
For p3, a description that names only one foreign key (start station ID) earns the mark.

No marks for

For (a), suggesting the start time on its own. Two riders can unlock bikes at the same minute at different stations.
For (a), suggesting the rider's name. Names are not unique and also repeat across trips.
For (b), "the tables are linked by the station name" with no idea of a key in Trip that matches Station's primary key.
For (b), "many-to-many". Each trip has exactly one start station.

A full-marks answer

(a) A TripID that the database gives each new trip, so no two trips share one. The rider's ID is not unique in the Trip table: one rider makes many trips over two years, so it cannot pick out one trip.

(b) The Trip table stores StartStationID and EndStationID as foreign keys. Each holds a value of StationID, the primary key of the Station table. The relationship is one-to-many: one station has many trips starting there, but each trip starts at exactly one station.

Question 17

The manager of LarkBikes suggests a change. The model would also take, as a feature, each station's current number of bikes from the latest sensor readings. It would still be retrained once each evening, on the past trips and the stored sensor readings. During the day, the trained model would be run again every 5 minutes on the newest readings, to update the predictions for the rest of the day. All of this would run on the existing central server.

Evaluate this suggestion. [4]

p1 [1]
Gives a benefit, for example the current bike count shows what is happening today, such as a station emptying faster than usual, so the updated predictions let the van reach it before it runs out.
p2 [1]
Explains the processing cost in terms of training and inference, for example the heavy work (training) still happens once a night, and running an already trained model for 40 stations every 5 minutes is light inference, so the existing central server can cope without extra hardware such as GPUs or cloud computing.
p3 [1]
Gives a limitation, for example the van crew cannot change its route every 5 minutes, so it is the bottleneck, or a station that loses its mobile connection gives a missing or out-of-date bike count, so its updated prediction could be wrong.
p4 [1]
Reaches a supported judgement, for example adopt it, because the extra cost is small, but send the van an updated plan only every 30 to 60 minutes, and fall back to the evening prediction for any station whose readings are missing.

Also accept

For p2, "every evening's training now has more data to learn from (the stored readings), so it takes longer" earns the mark if it is still linked to training being the heavier job.
For p4, a judgement that the change is not worth it yet, because one van cannot act on the extra updates, earns the mark if it is supported by that reason.

No marks for

Saying the sensors would have to send data more often. They already send readings every 5 minutes.
Saying the model would need retraining every 5 minutes. The suggestion only runs the trained model more often.
Listing benefits only, with no cost or limitation, or giving a judgement such as "it is a good idea" with no reason.

A full-marks answer

The current bike count tells the model what is happening today, not only what usually happens. If a station is emptying faster than usual, for example because of an event nearby, the updated predictions show it, and the van can get there before the station runs out. The processing cost is small. Training, the heavy part, still happens once each night. Running the trained model for 40 stations every 5 minutes is inference, which needs far less processing, so the existing central server can do it without GPUs or cloud computing. There are limits. One van crew cannot change its route every 5 minutes, so the van, not the model, is the bottleneck. A station that loses its mobile connection would give a missing or old bike count, and its updated prediction could be wrong. On balance I would adopt the change, because it costs little, but send the van crew a new plan only every 30 to 60 minutes, and use the evening prediction for any station whose readings are missing.

Question 18

Before training, the LarkBikes team checks the trip records and finds two problems.

Problem 1: when a station loses its mobile connection, it sends its readings again once it reconnects, and some trips from those stations are stored twice. Problem 2: about 3% of trips have no end station, because a dock sensor failed to read the bike's ID tag when the bike was returned.

(a) Explain how problem 1 would affect the predictions if the records were not cleaned. [2]

(b) Suggest a treatment for problem 2, and justify it. [2]

[4]

p1 [1]
(a) Says the duplicated trips make demand at the affected stations and hours look higher than it really was, so the model learns, and then predicts, too many bikes taken there.
p2 [1]
(a) Gives a consequence, for example the van brings bikes to stations that do not need them while other stations run out, and the error is worst at stations with poor mobile coverage, so it is not spread evenly.
p3 [1]
(b) Suggests keeping these trips for training, with the end station marked as missing, rather than deleting them.
p4 [1]
(b) Justifies it, because the label is the number of bikes taken from the start station, and the start station and start time are still known, so deleting the trips would make demand look lower than it was.

Also accept

For p3 and p4, deleting the trips earns both marks only if the justification argues that 3% is small and that the failures are spread across all stations, so no station's demand is biased. Deleting with no reason earns p3 only.
For p3, filling in the end station from the next reading of that bike's tag at a station earns the mark, with p4 for explaining that the bike's next start station is where it was returned.

No marks for

For (a), "the model will crash" or "the database will be full". Duplicates do not stop training; they mislead it.
For (a), "duplicates make the model slower" with no effect on the predictions.
For (b), "fill the end station with the most common station". That invents data that is wrong for most of those trips.

A full-marks answer

(a) The trips stored twice are counted twice, so demand at those stations, at the times their connection dropped, looks higher than it really was. The model learns that inflated demand and predicts too many bikes taken there. The van would then bring bikes to stations that do not need them while other stations run out, and the stations with the weakest mobile signal would be the most wrong.

(b) Keep these trips and mark the end station as missing. The model predicts how many bikes are taken from each station, and for these trips the start station and start time are still known. Deleting them would remove real departures and make demand look lower than it was, especially at any station whose docks fail more often.

Question 19

A data analyst trains the model on all two years of trips. She then measures its error on the same trips and reports that its predictions are wrong by only 0.3 bikes per hour on average.

(a) Explain why this figure does not show how well the model will predict tomorrow's demand. [2]

(b) A colleague suggests holding back the most recent two months of trips, training on the rest, and measuring the error on those two months. Explain why this is a better test for this model than holding back a random selection of hours (each station's count for those hours). [2]

[4]

p1 [1]
(a) Says the error was measured on the same data the model was trained on, data it has already seen.
p2 [1]
(a) Says a model can fit, or memorise, its training data closely (overfitting), so its error on new days it has not seen is likely to be higher than 0.3.
p3 [1]
(b) Says the model's real job is to predict future days from past ones, and testing on the latest two months copies that, including recent changes such as the newer outer-district stations.
p4 [1]
(b) Says a random selection of hours puts neighbouring hours from the same day, with the same weather and the same events, into both the training data and the test data, so the model has effectively seen the test days and its error looks better than it will be.

Also accept

For p2, "it does not show whether the model generalises" earns the mark.
For p4, "information leaks from the test set into training" earns the mark when linked to neighbouring hours from the same day.
For p4, saying that holding back random individual trips would split one hour's count between the two sets, so both sets would hold wrong counts, earns the mark.

No marks for

For (a), "0.3 is too high". The problem is how it was measured, not its size.
For (b), "two months is more data than a random sample". The amount is not the point; which hours are held back is.
For (b), "recent data is more accurate". Older records are not less accurate, they are just less like the days the model has to forecast.

A full-marks answer

(a) The 0.3 figure was measured on the same trips the model learned from. A model can fit its training data very closely, even memorising it, which is overfitting, so it will usually be more wrong on new days it has never seen. To know how it will do tomorrow, it must be tested on data it was not trained on.

(b) In use, the model always predicts the future from the past, and holding back the latest two months tests it in exactly that way, including recent changes such as the outer-district stations added last year. With a random selection of hours, the hours either side of a test hour, from the same day with the same weather and events, are in the training data, so the model has in effect already seen the test days, and its error would look better than it really is.

Question 20

The model predicts few trips at the outer-district stations, so the van rarely brings bikes there. Riders in the outer districts often find those stations empty.

Discuss whether it is fair to use the model's predictions to decide where the van takes bikes. [4]

p1 [1]
Explains where the low predictions come from, for example the outer stations have only one year of records and far fewer trips, so the model has little data and predicts low demand there.
p2 [1]
Explains the feedback loop, for example the trip records only count bikes actually taken, not riders who found a station empty, so empty stations record few trips, the model predicts even lower demand, and the van brings even fewer bikes.
p3 [1]
Identifies who is harmed and how, for example riders in the outer districts get a worse service for the same scheme, even if the model is accurate overall, and they may have fewer other ways to travel.
p4 [1]
Reaches a supported judgement that includes a change, for example record failed attempts to find a bike as unmet demand, or keep a minimum number of bikes at every station, and keep using the model above that minimum because it helps the busy centre.

Also accept

For p3, "the model can be accurate and still unfair, because accuracy is measured on the trips that happened" earns the mark.
For p4, a judgement that using the model is fair for now because the outer stations really are quieter, supported by a plan to check it once more data exists, earns the mark.

No marks for

Saying the model is unfair "because it is a computer" or "because AI is biased" with no link to the data.
Saying the outer-district riders should just walk to a city-centre station.
A one-sided answer with no judgement.

A full-marks answer

The low predictions come from the data. The outer stations were added only last year and record far fewer trips, so the model has little to learn from and predicts low demand there. This can feed on itself. The trip records only count bikes that were actually taken, not riders who arrived at an empty station. If the van rarely brings bikes, few trips are recorded, the model predicts even lower demand, and the van brings even fewer. The people harmed are riders in the outer districts, who are part of the same scheme but get a worse service, and who may have fewer buses or other options. The model could still be accurate overall, because accuracy is measured on the trips that happened. On the other hand, the outer stations may truly be quieter, and moving bikes to where they are used helps more riders in total. My judgement is that using the model on its own is not fair. LarkBikes should keep a minimum number of bikes at every station, record each time the app finds no bike nearby as unmet demand, and use the model to place the remaining bikes.

Back to the paper