How should I use these HSC Software Engineering practice questions?

Work them under timed conditions, one module at a time, then check against the worked solutions block. Treat the multiple choice as a 20-minute block, allow roughly one minute per mark for short answer, and plan extended responses before writing. Mark yourself honestly against the solution and rewrite any answer that lost marks. These prompts are written by ExamExplained for practice, not endorsed by NESA.

What does the HSC Software Engineering exam look like?

The exam is a single 3-hour paper plus 5 minutes reading time, worth 100 marks. Section I is 20 multiple choice questions for 20 marks. Section II is short answer for 60 marks across all four modules, with frequent code-reading and SQL. Section III is one or two extended responses for 20 marks that usually integrate two or more modules, for example secure software architecture applied to a web application.

How much coding appears in the HSC Software Engineering exam?

A lot. Almost every section includes short code snippets in Python, JavaScript, SQL or pseudocode. You are asked to predict output, find and fix bugs, and write short functions. NESA is language agnostic, but you must be able to read all three of Python, JavaScript and SQL even if you only write fluently in one. The Software Automation module is more conceptual, but still expects you to reason about data and algorithms.

How do I structure an extended response in Software Engineering?

Read the verb and the marks. A 7 to 9 mark question usually wants a structured response with an introduction, two or three developed points with concrete examples or code, and a short evaluative conclusion. Use the directive verb (describe, explain, evaluate, assess) to set the depth. Integrate modules where the question invites it, for example tie an OWASP risk to a specific server-side mitigation.

§-Study guide

NSWSoftware Engineering

HSC Software Engineering practice questions for 2026 with worked solutions

Practice questions for the 2026 HSC Software Engineering exam across all four Year 12 modules, with fully worked solutions. Multiple choice, short answer, code-reading and extended response, modelled on the NESA paper structure.

Generated by Claude Opus 4.818 min readNESA-SENG-12Updated 2026-06-30

Reviewed by: AI editorial process; not yet individually human-reviewed

Jump to a section

How to use these practice questions
Section I: Multiple choice (Modules 1 to 4)
Section II: Short answer
Section III: Extended response
Check your knowledge
Where to go next

How to use these practice questions

HSC Software Engineering rewards two things at once: conceptual fluency and hands-on coding. These practice questions cover all four Year 12 modules (Secure Software Architecture, Programming for the Web, Software Automation, and the Software Engineering Project) in the formats NESA uses: multiple choice, short answer, code reading, and extended response.

Work them under timed conditions. The real paper gives you about one minute per mark, so a 20-mark multiple choice section is roughly 20 minutes and a 6-mark short answer is about 6 minutes. Plan extended responses before you write. After each block, check the worked solutions and rewrite anything that lost marks. Do not move on until you can articulate why the marking answer earns full marks.

These prompts are written by ExamExplained for practice. They are modelled on the structure and rubric language of past NESA Software Engineering papers but are not endorsed by NESA. Use them alongside the official NESA past papers and sample papers.

Section I: Multiple choice (Modules 1 to 4)

Which OWASP Top 10 (2021) category best describes an attacker reading another user's invoice by changing the id in the URL /api/invoices/123 to /api/invoices/124?
(A) Injection (B) Cryptographic failures (C) Broken access control (D) Security misconfiguration
A web server responds with the status line HTTP/1.1 301 Moved Permanently. What does this tell the client?
(A) The request succeeded and the body contains the resource
(B) The resource has permanently moved and the client should use the new URL in the Location header
(C) The client is not authenticated
(D) The server encountered an error
Which statement about symmetric and asymmetric encryption is correct?
(A) Symmetric encryption uses a public and private key pair
(B) Asymmetric encryption is generally faster than symmetric encryption
(C) Symmetric encryption uses the same key to encrypt and decrypt
(D) Hashing is a form of symmetric encryption
A model is trained on a dataset of loan applications labelled "approved" or "rejected". This is an example of:
(A) Unsupervised learning (B) Supervised learning (C) Reinforcement learning (D) Clustering
In Git, which command stages a modified file so it will be included in the next commit?
(A) git commit file.py (B) git push file.py (C) git add file.py (D) git clone file.py

Section II: Short answer

(Module 1, 4 marks) Explain the difference between authentication and authorisation. Give one concrete example of each in a web application that has ordinary users and administrators.
(Module 1, 3 marks) A developer stores user passwords using only the MD5 hash function with no salt. Identify two weaknesses of this approach and state a better practice for each.
(Module 2, 5 marks) Consider the following SQL schema and query.

CREATE TABLE students (id INTEGER PRIMARY KEY, name TEXT, atar REAL);
CREATE TABLE enrolments (student_id INTEGER, course TEXT);

SELECT s.name, COUNT(e.course) AS course_count
FROM students s
LEFT JOIN enrolments e ON e.student_id = s.id
GROUP BY s.id
HAVING COUNT(e.course) >= 2;

(a) Explain what this query returns. (b) Explain why a LEFT JOIN is used here rather than an INNER JOIN, and what effect the HAVING clause has. (c) Rewrite the query so it instead returns students enrolled in exactly zero courses.

(Module 2, 4 marks) Read the following Python (Flask) route and identify the security vulnerability, then rewrite the database call to remove it.

@app.get("/search")
def search():
    term = request.args.get("q")
    rows = db.execute("SELECT * FROM products WHERE name LIKE '%" + term + "%'")
    return jsonify(rows)

(Module 3, 5 marks) Compare supervised and unsupervised learning. For each, state what the training data looks like and give one realistic application.
(Module 3, 3 marks) Explain what overfitting is, how you would detect it, and one technique to reduce it.
(Module 4, 4 marks) Describe the difference between the waterfall and agile (Scrum) software development methodologies. Identify one project situation that suits each.
(Module 4, 3 marks) Predict the output of the following Python and identify the off-by-one style bug.

def running_total(values):
    totals = []
    total = 0
    for i in range(1, len(values)):
        total += values[i]
        totals.append(total)
    return totals

print(running_total([10, 20, 30]))

Section III: Extended response

(Integrates Modules 1 and 2, 9 marks) A small business runs an online booking web application that stores customer names, contact details and payment card numbers. Recent audits found that the site sends data over plain HTTP, builds SQL queries by string concatenation, and stores passwords as plain text.

Evaluate the security of this application and recommend a set of improvements. In your response, refer to at least three distinct OWASP Top 10 risks and pair each with a specific developer-side mitigation that fits into a secure development lifecycle.

(Integrates Modules 3 and 4, 7 marks) A company plans to deploy a machine learning model that screens job applications and ranks candidates. Discuss the ethical risks of this system and describe the software engineering practices (across development, testing and deployment) that the team should adopt to manage those risks responsibly.

Check your knowledge

Attempt every question above under exam conditions before reading on. Then mark yourself against the worked solutions block, paying attention to the marking notes that say what an examiner rewards.

Solutions

Q1: (C) Broken access control. The attacker changes a record identifier they should not be able to access. This is insecure direct object reference, a subcategory of broken access control. Mitigation: enforce object-level authorisation on every endpoint so the server checks the current user actually owns invoice 124.
Q2: (B). A 301 means the resource has permanently moved; the client should follow the URL in the Location response header and update any stored links. Contrast with 302 (temporary), 200 (success with body), 401 (unauthenticated) and 5xx (server error).
Q3: (C). Symmetric encryption uses one shared secret key for both encryption and decryption (fast, used for bulk data). Asymmetric encryption uses a public and private key pair (slower, used for key exchange and digital signatures). Hashing is one-way and is not encryption.
Q4: (B) Supervised learning. The data has labels (approved or rejected), so the model learns the mapping from features to label. Unsupervised learning has no labels; reinforcement learning learns from rewards through interaction.
Q5: (C) git add file.py stages the file. git commit records staged changes, git push uploads commits to a remote, and git clone copies a whole repository.
Q6: Authentication answers "who are you" and verifies identity, for example logging in with a username and a password (ideally with multi-factor authentication). Authorisation answers "what are you allowed to do" and controls access to resources, for example only a user with the admin role can open /admin/users while an ordinary user is denied. Markers reward the identity versus permission distinction plus one concrete example of each. A strong answer notes that authentication happens first and authorisation is checked on every request, server-side.
Q7: Weakness 1: MD5 is fast and cryptographically broken, so an attacker can brute-force or use rainbow tables to recover passwords quickly. Better practice: use a slow, purpose-built password hashing function such as bcrypt or Argon2 with a work factor. Weakness 2: with no salt, identical passwords produce identical hashes, so one cracked hash exposes every user who chose that password, and precomputed rainbow tables apply. Better practice: add a unique random salt per user (modern functions like bcrypt and Argon2 do this automatically). Markers reward two distinct weaknesses each paired with a specific remedy.
Q8: (a) The query lists the name of each student together with how many courses they are enrolled in, but only for students enrolled in two or more courses. (b) A LEFT JOIN keeps every student even if they have no matching enrolments (those would show course_count of 0), whereas an INNER JOIN would silently drop students with no enrolments. The HAVING clause filters the grouped results after aggregation; you must use HAVING rather than WHERE because the filter is on the aggregate COUNT. (c) Students with zero courses:

SELECT s.name
FROM students s
LEFT JOIN enrolments e ON e.student_id = s.id
GROUP BY s.id
HAVING COUNT(e.course) = 0;

(Equivalently, a WHERE NOT EXISTS subquery would work.) Markers reward a correct reading of the original query, the reason for LEFT JOIN, the HAVING versus WHERE point, and a correct rewrite.

Q9. The route concatenates untrusted user input (term) directly into a SQL string, which is a SQL injection vulnerability (OWASP injection). An attacker can submit a value that breaks out of the string and runs arbitrary SQL. Fix with a parameterised query so input is always treated as data:

@app.get("/search")
def search():
    term = request.args.get("q", "")
    rows = db.execute(
        "SELECT * FROM products WHERE name LIKE ?",
        ("%" + term + "%",),
    )
    return jsonify(rows)

The wildcard characters are built into the bound parameter, and the database driver escapes the value. Markers reward naming SQL injection and a correct parameterised rewrite, not just "validate the input".

Q10: Supervised learning trains on labelled data, where each example has features plus the known correct answer (the label); the model learns the function from features to label. Example application: classifying email as spam or not spam, trained on messages a user has already marked. Unsupervised learning trains on unlabelled data (features only) and finds structure on its own. Example application: customer segmentation, where a clustering algorithm groups shoppers with similar buying habits without anyone defining the groups in advance. The key difference is the presence or absence of labels. Markers reward both definitions, the labels versus no labels distinction, and a realistic application for each.
Q11: Overfitting is when a model learns the training data too closely, including its noise, so it performs well on training data but poorly on new, unseen data. Detect it by holding out a validation or test set: a large gap between high training accuracy and low validation accuracy signals overfitting. Reduce it by techniques such as gathering more training data, simplifying the model, regularisation, dropout (for neural networks), or early stopping. Markers reward a correct definition emphasising poor generalisation, a detection method using held-out data, and one valid mitigation.
Q12: Waterfall is a sequential, plan-driven methodology: requirements, then design, then implementation, then testing, then maintenance, with each phase completed before the next begins. Agile (Scrum) is iterative and incremental: work proceeds in short sprints that each produce a working increment, with continuous feedback and changing requirements welcomed. Waterfall suits projects with stable, well-understood requirements and fixed regulatory constraints (for example, safety-critical avionics). Agile suits projects with evolving requirements and a need for frequent user feedback (for example, a consumer web app). Markers reward the sequential versus iterative contrast and a suitable situation for each.
Q13: Output: [20, 50]. The bug is that the loop starts at index 1 (range(1, len(values))), so the first value (10) is never added and the first running total is missing. The intended output of a running total over [10, 20, 30] is [10, 30, 60]. Fix by starting the loop at index 0: for i in range(len(values)), or iterate directly over the values. Markers reward the correct predicted output and identifying that the loop skips the first element.
Q14: A full-mark response evaluates the current state as insecure and structures recommendations around at least three OWASP risks, each with a concrete mitigation tied to the secure development lifecycle.

Cryptographic failures: the site uses plain HTTP and stores passwords in plain text, exposing data in transit and at rest. Mitigation: enforce HTTPS site-wide (TLS), hash passwords with bcrypt or Argon2 with per-user salts, and encrypt or tokenise stored card data (ideally do not store full card numbers at all; use a compliant payment provider).
Injection (SQL injection): queries are built by string concatenation. Mitigation: use parameterised queries everywhere and validate input against an allow-list. Add static analysis (SAST) to the build to catch unsafe query construction.
Broken access control: a likely risk given the poor security posture. Mitigation: enforce server-side authorisation checks on every endpoint, deny by default, and test for insecure direct object references.

Tie these to the secure development lifecycle: threat modelling during design, secure coding standards and code review during development, dependency scanning, and security testing (SAST, DAST and a penetration test) before deployment. A strong conclusion states that security must be built in from the start, not bolted on, and prioritises the highest-impact fixes (HTTPS and password hashing) first. Markers reward three distinct, correctly named OWASP risks, a specific developer-side mitigation for each, and integration with the lifecycle.

Q15. A strong response separates ethical risks from engineering practices and connects them.

Ethical risks: algorithmic bias (a model trained on historical hiring data can learn and amplify past discrimination, as in well-documented cases of resume-screening tools disadvantaging women); lack of transparency and explainability (candidates rejected by a black-box model have no clear reason or avenue for appeal); privacy (applicant data is sensitive personal information); and accountability (who is responsible when the system makes an unfair decision).

Software engineering practices to manage these: during development, audit and balance training data, document data provenance, and consider fairness-aware techniques; choose more interpretable models or add explanation tooling where possible. During testing, evaluate the model for disparate impact across protected groups, not just overall accuracy, and keep a held-out test set. During deployment, keep a human in the loop for final decisions, log decisions for audit, monitor for drift, and provide an appeals process. Manage the project with version control, code review and a clear methodology so changes are traceable. Markers reward identifying concrete ethical risks (especially bias and explainability) and pairing them with realistic engineering and governance practices across the lifecycle.

Where to go next

For deeper coverage of the modules these questions draw on, read our Secure Software Architecture deep dive and Programming for the Web deep dive. For dot-point-level answers, browse the full syllabus index.

For the official HSC Software Engineering papers and sample papers, refer to NESA at educationstandards.nsw.edu.au.

software-engineering
practice-questions
hsc-software-engineering
year-12
exam-prep
2026