L6M7 Paper 1 FREE

✅ Correct Answer: Volume

📌 Explanation
Volume is the first of the three Vs of big data and refers to the sheer quantity of data an organisation must store and process. A rise from gigabytes to petabytes is a pure scale increase, which is exactly what Volume captures in the 3Vs model.

❌ Why the other options are wrong:
Velocity — concerns the speed at which data arrives, not how much is held.
Variety — concerns the mix of data formats, not scale.
Veracity — is a later add-on describing data trustworthiness, not the quantity described here.

📋 LO: 1.1.2 — The three Vs of big data
📑 Indicative content: Volume, velocity and variety as the defining characteristics of big data

✅ Correct Answer: Velocity

📌 Explanation
Velocity is the second of the three Vs and describes the rate at which data is generated and must be captured or processed. Real-time sensor feeds and rapid transaction streams are classic velocity challenges in the 3Vs model.

❌ Why the other options are wrong:
Volume — describes the quantity of data, not its speed.
Variety — describes the range of formats, not the rate of flow.
Validity — is not one of the core three Vs and concerns data correctness.

📋 LO: 1.1.2 — The three Vs of big data
📑 Indicative content: Volume, velocity and variety as the defining characteristics of big data

✅ Correct Answer: Variety

📌 Explanation
Variety is the third of the three Vs and refers to the many different formats of data an organisation handles, from structured records to unstructured audio and images. A blend of GPS data, documents and voice notes is a textbook variety challenge in the 3Vs model.

❌ Why the other options are wrong:
Volume — concerns quantity of data, not the range of formats.
Velocity — concerns the speed of arrival, not the diversity of types.
Visibility — is not one of the recognised three Vs.

📋 LO: 1.1.2 — The three Vs of big data
📑 Indicative content: Volume, velocity and variety as the defining characteristics of big data

✅ Correct Answer: IoT sensors on equipment and Social media feeds

📌 Explanation
Recognised sources of big data in the supply chain include sensors and connected devices, third parties, web applications and social media. IoT sensors and social media feeds are both listed sources that generate large external data volumes for analysis.

❌ Why the other options are wrong:
The 3Vs framework — is a way of characterising big data, not a source of it.
Data masking — is a secure-administration technique, not a source of data.

📋 LO: 1.2.4 — Sources of data
📑 Indicative content: Sources such as sensors, devices, third parties, web applications and social media

✅ Correct Answer: Sensors and connected devices

📌 Explanation
Sensors and connected devices are a primary source of big data, automatically generating continuous readings such as temperature, location and machine status. This is one of the syllabus's named data sources feeding supply-chain analytics.

❌ Why the other options are wrong:
Third-party data providers — supply purchased or shared datasets, not the machine's own readings.
Web application logs — record user interactions with software, not production-line device output.
Manual spreadsheets — are human-entered and not the automated device source described.

📋 LO: 1.2.4 — Sources of data
📑 Indicative content: Sources such as sensors, devices, third parties, web applications and social media

✅ Correct Answer: Third-party data providers

📌 Explanation
Third parties are a recognised source of big data, supplying purchased or shared datasets that an organisation does not generate itself. Buying consumer datasets from a broker to enrich a model is a direct use of this third-party source.

❌ Why the other options are wrong:
Sensors and devices — generate the firm's own machine readings, not externally bought datasets.
Social media platforms — provide public user content, which is a distinct named source from purchased broker data.
Internal ERP records — are the firm's own transactional data, not third-party data.

📋 LO: 1.2.4 — Sources of data
📑 Indicative content: Sources such as sensors, devices, third parties, web applications and social media

✅ Correct Answer: Semi-structured data

📌 Explanation
The data-type taxonomy distinguishes structured, semi-structured and unstructured data. XML and RSS feeds carry tags and markup that give partial organisation without a rigid table schema, which defines them as semi-structured data.

❌ Why the other options are wrong:
Structured data — fits a fixed schema such as rows and columns, which tagged feeds do not.
Unstructured data — has no organising markup at all, such as free-text or raw video.
Streaming data — describes how data arrives over time, not its structural category.

📋 LO: 1.2.5 — Types of data
📑 Indicative content: Structured, semi-structured (XML, RSS) and unstructured data types

✅ Correct Answer: Real-time data

📌 Explanation
The data-type taxonomy contrasts real-time data with delayed or batch data. Data delivered continuously as events occur, rather than collected and processed later, is real-time data, which supports immediate decision-making.

❌ Why the other options are wrong:
Delayed data — is the opposite, processed in scheduled batches after collection.
Single-dimension data — refers to measuring one attribute, not the timing of delivery.
Semi-structured data — describes format such as XML, not delivery timing.

📋 LO: 1.2.5 — Types of data
📑 Indicative content: Real-time versus delayed data; multi-dimension versus single-dimension data; streaming data

✅ Correct Answer: The falling cost of storage and computing power

📌 Explanation
The move from technical problem to business opportunity was driven by the falling cost of storage and processing, which made it economic to keep and analyse ever-larger datasets. Cheaper capacity turned a scalability crisis into a chance to exploit big data for competitive advantage.

❌ Why the other options are wrong:
Stricter data protection law — constrains handling but did not create the opportunity to store more data cheaply.
A reduction in data volumes — is the reverse of what happened; volumes rose sharply.
The removal of analytics tools — would reduce, not enable, the opportunity.

📋 LO: 1.2.1 — The need for large volumes of detailed data
📑 Indicative content: How falling IT cost and rising capacity turn a technical problem into a business opportunity

✅ Correct Answer: Retaining all personal data indefinitely for future use

📌 Explanation
GDPR's principles include lawfulness, purpose limitation, data minimisation and storage limitation, the last of which requires data to be kept no longer than necessary. Retaining data indefinitely directly contradicts storage limitation, so it is the correct choice in this NOT question; the others are genuine principles.

❌ Why the other options are wrong:
Processing data lawfully and fairly — is a genuine GDPR principle.
Collecting data only for a specified purpose — is the purpose-limitation principle.
Keeping personal data accurate and up to date — is the accuracy principle.

📋 LO: 2.1.2 — Legal considerations in handling data
📑 Indicative content: The Data Protection Act, GDPR 2016 and responsible handling of personal data

✅ Correct Answer: The General Data Protection Regulation (GDPR)

📌 Explanation
The General Data Protection Regulation is the EU-wide framework governing the lawful processing of personal data, built on principles such as lawfulness, purpose limitation and data-subject rights. It is the primary legal instrument the syllabus cites for handling personal data.

❌ Why the other options are wrong:
ISO/IEC 27001 — is an information-security management standard, not a data-privacy law.
PCI DSS — governs cardholder payment data, not personal data generally.
The Trusted Computing Group specification — is a hardware-security body's work, not privacy legislation.

📋 LO: 2.1.2 — Legal considerations in handling data
📑 Indicative content: The Data Protection Act, GDPR 2016 and responsible handling of personal data

✅ Correct Answer: A non-disclosure agreement (NDA)

📌 Explanation
A non-disclosure agreement is the legal instrument used to bind parties to keep shared commercial or technical information confidential. It is the syllabus's named tool for protecting sensitive data exchanged between organisations before or during collaboration.

❌ Why the other options are wrong:
A data-processing consent form — captures an individual's permission to process personal data, not inter-firm confidentiality.
A PCI DSS certificate — evidences payment-card security compliance, not confidentiality of shared data.
A service-level agreement — defines performance standards, not confidentiality obligations.

📋 LO: 2.1.2 — Legal considerations in handling data
📑 Indicative content: Non-disclosure agreements and intellectual property rights in data handling

✅ Correct Answer: Intellectual property rights (IPR)

📌 Explanation
Intellectual property rights protect the ownership of creations such as databases, designs and proprietary datasets, allowing the owner to control their use and commercial exploitation. IPR is the syllabus's named framework for legal ownership of created data assets.

❌ Why the other options are wrong:
Data-subject access rights — belong to individuals over their personal data, not to the firm over its dataset.
Information assurance — is a risk-management discipline, not a legal ownership right.
Physical data integrity — concerns protecting data from corruption, not ownership.

📋 LO: 2.1.2 — Legal considerations in handling data
📑 Indicative content: Non-disclosure agreements and intellectual property rights in data handling

✅ Correct Answer: No, because GDPR also covers personal data held in structured manual filing systems

📌 Explanation
GDPR protects personal data regardless of medium, extending to structured manual filing systems as well as electronic records. Tomas is therefore wrong to limit it to computerised data, as the regulation's scope is defined by the data being personal, not by the storage technology.

❌ Why the other options are wrong:
Yes, because paper records are outside all data-protection law — is false; structured manual records are within scope.
Yes, because only digital data can identify an individual — is false; paper records can identify individuals too.
No, because GDPR applies only to anonymised data — reverses the position, as GDPR governs identifiable personal data.

📋 LO: 2.1.2 — Legal considerations in handling data
📑 Indicative content: The Data Protection Act, GDPR 2016 and responsible handling of personal data

✅ Correct Answer: The Data Protection Act

📌 Explanation
The UK Data Protection Act is the domestic statute that sits alongside GDPR to regulate the handling of personal data within the UK. The syllabus pairs the two as the core legal framework for responsible data handling.

❌ Why the other options are wrong:
The Computer Misuse Act — criminalises unauthorised access to systems, not general personal-data handling.
The Freedom of Information Act — governs public access to official information, not personal-data protection.
The EU Data Protection Directive — is EU-level and was superseded by GDPR, not the UK domestic statute.

📋 LO: 2.1.2 — Legal considerations in handling data
📑 Indicative content: The Data Protection Act, GDPR 2016 and responsible handling of personal data

✅ Correct Answer: PCI DSS

📌 Explanation
The Payment Card Industry Data Security Standard sets mandatory controls for storing, transmitting and processing cardholder payment data. It is the syllabus's named standard purpose-built for payment-card security, distinct from broader information-security standards.

❌ Why the other options are wrong:
ISO/PAS 28000 — addresses supply-chain security management generally, not payment data.
ISO 14001 — is an environmental-management standard, unrelated to data security.
ISO/IEC 27002 — is a code of practice for information-security controls, not payment-card specific.

📋 LO: 2.3.2 — Standards relevant to data and security
📑 Indicative content: Standards such as the Payment Card Industry Data Security Standard (PCI DSS)

✅ Correct Answer: The accuracy, completeness and consistency of data

📌 Explanation
Data integrity concerns keeping data accurate, complete and consistent over its lifecycle, whereas data security concerns protecting data from unauthorised access. The syllabus draws this distinction: integrity is about correctness, security is about protection.

❌ Why the other options are wrong:
Preventing unauthorised access to data — describes data security, not integrity.
Encrypting data in transit and at rest — is a security control, not the definition of integrity.
Recovering data after a disaster — is resilience or business continuity, not integrity.

📋 LO: 2.1.1 — The difference between data integrity and data security
📑 Indicative content: Distinguishing data integrity (accuracy and consistency) from data security (protection)

✅ Correct Answer: Malware

📌 Explanation
Malware is malicious software designed to damage, disrupt or gain access to systems, and self-replicating code that spreads and corrupts files is a classic example. It is one of the syllabus's named drivers of supply-chain cyber-security risk.

❌ Why the other options are wrong:
Counterfeit hardware — is compromised physical components, not spreading software.
Data masking — is a protective administration technique, not a threat.
System redundancy — is a resilience measure, not an attack.

📋 LO: 3.1.3 — Drivers of supply chain cyber security risk
📑 Indicative content: Drivers including cyber-terrorism, malware, data theft, illegal access and vulnerabilities

✅ Correct Answer: An advanced persistent threat (APT)

📌 Explanation
An advanced persistent threat is a prolonged, targeted intrusion in which an attacker maintains covert access to exfiltrate data over an extended period. Stealthy, sustained data theft over months is the defining pattern of an APT among the syllabus's cyber-security drivers.

❌ Why the other options are wrong:
A denial-of-service flood — aims to disrupt availability, not to quietly steal data over time.
A physical redundancy failure — is a resilience issue, not a deliberate attack.
An information-assurance audit — is a governance activity, not a threat.

📋 LO: 3.1.3 — Drivers of supply chain cyber security risk
📑 Indicative content: Drivers including data theft and advanced persistent threats (APT)

✅ Correct Answer: Improved staff cyber-awareness training

📌 Explanation
Drivers of supply-chain cyber-security risk include malware, data theft, illegal access and software vulnerabilities. Improved staff cyber-awareness training is a control that reduces risk, not a driver of it, making it the correct choice in this NOT question.

❌ Why the other options are wrong:
Malware infection — is a genuine driver of cyber-security risk.
Illegal access to systems — is a genuine driver of cyber-security risk.
Software and network vulnerabilities — are genuine drivers of cyber-security risk.

📋 LO: 3.1.3 — Drivers of supply chain cyber security risk
📑 Indicative content: Drivers including malware, illegal access and software/network vulnerabilities

✅ Correct Answer: Cyber-terrorism and Counterfeit hardware entering the supply chain

📌 Explanation
Supply Chain Cyber Security identifies drivers that increase risk, including cyber-terrorism and counterfeit hardware introduced through the supply chain. Both are named threats that expand the attack surface across supplier networks.

❌ Why the other options are wrong:
Buying only from trusted vendors — is a measure to minimise SCCS risk, not a driver of it.
Isolating critical machines — is a risk-reduction control, not a driver.

📋 LO: 3.1.3 — Drivers of supply chain cyber security risk
📑 Indicative content: Drivers including cyber-terrorism and counterfeit hardware in the supply chain

✅ Correct Answer: Data masking

📌 Explanation
Data masking replaces real sensitive values with realistic but fictitious data so that systems can be tested or used without exposing genuine records. It is a named secure-administration technique for protecting data in non-production environments.

❌ Why the other options are wrong:
Data erasure — permanently destroys data rather than substituting realistic values for use.
System redundancy — duplicates systems for resilience, not for concealing data.
Physical integrity control — protects data from corruption, not from exposure to testers.

📋 LO: 3.2.4 — Secure administration of systems
📑 Indicative content: Secure administration through backups, data masking and data erasure

✅ Correct Answer: Encryption

📌 Explanation
Encryption converts readable data into ciphertext that can only be decoded with the correct key, protecting it in transit and at rest. It is the syllabus's named software solution for securing data exchanged between systems.

❌ Why the other options are wrong:
Backups — provide recovery copies but do not make data unreadable to interceptors.
Data masking — substitutes fictitious values for testing, rather than reversibly encoding live data with a key.
Counterfeit detection — checks hardware authenticity, not data confidentiality in transit.

📋 LO: 3.2.2 — Software solutions and encryption
📑 Indicative content: Encryption as a software solution to secure data in the supply chain

✅ Correct Answer: Protecting the whole network of suppliers and partners from cyber threats

📌 Explanation
Supply Chain Cyber Security extends protection beyond a single organisation to the entire connected network of suppliers, partners and systems, recognising that risk enters through weaker links. It treats the supply chain, not just the firm, as the boundary to defend.

❌ Why the other options are wrong:
Securing only the buying organisation's own servers — is too narrow; SCCS spans the whole chain.
Auditing financial transactions for fraud — is a finance control, not cyber-security of the supply chain.
Improving the accuracy of demand forecasts — is an analytics goal, not a security practice.

📋 LO: 3.1.2 — Supply chain cyber security
📑 Indicative content: The concept of Supply Chain Cyber Security (SCCS) across the supplier network

✅ Correct Answer: Backups

📌 Explanation
Backups are a core secure-administration control, holding recoverable copies of data so a system can be restored after failure, corruption or attack. The syllabus lists backups alongside data masking and data erasure as secure-administration measures.

❌ Why the other options are wrong:
Data erasure — permanently destroys data at end of life; it does not create a recoverable copy.
Data masking — hides real values for testing; it is not a recovery mechanism.
Encryption — protects confidentiality but does not by itself provide a recoverable copy.
Counterfeit-hardware screening — checks component authenticity, not data recoverability.

📋 LO: 3.2.4 — Secure administration of systems
📑 Indicative content: Secure administration through backups, data masking and data erasure