2026 Unit 3 EST Prep
Study Notes That Help You Answer Questions
These notes focus only on the highlighted 2026 EST content. Use them to practise identifying what a question is really asking, then write short, scenario-linked answers.
What Is In Scope
If it is not on this list, do not spend most of your EST revision time on it.
How To Use These Notes
1. Read
Skim each section and underline the exact data, user, risk or hardware need in the scenario.
2. Answer
Use the response frames. Name the concept first, then apply it to the scenario.
3. Check
Ask whether your answer explains why, not just what. The best answers connect to the organisation or person affected.
Not the focus here
Do not foreground CPU internals, fetch-execute, spreadsheet builds, full database builds or the full SDLC sequence on this EST notes page unless a question directly connects them to the highlighted scope.
Topic 1
Context Diagrams
A context diagram shows the whole system as one process and the data that crosses the system boundary. It is not a screen design, database design or multi-process DFD.
Yourdon/DeMarco rules
- Process: one circle labelled with the whole system name and numbered 0.
- External entity: a rectangle for a person, organisation, department or other system outside the boundary.
- Data flow: a labelled arrow showing data moving into or out of the system.
- Not shown: internal screens, database tables, files, data stores or sub-processes.
Common EST traps
- Drawing more than one process.
- Putting a database inside the context diagram.
- Labelling arrows with actions such as "book room" instead of data such as "booking request".
- Drawing data directly between two external entities.
Accuracy check: one process, three external entities, labelled data flows, and no external-entity-to-external-entity arrows.
EST-style prompt
A uniform ordering system receives order details from parents, sends payment requests to a payment service, receives payment confirmations, sends order summaries to the uniform shop, and sends pickup notices to parents.
Task: Identify the central process, three external entities and four labelled data flows.
Model answer
Central process: Uniform Ordering System. External entities: Parent, Payment Service, Uniform Shop. Data flows: order details from Parent to system, payment request from system to Payment Service, payment confirmation from Payment Service to system, order summary from system to Uniform Shop, pickup notice from system to Parent.
Topic 2
Hardware Components For A Purpose
The mark is usually in the justification. Name the hardware category, choose a suitable device, then explain why it fits the scenario.
| Category | Job | Examples | Scenario-linked answer |
|---|---|---|---|
| Input | Captures data for the system. | Keyboard, barcode scanner, card reader, touch screen, microphone. | Visitor kiosk: touch screen because visitors can select options quickly without typing. |
| Output | Presents information from the system. | Monitor, printer, speakers, projector, display board. | Reception desk: label or receipt printer because visitors need a printed badge or pass. |
| Processing | Carries out instructions, calculations and logic. | CPU and related processing components. | Database workstation: suitable CPU because it must run the database, browser and reports reliably. |
| Primary storage | Fast temporary working storage while the computer is running. | RAM. | Student services desk: enough RAM so multiple school systems can stay open at once. |
| Secondary storage | Long-term storage that keeps data when power is off. | SSD, hard drive, external drive, network storage. | Loan records: SSD or network storage because records must be kept after the computer shuts down. |
Response frame
I would choose [hardware/device] because the system needs to [specific task]. This is suitable because [speed, accuracy, storage, reliability, ease of use, cost or environment].
Topic 3
Standard Operating Environment
An SOE is a consistent set of hardware, operating system settings, applications, security settings and configuration used across an organisation.
Strong answer pattern
An SOE would give all library staff the same approved database software, settings and security updates. This makes support easier and reduces configuration errors because technicians are working with predictable devices.
Topic 4
Privacy Considerations
Privacy means protecting personal information and respecting how people expect their data to be collected, stored, used and shared.
Topic 5
Data Protection Methods
Be precise. These methods do different jobs, so avoid saying "use security" without naming the method and the risk it reduces.
Encryption
Makes data unreadable without the correct key or method.
Best for
Sensitive files, online transmission, database backups, portable storage.
Watch for
Encryption does not prove who the user is. Pair it with access control.
Authentication
Checks that a user is who they claim to be.
Best for
Stopping unauthorised users before they access records.
Watch for
Shared logins weaken accountability because actions cannot be traced to one person.
Passwords
A knowledge-based authentication factor.
Best for
Basic account access when passwords are long, private and not reused.
Watch for
Weak, reused or shared passwords are a common cause of unauthorised access.
Biometrics
Uses a physical characteristic such as fingerprint or face pattern.
Best for
Convenient identity checks tied to a person rather than a shared secret.
Watch for
Biometric data is personal and cannot be easily changed if compromised.
Digital signatures
Help verify who approved or sent digital information and whether it changed.
Best for
Approval forms, signed documents, message integrity and non-repudiation.
Watch for
A digital signature is not the same as encrypting the whole document.
Topics 6 and 7
Legal, Ethical and Online Database Issues
Most extended responses are scenario questions. Identify the personal data, explain the risk or responsibility, then recommend a control.
Privacy scenario
A sports app stores student names, parent phone numbers, medical notes and attendance. The coach wants every player to see the full contact and medical list.
Model answer
This creates a privacy risk because medical notes and parent phone numbers are personal information. Access should be limited to authorised staff who need it, and players should only see information relevant to them.
Legal and ethical scenario
A school keeps old counselling records in an online folder long after students have left. Many staff can still open the folder.
Model answer
The organisation should consider retention, secure storage and authorised access. Keeping personal records longer than needed increases harm if there is a breach, and broad access is difficult to justify.
Online database scenario
A facility booking database is online. Staff can access it from home, but several users share one login and old bookings are never removed.
Model answer
The benefits are remote access and centralised records, but the risks are weak accountability, privacy exposure and poor retention. Each user needs an authenticated account, permissions should match roles, and old records should be archived or deleted according to policy.
Legal responsibilities can include
- Authorised collection and use of personal information.
- Secure storage and restricted access.
- Accurate records and correction processes.
- Retention, disposal and breach response.
Online database issues can include
- Weak authentication or shared accounts.
- Incorrect permissions exposing personal data.
- Data interception during transmission.
- Integrity problems when many users update records.
- Downtime, backups and legal jurisdiction concerns.