BTEC National in Information Technology

Complete Study Guide

Units 1 & 2 — External Examinations
Pearson Specification Issue 5 | First examination May/June 2026

How to use this guide

This guide covers all examinable content for Unit 1 (Information Technology Systems) and Unit 2
(Cyber Security and Incident Management). Both units are externally examined: Unit 1 is a 2-hour
exam worth 90 marks; Unit 2 is a 2h 15min exam also worth 90 marks.
Each section includes: key terms to learn, core content notes, and examiner tips on how to
approach different question types (State, Describe, Explain, Evaluate).
 UNIT 1: INFORMATION TECHNOLOGY SYSTEMS

How to Answer Unit 1 Questions

The exam uses specific command words. Each one expects a different type of response:
Term Definition
State / Name / Give One word or short phrase. No explanation needed. Don't
waste time here.
Describe Several key features. Use phrases like 'this means that...' to
show understanding.
Explain A point PLUS a reason. 'X because Y.' Without the
reasoning, you lose marks.
Evaluate Weigh up strengths and weaknesses. End with a justified
conclusion — this is required for full marks.

Content Area A: IT Systems & Devices

A1–A2: Digital Devices & Peripherals
You need to know the features and uses of these device types:
• Personal computers — general purpose, business and home use
• Servers — file, application, web servers; central storage and services for networks
• Mobile devices — smartphones, tablets; portable, touch-based, cellular connectivity
• Embedded systems — sensors, IoT devices; built into other products (e.g. smart thermostats,
car ECUs)
• Multifunctional devices — combine scanner, printer, copier
• Entertainment systems — gaming consoles, smart TVs
• Navigation systems — GPS-based, real-time mapping
• Communication devices — routers, modems, VoIP phones
Peripheral devices: input (keyboard, mouse, scanner, microphone), output (monitor, printer,
speakers), storage (HDD, SSD, USB drives, optical discs).
Exam tip: When asked about devices in context (e.g. a healthcare scenario), always link the
feature to the specific use — e.g. 'A server would be used because it provides centralised
storage accessible to all staff on the network'.

A3: Operating Systems & Software

Types of operating system:
• Batch — processes jobs in groups without user interaction (e.g. payroll)
• Distributed — runs across multiple machines that appear as one
• Multitasking — runs multiple processes simultaneously
• Real-time OS — responds instantly (used in critical systems like aircraft or medical devices)
• Network OS — manages resources across a network
• Mobile OS — lightweight, touchscreen-optimised (iOS, Android)
OS management roles: networking, security (access control, firewalls, encryption), memory
management (virtual memory, paging), multitasking (process scheduling), device drivers, user
accounts.
 Exam tip: 'Explain how the OS manages memory' = explain virtual memory, paging,
allocation/deallocation with a reason for each — not just list them.

A3.7: File Types & Formats

Term Definition
JPEG Lossy image format. Smaller file sizes, good for photos.
Quality lost on repeated saving.
PNG Lossless image format. Preserves quality. Larger files. Good
for graphics with transparency.
MP3 Lossy audio format. Compresses audio by removing
frequencies less audible to humans.
WAV Uncompressed audio. High quality, very large files.
MP4 Video container using lossy compression (H.264 codec
typically). Widely compatible.
AVI Older video container. Less compressed than MP4.
EXE / APP Application software format. Platform-specific (Windows vs
macOS vs Android).

A5: Emerging Technologies

You need to understand the implications of emerging technologies and AI on:
• IT system performance — AI can optimise resource allocation and predict failures
• Personal use — virtual assistants, smart devices, personalised services
• Organisational use — automation of tasks, data analysis at scale, AI-driven decision-making
Exam tip: For a 6-mark evaluate question on AI, structure it: benefits (2 points with explanation)
+ drawbacks (2 points with explanation) + conclusion (1 sentence).

Content Area B: Transmitting Data

B1–B2: Connectivity & Networks
Wired vs wireless connection types:
Term Definition
Ethernet Wired, fast, reliable, up to 10Gbps+. No interference. Used in
offices/businesses.
Wi-Fi Wireless, flexible, subject to interference. Uses radio waves.
Bluetooth Short-range wireless (PAN). Low power. For peripherals,
wearables.
USB Wired, direct connection between devices. Transfers data
and power.
Network types:
• PAN — Personal Area Network. Small range, e.g. Bluetooth devices
• LAN — Local Area Network. Single building/site. Fast, private.
• WAN — Wide Area Network. Spans large geography. The internet is the largest WAN.
• VPN — Virtual Private Network. Encrypted tunnel over a public network. Used for remote
working.
Network topologies: Star (all devices connect to central switch — most reliable, failure of one device
doesn't affect others), Ring (data travels in one direction — failure anywhere breaks the network),
Bus (all devices share one backbone — cheap but slow and unreliable).
Exam tip: Star topology is almost always the best answer for a business. If asked to compare,
say: star is more reliable (single point failure doesn't affect whole network) but costs more due to
cabling requirements.

B3: Data Transmission Issues

Protocols — rules governing data transmission:
• HTTP/HTTPS — web pages. HTTPS is encrypted (TLS). Always recommend HTTPS for
secure data.
• SMTP — sends email. POP — downloads email. IMAP — syncs email across devices.
• TCP/IP — foundation of internet communication. Breaks data into packets.
Bandwidth — maximum amount of data transmitted per second (Mbps/Gbps). Latency — delay
between sending and receiving data. High bandwidth + low latency = best performance.

B3.5–B3.6: Compression & Codecs

This is the topic your current cornell notes are on — so pay attention:
Term Definition
Lossy compression Permanently removes data to reduce file size. Quality is
degraded. Cannot be reversed. Examples: JPEG, MP3, MP4.
Lossless compression Reduces file size without losing any data. Original can be
perfectly restored. Examples: PNG, FLAC, ZIP.
Codec COder-DECoder. Software/hardware that encodes
(compresses) and decodes (decompresses) audio or video
data for transmission or storage.
Bitrate Amount of data processed per second. Higher bitrate = better
quality but larger file.
Common codecs: H.264/H.265 (video), AAC/MP3 (audio). H.265 achieves same quality as H.264 at
half the file size.
Why codecs matter: without compression, a 2-hour HD film would be hundreds of gigabytes.
Codecs make streaming viable by reducing file sizes while maintaining acceptable quality.
Exam tip: 'Explain why a video streaming company uses lossy compression' — say: lossy
compression significantly reduces file size (point), meaning the video can be streamed without
requiring extremely high bandwidth (reason), making it accessible to users on slower
connections (context).

Content Areas C, D, E, F
C: Operating Online
Cloud computing models:
Term Definition
IaaS Infrastructure as a Service. Provides virtual hardware
(servers, storage). You manage OS and software. E.g. AWS
EC2.
PaaS Platform as a Service. Provides development environment.
You manage the application. E.g. Google App Engine.
 SaaS Software as a Service. Fully managed software accessed via
browser. E.g. Google Docs, Microsoft 365.
Private cloud Dedicated cloud infrastructure for one organisation. More
secure, more expensive.
Public cloud Shared infrastructure. Cheaper, less control over security.
Hybrid cloud Mix of private and public. Sensitive data on private, other
workloads on public.
Implications: scalability (can scale up instantly), cost (pay-as-you-go but ongoing subscription),
security (data held off-site, reliant on provider's security), downtime risk (if internet fails, cannot
access services).

D: Protecting Data & Information

Threats: viruses, malware, unauthorised access (hackers), accidental damage, social engineering
(phishing, pretexting), natural disasters, internal staff threats.
Protection techniques:
• File permissions and access levels — limits who can read/write/execute files
• Passwords / MFA — multi-factor uses 2+ factors: something you know, have, or are
• Biometrics — fingerprint, facial recognition — hard to forge
• Antivirus — detects and removes malware
• Firewalls — filter incoming/outgoing traffic
• Encryption — scrambles data so only authorised parties can read it
• Backups — regular copies of data stored securely (onsite and offsite)
• Digital certificates — verify identity of websites and servers (basis of HTTPS)

E: Impact of IT Systems
Online services: retail (e-commerce), financial services (online banking), education (e-learning),
news, entertainment (streaming), booking systems.
Transactional data — data generated by purchases, clicks, searches. Used for targeted marketing,
stock management, business intelligence.
Data accuracy: verification (checking data entered matches source), validation (checking data is in
correct format/range — e.g. date format, postcode pattern).

F: Legal & Ethical Issues

Term Definition
Data Protection Act / Controls how personal data is collected, stored and used.
GDPR Individuals have rights to access their data, correct it, and
request deletion.
Computer Misuse Act Makes it illegal to access computer systems without
1990 authorisation, or to modify data without permission.
Copyright Act Protects software and creative works from being copied
without permission.
Health & Safety (DSE) Employers must assess risks of display screen equipment
Regulations use — covers posture, lighting, screen glare, breaks.
Ethical issues: privacy (tracking users without consent), environmental impact (energy use of data
centres, e-waste), digital divide (unequal access to technology), netiquette (acceptable online
behaviour).
 UNIT 2: CYBER SECURITY AND INCIDENT MANAGEMENT

How to Answer Unit 2 Questions

Unit 2 has a heavier focus on scenario-based questions. You will often be given information about
an organisation and asked to apply your knowledge to that specific context.
Exam tip: Always refer back to the scenario. A generic answer about firewalls won't score as
well as one that says 'In this case, the hospital should implement a firewall to filter incoming
traffic from external sources, which would have blocked the malware before it reached internal
systems'.

Term Definition
Identify Pick out relevant information from the scenario. Short
answer.
Explain Point + reason. Must be connected logically.
Evaluate Strengths + weaknesses + conclusion. Conclusion must be
supported.
Complete Fill in a diagram or process. Common in Unit 2 for network
diagrams.

Content Area A: Threats, Vulnerabilities & Protection

A1: Cyber Security Threats
Internal Threats
• Employee sabotage — deliberate theft or damage to systems/data
• Accidental damage — fire, flood, power loss, human error
• Weak security practices — visiting unsafe websites, poor password hygiene
• Accidental disclosure — sharing credentials, negligence, poor training
External Threats — Malware Types
Term Definition
Virus Attaches to files and replicates. Types: boot sector, macro,
web script, worm, rootkit, trojan, browser hijack, polymorphic.
Ransomware Encrypts files (encryptor) or locks the device (locker) and
demands payment. Scareware pretends to be ransomware.
Doxware/leakware threatens to publish data.
Spyware Monitors user activity covertly. Keyloggers capture
keystrokes. System monitors record activity. Stalkerware
tracks location.
Adware Displays unwanted adverts. Can be legitimate or
deceptive/abusive.
Bots/Botnets Networks of compromised computers controlled remotely.
Used for DDoS, spam.

Social Engineering
• Phishing — mass deceptive emails pretending to be legitimate
 • Spear phishing — targeted phishing at specific individuals
• Whaling — phishing targeting senior executives
• Vishing — voice/phone-based social engineering
• Smishing — SMS-based phishing
• DNS spoofing — redirects users to fake websites
• Pretexting / impersonation — creates a false scenario to gain trust
Exam tip: Be precise with malware types. 'Ransomware' alone in an explain question won't get
full marks — say which type (encryptor) and how it works (encrypts files, demands decryption
key payment).

A2: System Vulnerabilities

Types of vulnerabilities:
• Network — open firewall ports, spoofing, DoS vulnerabilities
• Organisational — poor password policies, excessive user permissions
• Software — zero-day exploits, SQL injection, missing patches/updates
• OS — unsupported versions, missing security settings
• Mobile — reliance on OEM for updates, loss/theft risk
• Physical — poor access controls, theft of devices
• Cloud & IoT — default passwords, weak encryption, no updates, poor integration with network
security
Vulnerability assessment tools: port scanners, network mappers, vulnerability detection software,
penetration testing (checks OWASP Top 10).
Risk management: transfer risk (outsource to third party), avoid risk (stop the activity), accept risk
(document and monitor it).

A3: Legal Responsibilities

Term Definition
GDPR Requires data to be: lawfully collected, accurate, minimal,
secure, stored only as long as needed. People have rights:
access, correction, deletion, portability, objection.
Computer Misuse Act Criminalises: unauthorised access to systems; unauthorised
1990 modification of data. Organisations must demonstrate due
care to comply.

A4: Security Measures

Physical Security
• Site locks (mechanical, electronic, network-connected)
• Card entry systems (NFC, RFID, chip)
• Biometrics (fingerprint, iris, facial, voice recognition)
• CCTV, security staff, alarms
• Protected cabling and server cabinets
• Staff training
Software/Hardware Security
• Antivirus — signature scanning, heuristic analysis, quarantine/deletion of threats
• Firewalls — packet filtering, application layer rules, inbound/outbound traffic rules
• Backup types: full (everything), differential (changes since last full), incremental (changes
since last backup of any kind)
• Backup strategies: onsite, offsite, cloud, automated vs manual, hot/warm/cold site
 • MFA — uses 2+ factors: knowledge (password), possession (security token), inherence
(biometric), location (IP/GPS), behaviour
Encryption
• Symmetric — same key to encrypt and decrypt. Fast. AES is the standard.
• Asymmetric — public key encrypts, private key decrypts. RSA. Used in HTTPS, digital
signatures.
• TLS/SSL — secures communications (web, email). Basis of HTTPS.
• VPN — encrypts all traffic over the internet, creating a secure tunnel.
• E2EE — end-to-end encryption; only sender and receiver can read messages.
WLAN Security
• MAC address filtering — only allow known device addresses
• Hide SSID — don't broadcast network name
• WPA2/WPA3 — current wireless encryption standards
• Change default passwords and router settings
• Use VPN on top of Wi-Fi for additional protection
Exam tip: For a 6-mark evaluate on encryption: strengths (protects data in transit, protects
stored data, required by GDPR), weaknesses (key management is complex, performance
overhead, doesn't stop malware accessing data before encryption), conclusion.

Content Area B: Networking for Security

B1: Network Types & Topologies
Network types: LAN, WLAN, WAN, SAN (Storage Area Network — high-speed storage), PAN, the
internet. Private: intranet (internal), extranet (shared with partners), cloud network.
Physical topologies: star, extended star, hierarchical, wireless mesh, ad-hoc (BYOD). Logical
topologies: logical bus, logical ring.
Network architecture: peer-to-peer (equal devices, no central server — small scale), client/server
(server provides resources — scalable, more secure), thin client (client does minimal processing,
server does all computation).
Modern trends — security implications:
• Virtualisation — segmentation, sandboxing, reduced attack surface
• Cloud — configuration risks, account hijacking, API vulnerabilities
• BYOD — personal data mixing with org data, patch management issues, data wiping
challenges
• IoT — default passwords, no updates, eavesdropping via smart devices
• Remote working — home Wi-Fi security, reliance on VPN, use of personal devices

B2–B3: Network Components & Infrastructure

Hardware components: switches (connect devices on LAN), routers (connect networks/direct traffic),
WAP (wireless access point), firewall (filters traffic), gateway (connects different network types),
modem (connects to ISP).
TCP/IP four-layer model: Application, Transport, Internet, Network Access. Packets have a header
(addresses, sequence), payload (data), trailer (error checking).
DNS — translates domain names to IP addresses. DHCP — automatically assigns IP addresses to
devices. NAT — translates private IPs to a public IP (allows multiple devices to share one internet
address).
Ports: well-known (0-1023, e.g. port 80 HTTP, 443 HTTPS, 25 SMTP), registered (1024-49151),
dynamic/private (49152-65535).
Routing: static (manually configured, no overhead), dynamic (automatically adapts to network
changes). BGP is used for internet routing between organisations.

Content Area C: Cyber Security Policies

C1: Internal Policies
Key policies all organisations should have:
• Acceptable use policy — what employees can/cannot do with IT systems
• Password policy — minimum length, complexity, frequency of change, no sharing
• Backup policy — what to back up, how often, where stored, who is responsible, testing
strategy
• Data protection policy — GDPR compliance, Data Protection Officer, staff training, contractor
obligations
• Cyber security incident response policy — contacts, procedures for
triage/containment/recovery, communications plan
• Disaster recovery policy — list of possible events, severity, appropriate response (business
continuity vs disaster recovery plan)
• External services policy — rules for cloud, hardware, software suppliers; SLAs; incident
response procedures
Security audits: check compliance against policies, identify gaps and weaknesses, report findings
and required changes.
Exam tip: For a question about incident response policy, use the structure: contacts who need
to be notified (IT, legal, PR, HR, insurance) + procedures (triage, containment, analysis,
recovery, review) + communications plan. Missing any of these loses marks.

Content Area D: Forensic Procedures

D1: Forensic Collection of Evidence
When responding to an incident, evidence must be collected carefully to remain admissible:
• Isolate the device from the network (airplane mode, Faraday bag, disconnect cables)
• Photograph the screen before powering down
• Document chain of custody — record every person who handles the device
• Take a forensic image (exact copy) rather than working on the original
• Generate a hash/checksum of the image — proves it hasn't been tampered with
• Review files, system logs, user activity logs, malware alerts
Challenges of live forensics: data changes while system is running; RAM is volatile (lost on
shutdown); capturing data from active memory without corrupting it; recovering deleted files.
Network forensics: review firewall logs, switch/router logs, WAP logs, analyse unusual traffic
patterns (unusual ports, unusual geographies, DoS indicators, unusual login attempts).

D2: Forensic Analysis & Reporting

Requirements for maintaining accurate forensic records:
• Work from copies — never alter original evidence
• Document all actions taken (contemporaneous notes)
• Retain snapshots: whole disk image, RAM, temporary files, system-generated files
• Create visual evidence: photos, screenshots, timestamps
• Assess whether findings are false positives (define search criteria carefully, manual review)
Security report structure: title, contents page, introduction, analysis of incident (errors in procedures,
unforeseen problems, detection delays), conclusions, recommendations for improvement (physical,
software, hardware, training, policy changes).
Exam tip: In a forensics question, the key concept to demonstrate is 'chain of custody' — the
need to document who handled evidence and when, and to work on copies not originals. These
phrases will get you marks even in a general question.
 QUICK REFERENCE: Last-Minute Key Facts
Unit 1 — Must-Know List
• Codec = COder-DECoder. Encodes and decodes audio/video.
• Lossy = smaller file, quality lost permanently (JPEG, MP3, MP4)
• Lossless = no quality loss, larger file (PNG, FLAC, ZIP)
• SaaS = software via browser. IaaS = virtual hardware. PaaS = dev platform.
• HTTPS = HTTP + TLS encryption. Port 443.
• MFA = 2+ of: something you know / have / are
• GDPR rights: access, correct, delete, portability, object
• Star topology: most reliable. Failure of one device doesn't break network.
• WAN = wide area (internet). LAN = local area. PAN = personal area (Bluetooth).

Unit 2 — Must-Know List

• Ransomware encryptor = encrypts files, demands payment for decryption key
• Phishing = mass fake emails. Spear phishing = targeted. Whaling = targeting executives.
• AES = symmetric encryption (fast). RSA = asymmetric (public/private keys).
• Full backup = everything. Differential = changes since full. Incremental = changes since last
backup.
• Chain of custody = documented record of everyone who handled evidence
• Always work from forensic COPIES, never the original
• OWASP Top 10 = list of most critical web application vulnerabilities
• GDPR breach must be reported to ICO within 72 hours
• Port 80 = HTTP. Port 443 = HTTPS. Port 25 = SMTP. Port 22 = SSH.

Good luck — you've got this.