Cambridge AS & A Level Computer Science 9618/12 is the May/June 2026 Paper 1 (Theory Fundamentals), variant 2. It is an AS Level component that lasts 1 hour 30 minutes, is worth 75 marks and is sat by every 9618 candidate. It had eight compulsory questions and no calculator, and the largest, on a computer game database and SQL, carried 16 marks. This guide goes through the paper question by question and shows what the official mark scheme gave marks for. The paper and its mark scheme are free on the Tutopiya Learning Portal.

For an overview of all four 9618 papers from this series, see A Level Computer Science 9618 May/June 2026 past papers: what came up and how it was marked.

9618/12 at a glance

Question	Topic	Marks	Main command word
1	Bitmap images: pixels, resolution, file header, bit depth, lossless compression	8	Describe, explain
2	Verification, validation of a date of birth, viruses and hackers	13	Describe, complete
3	A game database: relationships, SQL errors, an SQL query, DBMS terms	16	Describe, write, complete
4	Sound: sampling rate and sampling resolution	4	Describe, explain
5	Denary, binary, hexadecimal and BCD; two’s complement; shifts	7	Complete
6	A health monitor: embedded system, monitoring, RAM and ROM, the cloud	11	Explain, discuss
7	Process and memory management, defragmentation, debugging, translators	13	Identify, explain
8	Logic circuit truth table and a logic statement	3	Complete, write
	Total	75

Question-by-question walkthrough

Question 1: bitmap images (8 marks)

• Definition of a pixel (1 mark): the smallest element of an image that can be one colour.
• Image resolution against screen resolution (2 marks): image resolution is the number of pixels wide by high that make up the image; screen resolution is the number of pixels wide by high that the screen can display. The second mark is for a consequence, such as the image looking worse if the screen resolution is lower than the image’s, or the image resolution being changeable while the screen has a physical limit. Just “the number of pixels” was not enough, and bits or characters in place of pixels scored nothing.
• Another file header item (1 mark): file size, file type, image dimensions, compression type or the data offset. Resolution and colour depth were given in the question, so they didn’t count, and only your first answer was marked.
• Smallest bit depth (1 mark): the image uses three colours, so 2 bits are enough.
• Lossless compression (3 marks): name run-length encoding (RLE), explain that a run of consecutive pixels of the same colour is stored once with a count of how many there are, and give an example from the image, such as R2 or W4 for the first row. The scheme warned that the answer must be about pixels, not bits or characters.

Question 2: data entry and security (13 marks)

• Two verification methods (4 marks): a method and its matching description for each. A visual check compares the entered data with the original by eye, and double entry has the data typed twice so the computer compares the two. The question asked for verification, so validation checks scored nothing here, and saying the data is “as intended” was not enough without the comparison.
• Two validation checks on a date of birth (3 marks): one mark for naming two checks, then one mark for each use applied to the date. Accepted pairs included a presence check (the field can’t be blank), range check (between two dates, both ends needed), limit check (one end only), format check (dd/mm/yyyy), length check (exactly 10 characters) and type check (DATE). Range and limit together counted as one, and a use had to apply the check to the date rather than repeat its name.
• Virus (3 marks): malicious software that replicates and can fill storage or delete or corrupt data (“causes harm” alone was not enough). Then a method, anti-virus software, with a matching description: it scans files and downloads, compares them with a database of known viruses, and quarantines, deletes or alerts the user on a match.
• Hacker (3 marks): a person who gains unauthorised access to a computer system; malicious intent alone did not earn the mark. The method could be a firewall, multi-factor authentication, strong passwords or encryption, each with a matching description. A firewall already used for the virus part could not be repeated, and “authentication” alone was not enough for multi-factor authentication.

Question 3: the game database (16 marks)

The database held players, the characters they create and the groups characters can join, in four tables including a link table between characters and groups.

• Relationships (2 marks): PLAYER to CHARACTER is one-to-many (one player can create many characters, each character belongs to one player) and GROUP to CHARACTER is many-to-many (a group has many characters and a character can be in many groups). A described relationship needed both halves.
• Four errors in the CREATE TABLE script (4 marks): line 02 should declare CharacterID as VARCHAR, because the sample IDs start with zeros; line 05 uses TheLevel when the field is called Level; line 08 needs brackets, PRIMARY KEY(CharacterID); and line 09 must finish the foreign key with REFERENCES PLAYER(PlayerID).
• SQL query (5 marks): one mark each for selecting PlayerName and counting the characters, naming the count with AS (for example TotalCharacters), joining CHARACTER and PLAYER on PlayerID (a WHERE condition or an INNER JOIN, but not a mix of the two), GROUP BY, and ORDER BY PlayerID DESC. The scheme told examiners to check the DESC carefully.
• Database key terms (5 marks): the missing words were data dictionary, two examples of what it stores (one mark for both, such as data types, validation rules, primary keys or foreign keys), logical schema, access rights and developer interface. Table names, field names and relationships were already in the paragraph, “metadata” did not replace data dictionary, and “key” alone was not enough.

Question 4: sound (4 marks)

• 44.1 kHz (1 mark): the sound wave is sampled 44 100 times every second.
• 2 bytes against 8 bits (3 marks): the 16-bit recording has more bits per sample, so its file is larger, but the digital sound is closer to the original, because a wider range of more exact amplitudes can be stored with smaller quantisation errors. The reverse argument for the 8-bit file was accepted, as long as it was clear which resolution you meant.

Question 5: number systems (7 marks)

Conversion table (4 marks, one per value):

Missing value	Answer
160 in BCD	0001 0110 0000
100100001 in denary	289
2486 in unsigned binary	1001 1011 0110
1000100100110011 in hexadecimal	8933

Using the given values speeds this up: 121 in hex is 1 0010 0001 in binary, and 9B6 converts straight to binary a nibble at a time.

• Three short answers (3 marks): the smallest 12-bit two’s complement number is 1000 0000 0000, which had to be written as 12 bits in binary; 01100010 after a logical right shift of 2 places is 00011000, which is 24 and had to be given in denary; and a cyclic left shift of 4 on 10010101 gives 0101 1001.

Question 6: the health monitor (11 marks)

• Why it is an embedded system (3 marks): it has one function, monitoring health; its hardware, such as the sensors and microprocessor, is dedicated to that task; and its firmware can’t easily be changed because the function is preset.
• Monitoring or control (2 marks): monitoring. There was no mark for the tick itself. The justification: it only records and transmits data, it uses no feedback and doesn’t change its environment, its output doesn’t affect the next input, and it has no actuator. “Doesn’t perform an action” was not enough for the actuator point.
• RAM and ROM (2 marks): RAM can be read and written while ROM can only be read; RAM is volatile and ROM is non-volatile; RAM holds the data and instructions currently in use while ROM holds boot-up instructions or firmware. Each point had to cover both memories, and expanding the acronyms scored nothing.
• Storing the data in the cloud (4 marks): benefits included access from anywhere with internet, uploading on the move, sharing data with medical professionals, needing less storage on the phone and keeping data when you change device. Drawbacks included needing internet access, having no control over security and the provider selling or misusing the data. Benefits only, or drawbacks only, capped the answer at 3, a benefit and its exact reverse scored once, and “easier for hackers” was not enough.

Question 7: system software and the IDE (13 marks)

• Process management tasks (2 marks): allocating resources to processes, moving processes between states, allocating time slices, scheduling, resolving conflicts when two processes need the same resource and letting processes communicate. “Allows multiprogramming” was rejected as a benefit, not a task, and “resource management” was not enough.
• Memory management tasks (2 marks): allocating RAM to processes, freeing memory when a process closes, stopping two processes using the same memory and fetching data from RAM when needed.
• Why defragmentation helps (3 marks): over time files are split across the disk, so the head moves between locations to read one file; defragmentation moves the parts into contiguous blocks (or gathers the free space together); the head moves less when reading or writing; so data access takes less time. Just describing the process was not enough, because the question asked how it improves performance.
• Using debugging tools (4 marks): marked in pairs, a tool and how the student uses it: single stepping (run one line at a time and check the results before the next), breakpoints (stop the code at a chosen point to check values or test a section) and a watch window (see how variables change during execution). Tool names alone scored at most 2, and “check for errors” was not an explanation.
• Partly compiled, partly interpreted languages (2 marks): the intermediate code can run on different platforms because it is interpreted when run; machine code is generated at run time, so it is optimised for that processor; and the source code doesn’t need recompiling. The answer had to say why, not just describe the process.

Question 8: logic (3 marks)

• Truth table (2 marks, one per output column): in the circuit, A comes from a NOR gate fed by NOT X and X XOR Y, which works out as 1 only when X and Y are both 1. B comes from AND gates combining X XOR Y with Z. For inputs 000 to 111 in order, A is 0, 0, 0, 0, 0, 0, 1, 1 and B is 0, 0, 0, 1, 0, 1, 0, 0.
• Logic statement (1 mark): P is 1 whenever A and B are equal, whatever C is, so P = NOT (A XOR B). Equivalent forms such as (NOT A AND NOT B) OR (A AND B), or the full four-term sum of products, were accepted.

Where the marks are on 9618/12

Topic	Questions	Marks
Data representation (images, sound, number systems)	1, 4, 5	19
Databases and SQL	3	16
Security and data integrity	2	13
System software (OS, utilities, IDE, translators)	7	13
Hardware, embedded systems and the cloud	6	11
Logic gates	8	3
Total		75

• Data representation is a quarter of the paper, and almost all of it has fixed answers: the bit depth, the conversions, the shifts and the sampling-rate definition. These are the marks to bank first.
• SQL alone carried 9 marks across 3(b)(i) and 3(b)(ii). Both reward precise syntax: brackets, REFERENCES, AS, GROUP BY and DESC.
• Paired answers decide many marks. 2(a), 2(c), 6(b) and 7(b)(i) all need a method or tool and a matching description or justification. A name on its own earns only part of the credit.

How to self-mark 9618/12 with the mark scheme

1. Learn the scheme’s shorthand. A slash or // separates alternatives for the same point, NE means not enough, TV means too vague, BOD is benefit of the doubt and FT is follow through.
2. Mark the first answer only where the guidance says so, such as 1(c) and the validation table in 2(b). A second answer doesn’t rescue a wrong first one.
3. Check pairs together. For the virus and hacker tables, the description must match the method you chose, and the same method can’t score twice.
4. Mark SQL line by line. For 3(b)(ii), tick each of the five points separately; a missing DESC or GROUP BY costs exactly one mark.
5. Apply the caps. 6(d) is capped at 3 without both benefits and drawbacks, and 7(b)(i) is capped at 2 for tool names without explanations.
6. Check the form of number answers. The two’s complement answer must be 12 binary bits and the shift answer must be in denary.

Sit 9618/12 as a timed mock

The paper allows 90 minutes for 75 marks, about 1 minute 10 seconds per mark. A workable plan:

Block	Marks	Time
Question 1	8	9 minutes
Question 2	13	15 minutes
Question 3	16	19 minutes
Question 4	4	5 minutes
Question 5	7	8 minutes
Question 6	11	13 minutes
Question 7	13	15 minutes
Question 8	3	3 minutes
Check conversions and SQL	–	3 minutes
Total	75	90 minutes

There is no calculator, so do the conversions in Question 5 by grouping bits into nibbles, and use the working space.

Other May/June 2026 9618 papers

• 9618 Paper 22 (Fundamental Problem-solving and Programming Skills)
• 9618 Paper 32 (Advanced Theory)
• 9618 Paper 42 (Practical)

Practise and download

• Download 9618/12 and its mark scheme on the Learning Portal →
• All 9618 May/June 2026 papers: overview and marking patterns
• Try a free A Level Computer Science quiz

Need help with a 9618 topic? Book a free trial lesson with an A Level Computer Science tutor →

Frequently asked questions

What topics were on 9618 Paper 12 May/June 2026? +

Eight questions: bitmap images and run-length encoding; verification, validation, viruses and hackers; a computer game database with SQL; sound sampling; number conversions, two's complement and shifts; a health monitor as an embedded system; operating systems, defragmentation and IDE debugging tools; and a logic circuit with a truth table.

How many marks is 9618/12 and how long is it? +

It is out of 75 marks and lasts 1 hour 30 minutes, with no calculator allowed. Question 3, the game database, is the biggest at 16 marks.

What were the four SQL errors in 9618/12 Question 3? +

CharacterID was declared as INT but holds values with leading zeros, so it should be VARCHAR; the field was named TheLevel instead of Level; the primary key line needed brackets around CharacterID; and the foreign key line was missing REFERENCES PLAYER(PlayerID).

What were the number conversion answers on 9618/12 2026? +

160 in BCD is 0001 0110 0000, binary 100100001 is 289 in denary, 2486 is 1001 1011 0110 in binary and 1000100100110011 is 8933 in hexadecimal. The smallest 12-bit two's complement number is 1000 0000 0000, 01100010 shifted right logically two places is 24, and a cyclic left shift of 4 on 10010101 gives 01011001.

Is 9618/12 an AS or A Level paper? +

It is an AS Level component. AS candidates sit Paper 1 and Paper 2; full A Level candidates sit all four papers. Paper 1 has no optional questions.

Where can I download 9618/12 May/June 2026 and its mark scheme? +

Both are free to download and print on the Tutopiya Learning Portal, on the Cambridge AS & A Level Computer Science 9618 past papers page.

Ready to Excel in Your Studies?

Get personalised help from Tutopiya's expert tutors. Whether it's IGCSE, IB, A-Levels, or any other curriculum — we match you with the perfect tutor and your first session is free.

Book Your Free Trial