Years 9–10 Digital Systems

These are free worksheets for the Digital Systems strand of the Victorian Curriculum Digital Technologies, Levels 9–10: how networked systems handle data, how access to data is controlled and secured, and how cyber security threats and vulnerabilities are found, modelled and reduced.

This page lists the 40 modules written for Years 9–10: confidentiality, integrity and availability, authentication and authorisation, permissions, least privilege, role-based access control, access control lists, audit logs, password hashing and salting, and brute-force attacks; assets, threats, threat actors, vulnerabilities, exploits, attack surfaces, input validation, SQL injection, buffer overflows and zero-days; insider threats; software supply chains, dependencies, compromised updates, typosquatting, code signing and SBOMs; and risk ratings, data flow diagrams, trust boundaries, STRIDE, attack trees, security controls and writing and reviewing a threat model. Each module includes real practice questions and a full answer key.

The Years 9–10 journeys below also reuse Years 5–8 and VCE Cyber Security modules where the topic is the same, so each journey is a complete course. Teachers can assign the whole strand, or one content description at a time, with progress tracking, class sprints and badges.

Add this whole curriculum to your class, or just the modules your unit needs — Cloodit tracks who's stuck automatically.

Add to class →

Controlling and securing access to data — VC2TDI10S01, VC2TDI10S02 (12 modules)

Confidentiality Only authorised people or systems can read data. Everyone else is kept out, like student marks seen only by the student and teacher. A breach is when someone else sees them.

Integrity Data stays accurate and unaltered unless an authorised person changes it. Accidental or deliberate changes break it, such as a tampered bank balance.

Availability Authorised users can reach data and systems when they need them, such as a school network that stays up. Attacks and hardware failure can reduce it.

Authentication vs authorisation Authentication checks who you are, like logging in. Authorisation decides what you can do once you are known, like which files you can open. Authentication always comes first.

User permissions: read, write and execute A rule that lets an account read, write or execute a file or resource. Read only views it, write can change or delete it, and execute runs it as a program.

The principle of least privilege Give every user, program and device only the minimum access it needs to do its job. This limits the damage if an account is stolen, and unneeded access should be removed.

Role-based access control A way to manage access by giving permissions to roles, like student, teacher or admin, then assigning each user a role. Changing a user's role changes what they can access.

Access control lists A table attached to a resource, like a file or router, that lists which users or groups may access it and what they can do. If you are not listed, access is denied.

Access logs and audit trails An automatic record of who accessed a system or file, what they did and when. It helps spot failed logins and misuse, and holds users accountable for their actions.

Why passwords are stored as hashes A one-way scrambled value made from a password. A system stores it instead of the real password and checks a login by hashing what you type and comparing. It can't be reversed.

Salting a password hash A random value added to a password before hashing, so identical passwords give different hashes. Each user gets their own salt, which defeats precomputed hash tables.

Brute-force and dictionary attacks An attack that tries many passwords automatically until one works. A dictionary attack tries common words and leaked passwords first. Long passwords and lockouts slow it down.

Just this content description: the Controlling and securing access to data journey · Add VC2TDI10S01, VC2TDI10S02 to a class →

Threats and software vulnerabilities — VC2TDI10S02, VC2TDI10S01 (11 modules)

Asset Anything of value in a digital system that needs protecting, such as data, accounts, devices or services. Examples: a student database (data) or a school laptop (hardware).

Threat Anything that could cause harm to an asset, such as an attacker, malware, human error or a power failure. Threats can be deliberate or accidental, and internal or external.

Threat actor A person or group that carries out an attack on a system, described by their motive (why) and skill (how able). Examples: cybercriminals, hacktivists, insiders and nation-state groups.

Vulnerability A weakness in software, hardware, a process or a person that a threat could use to harm an asset. A vulnerability is only a weakness, not an attack.

Exploit A method or piece of code that takes advantage of a vulnerability (a weakness) to attack a system. The weakness is the open door; the exploit is the tool that gets through it.

Attack surface All the points where an attacker could try to get into a system or take data out, such as open ports, running services and user accounts. A smaller attack surface means fewer ways in.

Software vulnerabilities A flaw or bug in a program's code or settings, such as a coding mistake or an insecure default, that an attacker could use to get access or cause damage.

Input validation Checking that data a user enters is the expected type, length and format before the program uses it, so bad or harmful input is rejected.

SQL injection An attack where database commands are typed into an input field and run because the program joins the input straight into a query. Parameterised queries stop it.

Buffer overflow When a program writes more data into a memory area than it can hold, spilling over and overwriting nearby memory. This can crash the program or let an attacker run their own code.

Zero-day vulnerabilities A vulnerability that attackers know about before the software maker has released a fix. With no patch available yet, defenders rely on workarounds and monitoring.

Just this content description: the Threats and software vulnerabilities journey · Add VC2TDI10S02, VC2TDI10S01 to a class →

User vulnerabilities — VC2TDI10S02 (1 module)

Insider threats and human error Harm to data or systems caused by someone with legitimate access, either on purpose (malicious insider) or by mistake, like emailing the wrong person or setting a file to public.

Just this content description: the User vulnerabilities journey · Add VC2TDI10S02 to a class →

Software supply chain vulnerabilities — VC2TDI10S02 (7 modules)

Software supply chain Everything used to make and deliver software: code libraries, tools, build systems, suppliers and updates. Most of an app is other people's code, so you trust every link in the chain.

Third-party dependencies A library or package written by someone else that your program imports and relies on. If it has a flaw, every app that uses it is affected, including via dependencies of dependencies.

Compromised software updates An attack where criminals hide malicious code in a trusted supplier's software update, so users install it believing it is safe.

Typosquatting and malicious packages Publishing a malicious package or site with a name almost the same as a trusted one (like reqeusts for requests), hoping people install or visit it by mistake.

Code signing and trusted sources Code signing adds a digital signature to software so a computer can check it came from the named publisher and has not been changed since it was signed.

Software bill of materials (SBOM) A software bill of materials: a list of every component and library inside a piece of software, with version numbers, so owners can check each one for known vulnerabilities.

Reducing supply chain risk Use fewer, trusted dependencies, pin versions, verify integrity and scan for known vulnerabilities so a weak link in code you rely on cannot harm your system.

Just this content description: the Software supply chain vulnerabilities journey · Add VC2TDI10S02 to a class →

Threat modelling and security responses — VC2TDI10S02, VC2TDI10S01 (9 modules)

Risk as likelihood and impact Risk is how likely a threat is to succeed combined with how much harm it would cause. Rate each as low, medium or high to decide which risks matter most.

Risk rating matrix A grid that plots how likely a threat is against how bad its impact would be, giving each risk a priority rating (such as low, medium or high) so you know which to fix first.

Data flow diagram of a system A diagram that shows how data moves between users, processes, data stores and external services in a system, using labelled arrows for each flow.

Trust boundaries A line on a diagram where data passes between parts of a system with different levels of trust, such as from a user's device to a server. Threats often cluster here.

STRIDE threat categories A memory aid for six threat types: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service and Elevation of privilege. Use it to ask what could go wrong in a system.

Attack trees A diagram with the attacker's goal at the top, branching into the different ways to reach it. OR branches are alternatives, AND branches are all needed.

Security controls: prevent, detect, respond A measure that reduces risk by preventing an attack, detecting it or helping recovery. Controls can be technical, physical or procedural, and layering several works best.

Writing a threat model table A table with one row per threat. Columns record the asset, threat, vulnerability, risk rating and chosen control, e.g. a school app storing student data.

Reviewing and updating a threat model Checking and updating a threat model whenever the system, its users or the known threats change, for example after a new feature, a new dependency or a new control.

Just this content description: the Threat modelling and security responses journey · Add VC2TDI10S02, VC2TDI10S01 to a class →

Printable Years 9–10 Digital Systems Crosswords & Word Searches

Built from the key terms of each block of modules, every one with a full answer key. All free printables →

✎

Crossword: Controlling and securing access to data (Modules 13–24) 10 clues · Confidentiality, Integrity, Availability, Authentication vs authorisation and more

✎

Crossword: Controlling and securing access to data and Threats and software vulnerabilities (Modules 25–40) 10 clues · Salting a password hash, Brute-force and dictionary attacks, Asset, Threat and more

✎

Crossword: Threats and software vulnerabilities to Software supply chain vulnerabilities (Modules 41–69) 10 clues · SQL injection, Buffer overflow, Zero-day vulnerabilities, Insider threats and human error and more

✎

Crossword: Software supply chain vulnerabilities and Threat modelling and security responses (Modules 70–79) 10 clues · Reducing supply chain risk, Risk as likelihood and impact, Risk rating matrix, Data flow diagram of a system and more

🔎

Word Search: Controlling and securing access to data and Threats and software vulnerabilities (Modules 13–40) 20 words to find · Confidentiality, Integrity, Availability, Authentication vs authorisation and more

🔎

Word Search: Threats and software vulnerabilities to Threat modelling and security responses (Modules 41–79) 20 words to find · SQL injection, Buffer overflow, Zero-day vulnerabilities, Insider threats and human error and more

Journeys using these modules

9-10 Digital Technologies Vic Curric - Digital Systems and Security, VCE Applied Computing - U1O1 - Data analysis, VCE Software Development - U3O2 - Analysis and Design, VCE Software Development - U4O2 - Cyber Security: secure software development practices, VCE Data Analytics - U3O2 - Analysis and Design, VCE Data Analytics - U4O1 - Development and Evaluation, VCE Data Analytics - U4O2 - Cyber Security: Data Security, IGCSE Computer Science 0478 — 4.1 Types of Software and Interrupts, IGCSE Computer Science 0478 — 5.3 Cyber Security, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities, ACARA Digital Technologies Years 9–10 — Privacy Principles and Digital Footprints, QCE Digital Solutions Unit 2 — Data and Programming Techniques, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements, WA Computer Science ATAR Year 11 — Network Communications, WA Computer Science ATAR Year 11 — Data Management, WA Computer Science ATAR Year 11 — Cyber Security

Or build your own Journey from any of these modules →

Frequently Asked Questions

Are these worksheets free?

Yes — every worksheet and its answer key is free to view, download, and print, with no account required to access any individual module.

Do I need an account?

No account is needed to view or print a worksheet. A free teacher account adds extras like assigning modules to a class and tracking progress automatically — it takes under three minutes to set up and doesn't need a credit card.

What year level is this for?

This curriculum is aligned to the Australian Curriculum (ACARA) and Victorian Curriculum, spanning roughly Years 3 to 10 — from first sequencing and variables through to object-oriented programming and advanced data structures. Start wherever matches your class's current level; each module builds on the last.

Can I print them?

Yes — every module has a one-click Print Worksheet button that generates a printable page with the practice questions and a full answer key.

Is this aligned to a curriculum?

Yes — the module sequence is mapped to the Australian Curriculum (ACARA) and Victorian Curriculum, and a class's progress is reported back against those curriculum bands (e.g. ACARA Years 5–6 sequencing and iteration, Years 7–8 functions and data structures), not just a generic difficulty scale.

Can students use this without a teacher?

Yes — students can start any module and practice directly, no class or account required. Joining a teacher's class with a class code adds progress tracking, class badges, and live Sprints, but isn't needed to work through the worksheets or modules solo.

Do I need to know Years 9–10 Digital Systems myself to teach this?

No — every module comes with a full worked answer key, and Cloodit tracks who's stuck automatically, so you don't need to solve each exercise yourself before assigning it or be able to debug a student's work line by line.

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

For Teachers

Set this curriculum for your class and see who needs help, automatically.

Create a free teacher account →

No credit card. No setup fee. Make a class and invite students in under three minutes.

For Students

Practice this topic interactively, track progress, and unlock badges.

Start Learning Free →

Have a class code?