Two blocks carry 60% of the paper. Unit 2 (Hackers & Cyber Crimes) and Unit 6 (Cryptography & Network Security) each carried 133 marks (30%) across the four papers.
About 30% of the marks are outside the IT syllabus. The PYQ+ topics (Unit 6 + 3.2, 4.11, 2.12) carried 136 marks (30%). They come from the CSE side of the joint paper. A student who studies only the IT syllabus gives up almost a third of what the paper offers.
Unit weight swings wildly year to year (L15). Unit 2 ranged 11% → 49% of a paper, Unit 3 0% → 23%, Unit 5 0% → 20%. Only Unit 4 is steady (5% → 13%). No unit is safe to skip.
MAKAUT re-asks its own questions, and more so recently. 2025-26 re-asked 13 of 25 questions (42% of its marks) from earlier papers, and 2023-24 re-asked 8 (22%). The 19 repeated families are the cheapest marks in the subject.
Long explanatory answers decide the score. "Theory" questions carry 48% of all marks and diagram questions 11%. One-liners are 9%. Each paper's Group C alone offers 75 of its 112 printed marks.
Unit weight rotates, and it's predictable here (L25). Your observation holds in these papers. A unit that was heavy one year dropped the next, and a light one rose: 10 of 11 calls correct (91%). Next-exam outlook:
Unit 6 (Crypto & Network Security) ↑ likely UP: it fell to 18% last paper vs a 30% average, so it's the biggest expected riser.
Unit 1 ↑ likely UP.
Units 2 and 3 ↓ likely DOWN: they were heavy last paper.
Units 4 and 5 → steady.
A small core goes a long way, but not all the way.12 topics → 50%, 20 → 70%, 26 → 80% of all marks (out of 65). The other half of the map is still syllabus, and 15 topics have never been asked yet in CORE: the 12 from v1 (mostly Unit 4 forensics sub-steps and Unit 5 law basics) plus the three new old-pool topics 2.13–2.15. They're due at some point.
The old papers (R-OTHER) show MAKAUT's "other" question pool, and it repeats itself hard. The 7 old-scheme Cyber Law papers re-ask the same ideas year after year: identity theft and DoS/DDoS in 7 of 7, active vs passive attacks and phishing in 6 of 7, cyberstalking in 6. Three of today's CORE families (Trojan horse, SQL injection, virus vs worm) were already old-pool favourites. These papers never change a tier (L16). They add angles and wording for notes and flag which C/B topics are cheap insurance (2.13 stalking/bullying, 2.14 identity theft, 2.15 frauds, 2.16 mobile, 3.11 phishing). See Old-pool repeats below.
Every repeated family (19) + the ⚡ facts. Learn the canonical answers (Part A of question_bank.md), and memorise the one-liners that keep returning in Group A: who coined "cyberspace", vulnerability/threat/attack terms, worm vs trojan facts, scan types, data-breach steps (topics 1.2, 1.3, 1.4, 2.1, 2.3, 2.4, 2.6, 2.7, 3.9).
Each unit's must-do floor, so no unit can ambush you:
U1: 1.3, 1.8
U2: 2.1–2.5, 2.9, 2.11
U3: 3.9, 3.2, 3.6, 3.7
U4: 4.11, 4.4
U5: 5.6, 5.5
U6 (extra but heavy): 6.10, 6.9, 6.6, 6.7, 6.8
Old-pool insurance (R-OTHER, not a tier): after each unit's S/A topics, cover the old-pool favourites in that unit: 2.17, 2.14, 2.13, 2.15, 2.16, 3.11, 5.7. They're C/B in CORE, but if MAKAUT reaches into its older pool, these are what it has asked most.
Rotation tilt for the next exam (L25, strong back-test): within every tier, take the ↑ units first.
Unit 6: after 6.10 (S), go to 6.9, 6.6, 6.7, 6.8 (A), then 6.1–6.5 crypto basics (B), now ahead of other B topics, because Unit 6 is the most likely riser.
Unit 1: 1.4 and 1.2 facts, 1.7, then 1.5/1.6 (never asked yet, and Unit 1 is likely to rise).
Units 2 and 3 (↓): still do all their S/A topics. "Likely down" means less space, not zero, and both have swung by about 20–40 points between papers.
Then the rest of tier A, then B (the one-off syllabus questions in Units 3–4).
Then tier C (never asked yet). It's prepared from the syllabus to the same standard, because anything in the syllabus can appear (L4).
Full-marks standard (L23): the order above is priority, not a cut-off. The goal is that every question the paper can offer, including all choices, is answerable.
Rendered by tools/analyze.py. Basis: 4 counted papers (CORE + R-OLD) · mode STANDARD · marks = printed paper marks incl. all choices (448 in total, 112 · 112 · 112 · 112 per paper).
# Unit importance (historical evidence, NOT a fixed weightage: L15)
Unit
Title
Topics
Asked topics
Questions
Papers asked in
Marks (all yrs)
Avg % of paper
Range across years
Rank
1
Introduction
8
6
18
4/4
26
6%
3% – 8%
6
2
Hackers and Cyber Crimes
17
14
46
4/4
133
30%
11% – 49%
1
3
Ethical Hacking and Social Engineering
11
9
12
3/4
72
16%
0% – 23%
3
4
Cyber Forensics and Auditing
11
6
8
4/4
51
11%
5% – 13%
4
5
Cyber Ethics and Laws
7
4
6
3/4
28
6%
0% – 20%
5
6
Cryptography & Network Security (PYQ+ block, from the joint CSE/IT paper)
10
10
21
4/4
133
30%
18% – 45%
2
X
Odd questions (L20)
1
1
1
1/4
5
1%
0% – 4%
7
# Unit volatility: marks per unit in each paper (% of that paper)
Unit
2022-23
2023-24
2024-25
2025-26
1
8 (7%)
6 (5%)
9 (8%)
3 (3%)
2
22 (20%)
55 (49%)
12 (11%)
44 (39%)
3
21 (19%)
–
26 (23%)
25 (22%)
4
6 (5%)
15 (13%)
15 (13%)
15 (13%)
5
–
1 (1%)
22 (20%)
5 (4%)
6
50 (45%)
35 (31%)
28 (25%)
20 (18%)
X
5 (4%)
–
–
–
# Unit rotation check (L25): does a heavy unit drop next year, and a light unit rise?
Rule tested: a unit more than 3 points above its average share → expect it to go DOWN in the next paper; more than 3 below → expect UP. ✓ = it happened, ✗ = it didn't.
Unit
Avg share
2022-23 → 2023-24
2023-24 → 2024-25
2024-25 → 2025-26
1
6%
7%→5% (steady, no call)
5%→8% (steady, no call)
8%→3% (steady, no call)
2
30%
20%→49% · expected ↑ ✓
49%→11% · expected ↓ ✓
11%→39% · expected ↑ ✓
3
16%
19%→0% (steady, no call)
0%→23% · expected ↑ ✓
23%→22% · expected ↓ ✓
4
11%
5%→13% · expected ↑ ✓
13%→13% (steady, no call)
13%→13% (steady, no call)
5
6%
0%→1% · expected ↑ ✓
1%→20% · expected ↑ ✓
20%→4% · expected ↓ ✓
6
30%
45%→31% · expected ↓ ✓
31%→25% (steady, no call)
25%→18% · expected ↑ ✗
Back-test: 10 of 11 calls correct (91%): the rotation pattern holds strongly in this subject's papers. Caveat: the average includes the years being tested, so with few papers this flatters the hit rate a little.
# Next-exam unit outlook (L25: from the latest paper, 2025-26, vs each unit's average)
Unit
Title
Avg share
Latest share
Gap
Outlook for next exam
1
Introduction
6%
3%
-3.1 pts
↑ likely UP
2
Hackers and Cyber Crimes
30%
39%
+9.6 pts
↓ likely DOWN
3
Ethical Hacking and Social Engineering
16%
22%
+6.2 pts
↓ likely DOWN
4
Cyber Forensics and Auditing
11%
13%
+2.0 pts
→ steady
5
Cyber Ethics and Laws
6%
4%
-1.8 pts
→ steady
6
Cryptography & Network Security (PYQ+ block, from the joint CSE/IT paper)
30%
18%
-11.8 pts
↑ likely UP
Outlook = priority tilt only. Every unit is still fully prepared (L15, L23): MAKAUT's split stays partly random, and confidence in the tilt follows the back-test above (91% on 11 calls).
12 topics → 50% of all marks · 20 topics → 70% of all marks · 26 topics → 80% of all marks · 33 topics → 90% of all marks (out of 65 topics). Historical only; every unit's floor topics still apply (L15).
# Old-pool repeats (R-OTHER: 9 papers, never counted, L16)
Hand-written from data/questions.csv (R-OTHER rows only). "Old" = the 7 IT-802B/CS-802B papers (2013-14 → 2018-19); "OEC" = the 2 OEC-CS801B papers. A topic counts a paper if it's the primary or a secondary topic. Use: angles, wording and insurance order. Never tiers. Near-duplicate papers (IT-802B 2016-17 ≈ CS-802B 2015-16) are counted separately because they're separate exams, so the old counts run a little high.
Topics in ≥ 3 of the 7 old papers
Topic
CORE tier
Old (of 7)
OEC (of 2)
Read as
2.2 Cyber Crime & Classification
S
7
2
already S: old pool agrees
2.3 Types of Cyber-Attacks
S
7
2
already S: active vs passive, DNS redirection, spoofing
2.17 DoS, DDoS & Botnets
B
7
1
top insurance topic (split from 2.3 in Topic Map v3)
2.4 Malware
S
7
2
already S: Trojan, virus vs worm, virus hoax
5.5 IT Act: Offences & Penalties
A
7
2
mostly 1-mark facts (sections, year)
2.14 Identity Theft
C
7
1
top insurance topic
3.11 Phishing
B
7
1
top insurance topic
2.13 Stalking, Bullying & Defamation
C
7
0
top insurance topic
3.9 Social Engineering
S
7
0
already S
2.1 Hackers vs Crackers vs Phreakers
S
6
2
already S
2.15 Financial Frauds
C
6
2
insurance: card fraud, salami, data diddling, forgery
2.9 SQL Injection
A
6
1
blind SQLi too
2.16 Mobile & Bluetooth Attacks
B
6
1
insurance
2.6 Reconnaissance, Scanning & Sniffing
B
5
1
recon, sniffing MCQ
6.1 Crypto Basics & Steganography
B
5
0
steganography vs cryptography
5.7 IT Act in Practice
B
4
2
insurance: positives/weak areas, 2008 amendment
5.2 Introduction to Cyber Laws
C
4
1
meaning/need of cyber law
2.5 Backdoors & Trapdoors
S
4
0
Trojan vs backdoor
2.10 Buffer Overflow
B
4
0
types of overflow
6.6 Firewalls & Proxy Servers
A
4
0
proxy server
2.8 Password Attacks
B
3
1
brute force, dictionary, keyloggers
5.6 IPR in Cyberspace
A
3
1
software piracy
1.8 Networking Basics
A
3
0
1-mark facts (LDAP, Telnet port)
2.7 System Hacking Stages
B
3
0
planning phases, anonymizers
3.3 Threats & Attack Vectors
B
3
0
attacks launched with attack vectors
Most repeated old-pool families (≥ 4 of the 7 old papers)
Cyberstalking: definition, how it works, types of stalkers
6
0
0
F-2.4-02
What is a Trojan horse?
5
1
2
F-2.9-01
What is SQL injection?
5
1
2
F-2.2-02
Define cybercrime; classify its types
4
1
0
F-2.4-04
Virus vs worm (vs Trojan)
4
1
2
F-5.2-01
Cyber law: meaning, need, pros & cons
4
1
0
F-2.10-01
Buffer overflow
4
0
2
F-2.13-02
Cyberbullying
4
0
0
F-2.15-03
Data diddling (MCQ)
4
0
0
F-2.3-04
DNS redirection
4
0
0
F-2.5-02
Trojan horse vs backdoor
4
0
0
F-2.6-03
Sniffing (MCQ)
4
0
0
F-3.11-03
Spear phishing / whaling vs spear phishing
4
0
0
F-5.5-01
India's first cyber law / ITA year (MCQ)
4
0
0
F-6.6-02
Proxy server (vs anonymizer)
4
0
0
All 61 R-OTHER-only families, with members, are listed in Part B's "All repeated families" (they show 0/4 because only CORE counts) and in question_bank.md Part A. The blueprint carries an old-pool line on each topic in ≥ 3 old papers.
Rendered by tools/analyze.py. Columns per evidence class are kept separate (L9); – = no papers of that class.
Flags:floor↑ promoted by the per-unit floor (L15) · ⚡facts asked as 1–2-mark facts in ≥2 papers · recent asked in the latest paper · +sec also appears as a secondary part of another topic's question.
F-4.11-01 (4.11) · Data backup (need), archival and disposal security considerations. · 3/4 papers
2022-23 C·10(iii) [6]: Explain the need to take Backup?
2023-24 B·3 [5]: Explain Data backup security, Data archival security, and Data disposal considerations.
2025-26 C·10 [15]: Explain the difference between Virus, Worms and Trozan Horse. What is the data security consideration? Explain in this reference Data backup security, Data archival security and Data disposal considerations.
F-2.5-01 (2.5) · What is a backdoor? · 3/4 papers
2023-24 C·7(b) [5]: [Write short notes on:] Backdoor.
2024-25 B·3(ii) [5]: What is a Backdoor?
2025-26 B·2(ii) [5]: What is a Backdoor?
F-1.3-01 (1.3) · Define / describe the CIA triad (and how to achieve it). · 3/4 papers
2023-24 A·1(III) [1]: Why are the factors like Confidentiality, Integrity, Availability, and Authenticity considered as the fundamentals?
2024-25 B·5 [5]: Describe briefly the CIA Triad and how to achieve it.
2025-26 A·1(XII) [1]: Define CIA Triad.
F-1.2-01 (1.2) · Who coined the term "cyberspace"? · 3/4 papers
2022-23 A·1(I) [1]: “Cyberspace” was coined by _________.
2023-24 A·1(VI) [1]: Cyberspace” was coined by _______.
2024-25 A·1(V) [1]: “Cyberspace” was coined by _________.
F-1.4-01 (1.4) · What is an attempt/act to harm, damage or threaten a system or network called? · 3/4 papers
2022-23 A·1(III) [1]: An attempt to steal, spy, damage or destroy computer systems, networks, or their associated information is known as ________________.
2023-24 A·1(X) [1]: An act to injure, corrupt, or threaten a system or network is characterized__________.
2025-26 A·1(X) [1]: Which of the following is defined as an attempt to harm, damage or cause threat to a system or network? a) Digital crime b) Threats c) System hijacking d) Cyber Attack
F-2.2-01 (2.2) · Elaborate: "Cyber crime plays a vital role against person, property and govt. …" · 2/4 papers
2022-23 C·11 [15]: Elaborate: ''Cyber crime play a vital role against person ,property and govt. to protect all valuable information and rights''.
2023-24 C·11(a) [6]: Elaborate "Cyber-crime plays a vital role against person, property, and govt. to protect all valuable information and rights".
F-4.4-01 (4.4) · Explain the forensic investigation process (its stages). · 2/4 papers
2024-25 C·7(i) [8]: Explain briefly about the Forensics Investigation Process.
2025-26 C·9(a) [10]: Explain the major stages of a forensic investigation process.
2023-24 A·1(XII) [1]: Differentiate Worm and Virus.
2025-26 C·10 [15]: Explain the difference between Virus, Worms and Trozan Horse. What is the data security consideration? Explain in this reference Data backup security, Data archival security and Data disposal considerations.
F-2.9-01 (2.9) · What is SQL injection? Discuss. · 2/4 papers
2023-24 C·8(a) [5]: Discuss the SQL Injection in detail.
2025-26 A·1(III) [1]: ____________ is a code injecting method used for attacking the database of a system / website.
2025-26 C·11(b) [5]: What do you mean by SQL injection attacks.
F-6.6-01 (6.6) · What is a firewall, and how does it work? · 2/4 papers
2022-23 A·1(X) [1]: A ____________ can be a hardware device or a software program that filters all the packets of data that comes through a network, the internet, etc.
2022-23 C·10(ii) [5]: Explain Firewall and working of Firewall?
2023-24 C·7(a) [5]: Write short notes on: Firewall.
F-5.6-01 (5.6) · IPR in cyberspace: short note / significance. · 2/4 papers
2024-25 C·9(c) [5]: [Write a short note on:] c) IPR
2025-26 B·5 [5]: Discuss the significance of intellectual property rights (IPR) in cyberspace.
2022-23 A·1(IX) [1]: When there is an excessive amount of data flow, which the system cannot handle, _____ attack takes place.
2022-23 A·1(XII) [1]: A cyber-criminal or penetration tester uses the additional data that stores certain special instructions in the memory for activities to break the system. Name the type of attack.
2023-24 C·8(b) [5]: What is buffer overflow?
F-2.1-01 (2.1) · Define hacker. List the types of hackers. · 2/4 papers
2024-25 B·3(i) [5]: Define Hacker. List Out the Types of hackers
2025-26 B·2(i) [5]: Define Hacker. List Out the Types of hackers
F-1.4-02 (1.4) · What is a weakness in a system or network called? (vulnerability) · 2/4 papers
2022-23 A·1(VI) [1]: What is the existence of weakness in a system or network is known as?
2023-24 A·1(I) [1]: What is the existence of weakness in a system or network is known as?
F-2.4-01 (2.4) · Which independent malicious program needs no host program? (worm) · 2/4 papers
2022-23 A·1(VII) [1]: Which independent type of malicious program does not require any host program?
2023-24 A·1(IX) [1]: Which is a sort of independent type of malicious program that would not require any host program?
F-2.4-02 (2.4) · What is a Trojan horse? · 2/4 papers
2022-23 A·1(VIII) [1]: What are Trojan-Horse programs?
2025-26 A·1(I) [1]: What is trojan horse?
F-2.4-03 (2.4) · Which malware does not clone/replicate itself? · 2/4 papers
2024-25 A·1(II) [1]: Which malware does not clone or replicate itself through infection?
2025-26 A·1(VI) [1]: Which malware does not clone or replicate itself through infection?
F-2.6-01 (2.6) · Which of these is NOT a scanning type? · 2/4 papers
2024-25 A·1(VI) [1]: Which of these is NOT a scanning type? a. Null Scan b. Xmas Tree Scan c. SYN Stealth d. Cloud Scan
2025-26 A·1(V) [1]: Which of these is NOT a scanning type? a. Null Scan b. Xmas Tree Scan c. SYN Stealth d. Cloud Scan
F-2.7-01 (2.7) · Which is NOT a step followed by cyber-criminals in data breaching? · 2/4 papers
2024-25 A·1(X) [1]: Which of the following is not a step followed by cyber-criminals in data breaching? a) Exfiltration b) Research and info-gathering c) Attack the system d) Fixing the bugs
2025-26 A·1(IX) [1]: Which of the following is not a step followed by cyber-criminals in data breaching? a) Exfiltration b) Research and info-gathering c) Attack the system d) Fixing the bugs
F-1.2-02 (1.2) · What is cyberspace? (alone or with cyber ethics / cybercrime / planning phases) · 0/4 papers
Unit 4: 4.2 Computer Equipment & Storage Media · 4.3 Role of the Forensics Investigator · 4.5 Collecting Network-Based Evidence · 4.6 Writing Computer Forensics Reports · 4.10 ISO 27001:2013
Unit 5: 5.2 Introduction to Cyber Laws · 5.3 E-Commerce & E-Governance · 5.4 Certifying Authority & Controller
4 papers → MEDIUM confidence. With 4 papers, one appearance = 25%, so a single paper can move a topic a whole tier. The tiers are a guide, not a guarantee.
One-off long questions are rated A on purpose: IDS (6.7), Zachman (3.7), SSL (6.8). A full 15-mark question is too valuable to rate B on one appearance.
Marks go to the primary topic only. 2025-26 Q10 [15, split unknown] gives all 15 marks to 2.4 Malware, though part of it asks about backup (4.11). 4.11 still counts that paper for presence and tier. Likewise 2025-26 Q7 credits 6.7 IDS, with 2.12 Application Security getting presence only.
Shared marks are split equally: "Define hacker + What is a backdoor" [5] gives 2.5 each to 2.1 and 2.5.
The PYQ+ block is only as complete as the questions seen. We don't have the CSE syllabus that drives Unit 6, so other crypto/network-security areas could appear that haven't yet. The blueprint (P1E) and the notes should cover Unit 6 topics broadly (L21, L23).
2022-23 Q6 "Discuss matrix mining." is unclear (X.1, 5 marks). It's counted but not interpretable.
Rotation outlook = a tendency, not a law. 91% on 11 calls is strong but small. The average includes the years being tested (which flatters the hit rate a little), and the one miss was Unit 6 itself (expected ↑ in 2025-26, but it fell from 25% to 18%). That makes its expected rise more overdue, but not certain. The outlook only reorders priority. Every unit is still fully prepared (L15, L23).
Tier thresholds were tuned on this subject and confirmed by the founder at CP3.
R-OTHER amendment (Topic Map v2, 2026-10-22). 9 older/other MAKAUT papers (304 rows) were added as support only: mode, confidence and every v1 tier are unchanged (re-checked after the rebuild: 0 of 57 changed). They don't count because they're different subjects (old-scheme IT-802B/CS-802B Cyber Law & Security Policy; 8th-sem elective OEC-CS801B Cyber Law & Ethics), and their syllabi weren't provided, so overlap is inferred from the questions. The 6 new topics get their tiers from CORE only: 2.16, 3.11 and 5.7 are B through one CORE secondary each; 2.13–2.15 are C. Coverage figures ("12 topics → 50%") are unchanged because only CORE marks count.
Topic Map v3 (2026-10-24). 2.3 was split: DoS/DDoS, traffic flooding and botnets moved to the new 2.17 DoS, DDoS & Botnets (22 rows, incl. CORE 2023-24#1(II), 1 mark). 2.3 stays S (8 marks, 4/4 papers); 2.17 is B from that one CORE MCQ but is a top old-pool insurance topic (7/7 old papers). 80% coverage now needs 26 topics instead of 25 because that 1 mark left 2.3.
The picture matches the founder's experience: yes.
Tier S rule ("≥ 60% of papers + at least one 5/15-mark appearance, or a family descriptive in ≥ 3"): agreed.
1-mark-only topics stay B + ⚡ facts: agreed.
Floor choices (1.8 promoted; no floor for the Unit 6 PYQ+ block): OK.
Added by the founder: unit weightage rotates year to year, so analyse it for a next-exam prediction → L25. Back-test: 10/11 (91%). Outlook: U6 ↑ · U1 ↑ · U2 ↓ · U3 ↓ · U4 → · U5 →.