- Reading time: 3 minutes
- Price: Free download
- Published: 17th September 2026
- Word count: 784 words
- File format: Text
Why do you want to study this course or subject?
The part of my Computer Science A level that stuck with me was not writing programs but watching how they talk to each other. When we studied the TCP handshake, I set up two virtual machines on an old laptop and captured the traffic in Wireshark just to see the SYN, SYN-ACK and ACK appear in order. What struck me was how much of it is agreement rather than enforcement: protocols work because both ends behave as expected, and a great deal of security exists to handle the case where one end does not. That shifted my interest from building things to examining how they fail. Since then I have read parts of Ross Anderson's Security Engineering, borrowed from the college library, and found his argument that incentives shape security outcomes as much as cryptography does genuinely surprising. A well-configured firewall is no help if the people around it are rewarded for working around it. I want a degree that takes both halves seriously. I am drawn to network security specifically because the problems are layered and public: the same packet can be legitimate, malformed or malicious depending on context, and deciding which requires understanding routing, protocol design, logs and human behaviour together. I am aware the field asks for patience with detail and steady reading rather than quick wins, and that suits how I like to work. Longer term I would like to work in defensive security or network operations, and I want a strong grounding in operating systems, cryptography and networking before specialising.
How have your qualifications and studies helped you to prepare?
My A levels give me the foundations I need. Computer Science covers networking, data representation and systems architecture; I chose a packet-sniffing and traffic-analysis tool for my coursework project, writing it in Python and producing a simple summary of protocols seen on my own home network. The hardest part was not the code but deciding what counted as normal, which taught me more about baselines than any textbook section. Mathematics has been the more demanding subject and the more useful one. Working through modular arithmetic in the pure modules made RSA readable rather than mysterious when I met it, and the statistics content has made me cautious about drawing conclusions from small samples of log data. Geography seems unrelated, but the fieldwork unit trained me in collecting messy data, acknowledging its limitations and writing up findings clearly, which is closer to incident reporting than people expect. Outside the syllabus I completed a free introductory networking course online, covering subnetting and the OSI model, and I practise on TryHackMe rooms most weeks, keeping notes on what I got stuck on. I also entered the CyberFirst Girls-style team competition run through my college, where we worked on cryptography and forensics puzzles under time pressure and came a respectable middle of the field. I am comfortable reading documentation, including RFCs when I need the exact wording of a protocol behaviour.
What else have you done to prepare outside of education, and why are these experiences useful?
In the summer I spent three supervised days with the two-person IT team at my college, arranged through my tutor. My role was firmly that of an observer and helper: I labelled patch panel ports, checked a spreadsheet of device inventory against what was physically in a cupboard, and sat with the network manager while he reviewed firewall logs and explained why a blocked request was probably a misconfigured printer rather than an attack. I was not given access to live systems or student data, and the boundary itself was instructive. I saw how much of the work is documentation, change control and telling colleagues no politely. I also noticed how ordinary the pressures are: an ageing switch, a supplier deadline and a holiday period all shaping what could realistically be secured first. Every other Saturday I help at a digital skills drop-in at my local library, mostly supporting older residents with phones and email. Explaining why a text message asking for bank details is suspicious, without being patronising or frightening, is harder than explaining phishing in an essay. That has made me more interested in usable security. I also work Saturdays in a bakery, where early starts, cash handling and dealing with queues have made me reliable and calm when things go wrong. Between shifts, college and the drop-in I have had to plan my weeks carefully, and I expect that habit to carry into a demanding degree.
This example has 4,391 characters across the three answers. Use it for ideas and structure. Your own UCAS answers must fit within 4,000 characters in total, including spaces.
Why this example works — strengths and ways to improve
This is a thoughtful, specific statement. Its motivation grows from hands-on curiosity, and the work placement is framed honestly within its limits. The main problem is length: at 4,391 characters it exceeds the 4,000-character UCAS limit, so you need to cut. A few vague or conflicting details also weaken credibility. The bakery reflection is the most generic passage.
Subject motivation
What struck me was how much of it is agreement rather than enforcement
This is genuine curiosity. You move from a concrete Wireshark experiment to an idea about protocols and trust. You then connect Anderson's incentives argument to the human side of security, which explains why network security specifically appeals to you, not just computing in general.
Academic preparation
Working through modular arithmetic in the pure modules made RSA readable rather than mysterious
You link syllabus content to a specific payoff rather than just listing subjects. The same is true of statistics and log samples. The Geography link to incident reporting feels more forced, so it is a good candidate for trimming when you cut for length.
Evidence and reflection
The hardest part was not the code but deciding what counted as normal
This is real reflection. You identify a conceptual difficulty, establishing baselines, that matters in defensive security. The library drop-in insight about usable security works the same way. By contrast, the bakery making you "reliable and calm" is a generic skill claim without reflection.
Relevant experience
I was not given access to live systems or student data
Your college IT placement is modest but well used. You describe the actual tasks, and noticing documentation, change control and resource pressures shows judgement. Acknowledging the access boundary strengthens your account rather than diminishing it. TryHackMe and the competition sit well here too.
Credibility and voice
I also entered the CyberFirst Girls-style team competition run through my college
"CyberFirst Girls-style" is vague: it is unclear what competition you actually entered. Name it accurately or describe it plainly. Elsewhere, you say you help "every other Saturday" at the library and also "work Saturdays" at the bakery. Readers may notice this conflict, so clarify it.
Structure and format
This example has 4,391 characters across the three answers.
Each answer comfortably exceeds 350 characters, and the evidence rarely overlaps between answers. However, the total is about 391 characters over the 4,000 limit. Cut repetition rather than substance: the bakery sentence, the Geography aside and some phrasing in the motivation answer are the obvious places to start.
What you’ve done well
- Your opening uses a self-directed Wireshark capture of the TCP handshake to show curiosity concretely, then builds a genuine idea from it about agreement versus enforcement.
- Your account of the IT placement is honest about your observer role and draws mature lessons about documentation and realistic constraints, without overstating your authority.
How this draft could improve
- Reduce the total to 4,000 characters or fewer. Start with the generic bakery reliability claim and the weaker Geography link, and keep the reflective passages intact.
- Replace "CyberFirst Girls-style" with the accurate name of the competition, and resolve the conflicting Saturday commitments so every detail reads as precise and verifiable.
- Consider softening or supporting the RFC claim with one brief instance of when you used one, so it reads as evidence rather than assertion.