AP Cybersecurity — Free Practice Questions, Study Guides & Mock Exams

Learn about digital systems, cyber risks, defensive strategies, and the ethical decisions behind protecting people, data, and organizations.

Topics covered

True/False
Classify
MCQ
Strategy Choice
Trap Classification
numeric
Rule Naming
Diagram Reasoning
Dropdown

Free AP Cybersecurity study guides

Social Engineering Indicators — Recognise the signs that a message is trying to manipulate you — before you click.
Why Tactics Work — Intimidation and urgency exploit responses that serve you well most of the time — that is precisely why they work.
Impacts on Victims — The harm is rarely the message. It is what the disclosed detail unlocks next.
Signs of an Online Password Attack — Every guess is a real login attempt — so the attack writes itself into the log.
How Adversaries Exploit Weak Authentication — Adversaries guess the way people actually build passwords — which is a very short list.
Making Authentication Stronger — Long, random, unique — then add a factor that still works once the password is known.
Identifying the Adversary — Two axes: what they can build, and why they came here.
Types of Wireless Cyberattacks — Listen, block, or survey — the goal separates three attacks that all travel over the air.
Protecting Sensitive Data on Public Wi-Fi — Encryption does not remove the observer — it changes who the observer is.
How Adversaries Use AI to Augment Cyberattacks — AI invents no new attacks. It removes the effort, the language barrier, and the tells.
Defending Against AI-Augmented Attacks — You cannot detect a good fake. Verify through a channel the adversary does not control.
Leveraging AI in Cyber Defense — AI produces recommendations, never decisions — a qualified human approves before anything ships.
AI Threat Detection & Response — The bottleneck was never seeing events. It was deciding which ones deserve a human.
Social-Engineering Attacks — Every tactic borrows a feeling strong enough that the ordinary check feels unnecessary.
Types of Adversaries — Ask what they want and what access they started with — the rest follows.
Phases of a Cyberattack — Six stages an adversary may work through — and the evidence each one leaves behind.
Risk Assessment Process — Threat, vulnerability, asset — all three, scored by likelihood and severity.
Risk-Management Strategies — Avoid, transfer, mitigate, accept — and write down what you accepted.
Types of Security Controls — Three labels at once: the principle it serves, where it lives, and what it does.
Defense-in-Depth — Every control has a bypass. The next layer is what catches it.
Common Physical Attacks — They bypass every technical control — and most of them work by exploiting politeness.
How Threats Exploit Physical Vulnerabilities — Physical access is a shortcut past every technical control — and one threat has no attacker at all.
Rating & Documenting Physical Risk — Band each finding by what it exposes and what it leads to — then write down why.
Managerial Controls for Physical Security — A policy is a control only when people can follow it and someone checks that they do.
Layered Physical Mitigation — Choose each control by the mechanism it interrupts — then layer prevention, detection and recovery.
Detecting Physical Attacks — Detection is worth having only if the signal reaches somebody who will act on it.
Placing Detection Controls — Put each detector where its signal means something — not where there is space on the wall.
Identifying Physical Attacks — One sensor rarely resolves anything. Pair the trigger with a camera and the ambiguity goes.
Identifying Common Network Attacks — Three of them poison a lookup table. The fourth just floods. Ask which table is lying.
Exploiting Network Vulnerabilities — Getting in is the first problem. Moving sideways afterwards is what makes it a breach.
Assessing & Documenting Network Risk — Difficulty lowers likelihood, never severity — and a scanner report is an input, not an assessment.
Managerial Controls for Network Security — A configuration standard makes the secure setting the default rather than the exception.
Wireless Security Configuration — Encryption and authentication do the work. Hiding the name only buys time.
Network Segmentation Techniques — All three buy the same thing: a compromised device reaches fewer other devices.
Why Segmentation Increases Security — It does not stop the compromise. It decides how much the compromise is worth.
Types of Network Firewalls — They differ in how much context each one has at the moment it decides.
Firewall Access Control Lists — Rules are checked in order and the first match wins — so order is not cosmetic.
Firewall Placement — One firewall per boundary — and each gets the strictness its contents deserve.
Configuring Firewall Rules — Translate the requirement clause by clause — then order specific above general.
Automated Network Detection Tools — NIDS tells you. NIPS acts. SIEM joins the dots across everything else.
Leveraging AI for Threat Detection — The model outputs a probability. The organisation chooses the threshold — and that choice is the policy.
Choosing a Network Detection Method — Signature, anomaly or hybrid — decided by four properties of the network, not by preference.
Evaluating Detection Impact — Speed, cost, false positives, false negatives — and no method wins all four.
Analyzing Logs for IoCs — Six network attacks, six different signatures — and four capture fields where the evidence lives.
Classifying Computing Devices — Classify by what the device is for — because that predicts how well it can be defended.
Identifying Malware Types — Ask how it spreads and what it does — most samples are one answer from each column.
Exploiting Device Vulnerabilities — Most device compromises use a weakness that was known, documented and fixable beforehand.
Assessing & Documenting Device-Vulnerability Risk — Ask what the device touches — sensitive data, critical operations, or neither.
Storing Passwords as Hashes — A service should never know your password — only enough to recognise it.
Password Attacks — Online attacks are loud and limited. Offline attacks are silent and unlimited.
Authentication Factors & MFA — Name the factor by the kind of proof it asks for — then count how many kinds are required.
Hardening Login Settings — Five settings, three jobs: shape the password, age it, and slow the attacker down.
Managerial Controls for Device Security — A device policy works when it says what is allowed and how to ask for the rest.
Anti-Malware Software — It compares files against a database of known signatures — its strength and its limit, in one sentence.
Why Updates Matter — A published fix also publishes the flaw — which is why delay is the whole exposure.
Host-Based Firewall — The one filter that still applies when the network is already compromised.
Detecting Attacks on Devices — An indicator of compromise is evidence — found in logs, in files, or in behaviour.
Choosing Device Detection Controls — Choose per device, not per organisation — the criteria resolve differently on each machine.
Evaluating Device Detection Methods — Devices lack headroom — so most device detection is signature-based, and inherits its blind spot.
Reading Auth Logs for Password-Attack IoCs — Count users per source and passwords per user — those two numbers name the attack.
Exploiting Application & File Vulnerabilities — Files are protected by encryption and permissions. Remove either and possession becomes access.
Application Attacks — All four are the same failure: user input treated as instructions instead of data.
Assessing & Documenting Data Risk — Two dials set the band: how sensitive the data is, and how weak the protection is.
Data State & Classification — State decides which control applies. Classification decides how much of it you apply.
Managerial Controls for App/Data Security — Both policies do one job: take a technical decision once, centrally, instead of per project.
Choosing an Access-Control Model — Subjects, operations, objects — the model is just who gets to decide.
Linux File Permissions (chmod, octal) — Read the rwx string, do the 4–2–1 arithmetic, set it the numeric or symbolic way — then verify.
Encryption Protects Stored Files — The algorithm is public. The key is the secret — and the keyspace is what makes guessing hopeless.
Applying Symmetric Encryption — One key, both directions — which makes key handling the whole problem.
Choosing the Asymmetric Key — Public to encrypt, private to decrypt — and both of them belong to the receiver.
Key Length and Security — An n-bit key has a keyspace of 2ⁿ — and guessing it takes half that, on average.
Applying Asymmetric Encryption — Encrypt with the public key, decrypt with the private one — which is why the public half can be published.
Secure by Design & Default — Security in every phase of development — and enabled before the customer touches anything.
Input Sanitization — Applications encase input in control characters — sanitisation stops the user supplying their own.
Detecting Attacks on Data — Unusual access, a file nobody should touch, and a digest that changed.
Determining Detective Controls — Two criteria are judgement. The third may be decided for you by law.
Evaluating a Detection Method — Judge it on speed — and on what it structurally cannot see.
Verifying a File Hash — Hashes are repeatable — so a different output can only mean a different file.
Detecting App-Attack IoCs in Logs — Each attack leaves a literal string or a length — and both are things you can search for.

Units

Unit 1
Unit 2
Unit 3
Unit 4
Unit 5

Browse all subjects · All study guides