The AP® Cybersecurity exam: format, the FRQ and how to earn every point

Point 1 A (i): How following one rule reduces risk.

Earns the point: Names one part of Source 5 and explains how it protects the device.

Model answer: The policy requires security updates within 7 days of release. Updates patch known vulnerabilities, so an adversary has less time to exploit a published flaw on the catalog server.

Does not earn it: Repeats the rule without saying how it protects ("updates are required"), or names something that is not in the policy.

Point 2 A (ii): Rewrite one existing rule, with new wording.

Earns the point: Gives specific new wording for an existing rule and explains why it protects the server better.

Model answer: Rewrite "Installing software that the technology office has not approved" as "Installing unapproved software, or enabling unencrypted remote services such as Telnet and FTP". Telnet and FTP send usernames and passwords in plaintext, and rules 3 and 4 of the firewall allow both from anywhere.

Does not earn it: Adds a brand-new rule instead of rewriting an existing one, gives vague advice ("make the policy stricter"), or gives no reason.

Point 3 B (i): What in rows 3 to 12 shows the password attack.

Earns the point: Describes repeated failed sign-ins and cites the log.

Model answer: Rows 3 to 12 show ten "authentication failure" entries for user=librarian over FTP (vsftpd) within about ten seconds, 14:20:01 to 14:20:10, all from rhost=203.0.113.9. Many failed attempts against one account in a short time is an online password attack.

Does not earn it: Says "there are failed logins" without citing entries, timing or the account.

Point 4 B (ii): The address the attack came from.

Earns the point: The correct address, and only that one.

Model answer: 203.0.113.9

Does not earn it: The device's own address (10.20.30.15), another address, a port number, or a list of several addresses.

Point 5 C (i): What one file's permission string allows, for owner, group and others.

Earns the point: Names a file and correctly reads all three sets.

Model answer: patrons.csv is -rw-rw-rw-: the owner mreyes can read and write it, members of the group staff can read and write it, and every other user on the system can also read and write it. No one can execute it.

Does not earn it: Reads only one set, or mixes up the order (owner, group, others).

Point 6 C (ii): A new, more limited setting for one named file.

Earns the point: A valid setting that restricts some users, named for one file.

Model answer: patrons.csv: keep read and write for the owner, give the staff group read only, and remove all permissions for others, so only staff can see patron records and only mreyes can change them.

Does not earn it: Removes everything for everyone, removes the owner's own access, or describes a setting that gives more access.

Point 7 C (iii): The chmod command for C (ii).

Earns the point: A correct command matching C (ii).

Model answer: chmod 640 /srv/catalog/patrons.csv (or chmod u=rw,g=r,o= /srv/catalog/patrons.csv)

Does not earn it: A command that does not match C (ii) (for example chmod 644 when C (ii) said "no access for others"), or invalid syntax. Adding sudo is optional.

Point 8 D (i): Why the firewall stopped one attempt, with log evidence.

Earns the point: Cites one blocked attempt and the rule that blocked it.

Model answer: Row 14 of Source 2 is "[UFW BLOCK] SRC=10.20.30.41 ... DPT=22": an SSH connection from 10.20.30.41. Rules are checked from the top. Rule 2 allows SSH only from 10.20.30.40 and no other allow rule covers port 22, so the first rule that matches is rule 7, which denies all other inbound traffic. (Also correct: row 13, SSH from 198.51.100.77, where the first match is rule 5.)

Does not earn it: Names a blocked address without the log evidence, names a rule that does not match, or lists several attempts when one of them is wrong.

Point 9 D (ii): An edit to one existing rule that lets that attempt through.

Earns the point: A specific edit to one existing rule that allows the attempt from D (i).

Model answer: For row 14: change rule 2's source from 10.20.30.40 to 10.20.30.40 and 10.20.30.41. (If D (i) used row 13: add 198.51.100.77 to rule 2's source; rule 2 sits above rule 5, so it matches first.)

Does not earn it: "Delete rule 7" or "allow everything" (far more than one attempt), adding a new rule instead of editing one, or an edit that allows a different attempt from the one in D (i).

Point 10 D (iii): One effect of the edit, beyond that attempt.

Earns the point: A real consequence for traffic or risk that follows from the edit in D (ii).

Model answer: All SSH traffic from 10.20.30.41 now reaches the server, so if that computer is compromised an adversary can try to sign in over SSH from it. It also conflicts with the policy, which permits SSH only from the circulation desk computer. SSH from every address except 10.20.30.40 and 10.20.30.41 is still denied.

Does not earn it: Restates the change ("now .41 can connect") instead of an impact.

Point 11 E (i): The type of the second attack.

Earns the point: Names the attack.

Model answer: SQL injection, in the web server access log (Source 3).

Does not earn it: A general label such as "hacking" or "a web attack", or a list of attack types.

Point 12 E (ii): The specific evidence in that log.

Earns the point: Cites the injected input and what it shows.

Model answer: Rows 3 to 5 come from 203.0.113.61 using curl. Row 3 adds a single quote to id and the server errors (500). Row 4 adds ' OR '1'='1, which is always true, and the reply jumps to 51734 bytes from the normal 2210 for item 118, so the query returned far more rows than one item. Row 5 adds UNION SELECT username,password_hash FROM staff to pull staff password hashes (the -- turns the rest of the original query into a comment).

Does not earn it: Says "strange URLs" without quoting the SQL or reading the response codes and sizes.

Point 13 E (iii): How an automated system could stop it as it happens.

Earns the point: A system and how it stops the attack as it happens.

Model answer: An intrusion prevention system (IPS) in front of the web server inspects each request, matches SQL keywords such as UNION SELECT or ' OR '1'='1 in the URL, drops the request and blocks 203.0.113.61.

Does not earn it: Names a system without saying how it stops the attack, or describes something done later (reviewing logs next week).

Point 14 E (iv): One other countermeasure, not a firewall, IDS, IPS or AI tool.

Earns the point: A valid countermeasure that is not a firewall (including a web application firewall), IDS, IPS or AI tool.

Model answer: Input sanitization in the catalog code (or parameterized queries), so text in id is treated as data and never as part of the SQL command.

Does not earn it: Repeats the system from E (iii), or names a firewall, intrusion detection system (IDS), IPS or AI tool.