AP® Cybersecurity · Unit 3 Primer
Unit 3 networking reference sheet
The facts Unit 3 questions lean on, in one place. Keep it open while you work through the unit, or print it. Each block links to the page that teaches it.
1. Devices
| Device | Works with | Job |
|---|---|---|
| Switch | Media access control (MAC) addresses | Delivers frames inside one local area network (LAN) and keeps a MAC address table. |
| Router | Internet Protocol (IP) addresses | Forwards packets between networks; acts as the default gateway. |
| Wireless access point | Radio | Connects wireless devices to the LAN. |
| Firewall | Rules | Allows or denies traffic by address, port, protocol and direction. |
2. Addresses
| MAC address | IP address (version 4, IPv4) | |
|---|---|---|
| Size | 48 bits, written in hexadecimal | 32 bits, four numbers from 0 to 255 |
| Set by | The manufacturer | The network |
| Used | On one local link | Across networks |
| Example | 3C:52:82:4A:9F:10 | 192.168.1.10 |
Broadcast MAC address: FF:FF:FF:FF:FF:FF. The Address Resolution Protocol (ARP) finds the MAC address for an IP address on a LAN; the Domain Name System (DNS) finds the IP address for a name.
3. Address ranges
| Prefix | Network part | Addresses |
|---|---|---|
| /8 | First number | 16,777,216 |
| /16 | First two numbers | 65,536 |
| /24 | First three numbers | 256 |
192.168.1.0/24 runs from 192.168.1.0 to 192.168.1.255. In a /24, .0 is the network address and .255 the broadcast address.
Private ranges: 10.0.0.0/8, 172.16.0.0 to 172.31.255.255, 192.168.0.0/16. 127.0.0.1 means this device.
4. Ports
| Port | Service | Encrypted? |
|---|---|---|
| 21 | File Transfer Protocol (FTP) | No |
| 22 | Secure Shell (SSH) | Yes |
| 23 | Telnet | No: turn it off |
| 25 | Simple Mail Transfer Protocol (SMTP) | Not by default |
| 53 | DNS | No |
| 80 | Hypertext Transfer Protocol (HTTP) | No |
| 443 | HTTP Secure (HTTPS) | Yes |
| 3389 | Remote Desktop Protocol (RDP) | Yes, but keep it off the internet |
5. Protocols
- Transmission Control Protocol (TCP): sets up a connection first with a three-way handshake: synchronize (SYN), synchronize-acknowledge (SYN-ACK), acknowledge (ACK), then delivers reliably.
- User Datagram Protocol (UDP): no connection; fast, with no delivery check.
- Internet Control Message Protocol (ICMP): no ports; used by ping; abused in smurf attacks.
6. Reading a firewall rule
DENY inbound TCP port 23 from ALL
Read it as: action, direction, protocol, destination port, source.
Rules are checked from the top, and the first rule that matches decides. Put specific rules above general ones. A stateless firewall checks each packet's header; a stateful firewall also tracks connections.
7. Reading a log line
2026-10-12 04:40:03 DENY TCP 198.51.100.7:51544 -> 10.0.0.20:22
Fields: time, action, protocol, source IP address and port, destination IP address and port. Here an outside host tried to reach SSH on an internal server at 4:40 a.m. and was blocked.
8. Attacks: what they abuse and how to detect them
| Attack | Abuses | Detect by |
|---|---|---|
| ARP poisoning (an on-path attack) | Unverified ARP replies | Duplicate MAC address in ARP packets; check the default gateway's ARP table |
| MAC flooding | The switch's MAC address table | A surge of frames from many different MAC addresses; check the switch's MAC address table |
| DNS poisoning | Trusted DNS records | A sudden, unexplained drop in a website's traffic; check the DNS records |
| Smurf attack (denial of service) | ICMP sent to a broadcast address | A surge of ICMP requests to the broadcast address |
| Evil twin | A copied or look-alike service set identifier (SSID), the network name | Scan for similar SSIDs; locate the source by triangulation |
| Jamming | The radio signal | Devices cannot connect; electromagnetic noise on the channel |
| Network scan | Open ports | One source trying many ports or many hosts |
9. Choosing a detection method
| Situation | Method | Trade-off |
|---|---|---|
| High traffic volume, and speed matters | Signature-based | Fast, with very few false positives, but misses new attacks. |
| Consistent traffic, and new attacks are likely | Anomaly-based | Needs a baseline recorded on a clean network; costs more than signature-based and gives more false positives. |
| Sensitive or critical data, and the budget allows it | Hybrid | Catches the most, but costs the most and raises the most alerts. |
10. Protections
- Wireless: Wi-Fi Protected Access 3 (WPA3) is the strongest; never Wired Equivalent Privacy (WEP), Wi-Fi Protected Setup (WPS) or the original WPA. Use Extensible Authentication Protocol (EAP) with an authentication server, turn off beacon broadcasting, and limit the signal to the space it should cover.
- Remote access: a virtual private network (VPN) only for the roles that need it, sign-in with key pairs or multifactor authentication (MFA), and no split tunneling.
- Segmentation: a screened subnet (also called a demilitarized zone, or DMZ) for public servers; subnets and virtual LANs (VLANs) to separate groups; firewalls between segments and at every ingress and egress point; port security against MAC flooding.
- Goals: the CIA triad: confidentiality, integrity and availability.
3.2 Managerial Controls and Wireless Security · 3.3 Segmentation