LockInCS

AP® Cybersecurity · practice exam

Practice exam: Section I, multiple choice

60 questions, 80 minutes, all five units, like the multiple-choice section of the AP® exam (70% of your score). No feedback until you submit; then you get your score by unit and every answer explained.

Questions come from this site's topic checkpoints: Unit 1: 11, Unit 2: 10, Unit 3: 13, Unit 4: 10, Unit 5: 16. Evidence-based questions are chosen first. For the free-response section, use the practice FRQ (50 minutes).

  1. 1 Which of the following attacks does input sanitization help protect against?
    Show answer

    Answer: A. Verifying and sanitizing user input protects against many application attacks, including SQL injection, XSS and directory traversal.

    Topic 5.5 Protecting Applications

  2. 2 Which command removes write permission from the group and from others, without changing the owner?
    Show answer

    Answer: B. Symbolic method: g is the group, o is others, - removes a permission and w is write.

    Topic 5.2 Protecting Applications and Data: Managerial Controls and Access Controls

  3. 3 A 48-byte file is encrypted with AES. Which of the following best describes how AES processes it?
    Show answer

    Answer: C. AES is a symmetric key block cipher that encrypts data in 128-bit blocks (16 bytes); block encryption produces an output block for each input block.

    Topic 5.3 Protecting Stored Data with Cryptography

  4. 4 A student uses a VPN on hotel Wi-Fi. Who can still view the student's traffic?
    Show answer

    Answer: D. A VPN encrypts all traffic to the VPN operator's system, hiding it from the service provider, but the VPN provider can view it.

    Topic 1.3 Best Practices for Public Networks

  5. 5 A research lab expects adversaries to try brand-new attacks, but cannot afford hybrid detection. What should it choose?
    Show answer

    Answer: A. Signature-based detection cannot detect a new attack. Anomaly-based detection is preferred when hybrid detection costs too much.

    Topic 3.5 Detecting Network Attacks

  6. 6 A company is writing its password policy. Which of the following would most likely appear in it?
    Show answer

    Answer: B. Password policies cover length, how long a password may be kept, reuse, construction rules and using password managers.

    Topic 4.3 Protecting Devices

  7. 7 A company learns its user:password hash database was stolen last month. Its authentication logs show nothing unusual. What should it do?
    Show answer

    Answer: C. Offline password attacks cannot be detected; if a hash database is compromised, every password in it should be treated as insecure and reset.

    Topic 4.4 Detecting Attacks on Devices

  8. 8 A network has three segments and two internet connections. Where should firewalls be placed?
    Show answer

    Answer: D. Each segment should have a firewall, and every point of data ingress and egress between the internal network and the internet should have one.

    Topic 3.4 Protecting Networks: Firewalls

  9. 9 A bank lets customers verify their identity by speaking a passphrase on the phone. Which of the following best explains why voice cloning is a growing risk for the bank?
    Show answer

    Answer: A. With voice-based authentication, a convincing cloned voice can impersonate the user to the system, increasing the potential impact.

    Topic 1.4 AI-Based Cybersecurity Attacks

  10. 10 A network's monitoring shows a victim being flooded by replies during a smurf attack. Which of the following devices actually send the flood of traffic that reaches the victim?
    Show answer

    Answer: B. The adversary sends ICMP requests, carrying the victim's address, to a network's broadcast address. The gateway passes them to every device, and every device replies to the victim. Those replies form the flood.

    Topic 3.1 Network Vulnerabilities and Attacks

  11. 11 A laptop has a strong password and full encryption. Which of the following best explains why leaving it unattended with open Universal Serial Bus (USB) ports is still a risk?
    Show answer

    Answer: C. Physical access to a device and its ports lets an adversary plug in a keylogger or malware drive, bypassing many technical controls.

    Topic 2.2 Physical Vulnerabilities and Attacks

  12. 12 A student joins a fake "Airport Free WiFi" network run by an adversary and then logs in to a site using HTTPS. Which of the following can the adversary do?
    Show answer

    Answer: D. In an evil twin attack the adversary captures traffic, but cannot read traffic that uses an encrypted protocol like HTTPS.

    Topic 1.3 Best Practices for Public Networks

  13. 13 Mei receives a file encrypted with her public key. Which key decrypts it?
    Show answer

    Answer: A. Either key in a pair can encrypt, but only the other key in the pair can decrypt. Data encrypted with Mei's public key need Mei's private key.

    Topic 5.4 Asymmetric Cryptography

  14. 14 Anti-malware finds no malicious files on a laptop, yet a check of its random access memory (RAM) shows malicious code running inside a legitimate built-in program. Which of the following best explains this?
    Show answer

    Answer: B. Fileless malware lives in RAM and uses legitimate programs already installed, so there may be no malicious file to find.

    Topic 4.1 Device Vulnerabilities and Attacks

  15. 15 A student receives a text: "Pay the fee today or your phone line will be cut off and reported." Which of the following best describes the two tactics this message combines?
    Show answer

    Answer: C. "Today" creates urgency, a reason to act quickly. "Cut off and reported" is intimidation, a threat of negative consequences.

    Topic 1.1 Understanding Social Engineering

  16. 16 A school district must decide which systems to monitor most closely. Which system should get the closest monitoring?
    Show answer

    Answer: D. More sensitive or critical data are likelier targets and should be monitored more closely; educational and healthcare data often have legal monitoring requirements.

    Topic 5.6 Detecting Attacks on Data and Applications

  17. 17 A hospital wants one service that monitors all its laptops and servers and sends every alert to a central platform. Which of the following does it want?
    Show answer

    Answer: A. EDR services from a vendor give a holistic, unified approach to device threat detection with a centralized alert platform, though they are expensive.

    Topic 4.4 Detecting Attacks on Devices

  18. 18 A teacher tells students to spot phishing by looking for spelling and grammar mistakes. Which of the following best explains why this check is weaker than it used to be?
    Show answer

    Answer: B. Large language models (LLMs) let adversaries write phishing that reads as though a native speaker wrote it, so unnatural language is a less reliable clue.

    Topic 1.4 AI-Based Cybersecurity Attacks

  19. 19 A developer adds a function that removes < and > characters from every comment before it is saved. Which attack does this most directly protect against?
    Show answer

    Answer: C. Sanitizing user input by removing potentially malicious characters protects against attacks including XSS, which relies on script tags.

    Topic 5.5 Protecting Applications

  20. 20 A new intern needs to read the marketing calendar. Which permission is the best choice under the principle of least privilege?
    Show answer

    Answer: D. Least privilege gives an entity exactly as much access as it needs to perform its function and no more.

    Topic 5.2 Protecting Applications and Data: Managerial Controls and Access Controls

  21. 21 A virtual private network (VPN) policy prohibits split tunneling. What does this prevent?
    Show answer

    Answer: A. VPN policies may prohibit split tunneling (also called dual tunneling), where traffic is split between the VPN and a direct internet connection.

    Topic 3.2 Protecting Networks: Managerial Controls and Wireless Security

  22. 22 A student's password was leaked in a data breach, but the adversary still cannot log in. Which of the following controls most likely stopped the adversary?
    Show answer

    Answer: B. Multifactor authentication (MFA) requires extra proof, such as a one-time code, in addition to the password, so a stolen password alone is not enough.

    Topic 1.2 Suspicious Website Logins

  23. 23 A courier's bag is stolen with an external drive inside. The drive holds unencrypted delivery records. Which of the following is the most likely result?
    Show answer

    Answer: C. An adversary can read any unencrypted files once they have access to the device or drive that stores them.

    Topic 5.1 Application and Data Vulnerabilities and Attacks

  24. 24 Malware infects one laptop in a segmented network. Which of the following explains why fewer devices are exposed than in a flat network?
    Show answer

    Answer: D. Subnets isolate traffic, which can prevent attacks on one subnet from impacting devices on other subnets.

    Topic 3.3 Protecting Networks: Segmentation

  25. 25 Which of the following is the main advantage of asymmetric encryption over symmetric encryption?
    Show answer

    Answer: A. Asymmetric encryption allows users to communicate securely without prearranging a shared secret key.

    Topic 5.4 Asymmetric Cryptography

  26. 26 A hospital wants a tool that can block an attack as soon as it is detected, not only report it. Which of the following can a network intrusion prevention system (NIPS) do that a network intrusion detection system (NIDS) cannot?
    Show answer

    Answer: B. Both analyze data and detect attacks. A NIPS can also mitigate or halt an attack by closing ports, blocking specific IP or MAC addresses, or rejecting protocols.

    Topic 3.5 Detecting Network Attacks

  27. 27 Which of the following is the most likely trade-off of switching from AES 128-bit keys to AES 256-bit keys?
    Show answer

    Answer: C. AES can use keys of different lengths. Longer keys produce more secure encryption but require more time to encrypt and decrypt. The block size stays 128 bits.

    Topic 5.3 Protecting Stored Data with Cryptography

  28. 28 A router security policy requires that all router logins use an approved authentication server. Which setting breaks this policy?
    Show answer

    Answer: D. Router policies ban local user accounts; logins must go through an approved authentication server.

    Topic 3.2 Protecting Networks: Managerial Controls and Wireless Security

  29. 29 Which of the following combinations is multifactor authentication?
    Show answer

    Answer: A. MFA needs more than one type of factor. A password (knowledge) plus a phone (possession) is two factors; a password and a PIN are both knowledge.

    Topic 4.2 Authentication

  30. 30 A school has a low-cost fix for a high risk and an expensive fix for a low risk. Which should it prioritize?
    Show answer

    Answer: A. Organizations prioritize mitigations based on the severity of the risks and the cost of the recommended mitigations.

    Topic 2.3 Protecting Physical Spaces

  31. 31 A school installs a security camera above the entrance to its server room. Which of the following best classifies this control?
    Show answer

    Answer: B. By type, a camera is a physical control. By function, it helps identify attacks as they occur, so it is a detective control.

    Topic 2.1 Cyber Foundations

  32. 32 Which of the following methods identifies an attack only after it has occurred?
    Show answer

    Answer: C. Some DLP tools, honeypots and realtime automated log analysis alert as the attack is happening. Retrospective log analysis and hash checks identify attacks after they occur.

    Topic 5.6 Detecting Attacks on Data and Applications

  33. 33 A hospital's four security analysts monitor its whole network. Which of the following best explains why the team uses AI to help with detection?
    Show answer

    Answer: D. Of the millions of daily events, a few likely represent malicious activity, and humans cannot carefully examine them all.

    Topic 1.5 Leveraging AI in Cyber Defense

  34. 34 On average, how many guesses would an adversary need to find a randomly chosen 12-bit key?
    Show answer

    Answer: B. A 12-bit key has a keyspace of 2^12 = 4,096. Random guessing finds it in 2^12 / 2 = 2^11 = 2,048 guesses on average.

    Topic 5.4 Asymmetric Cryptography

  35. 35 A policy says staff must lock their screen and put away sensitive papers before leaving their desk. What is this?
    Show answer

    Answer: C. A workstation security policy requires measures such as locking devices and clearing sensitive documents (a clean desk policy).

    Topic 2.3 Protecting Physical Spaces

  36. 36 A security audit finds a rogue access point plugged into a wall port inside a school. Which of the following best explains why it can be more dangerous than an adversary attacking from the internet?
    Show answer

    Answer: D. Traffic from the internet must cross the boundary firewalls. A rogue access point plugged into an internal port gives the adversary access to the LAN from the inside, so its traffic to internal devices never passes those firewalls. How far it reaches depends on the design: port security, device authentication and internal segmentation can limit it.

    Topic 3.1 Network Vulnerabilities and Attacks

  37. 37 A school's network already has a firewall. Which of the following best explains why each laptop should also run a host-based firewall?
    Show answer

    Answer: A. Host-based firewalls allow or deny traffic into or out of a single device, adding protection when a host is on a compromised network.

    Topic 4.3 Protecting Devices

  38. 38 A school laptop has no BIOS (basic input/output system) or UEFI (unified extensible firmware interface) password. Which of the following could an adversary with physical access most likely do?
    Show answer

    Answer: B. Without BIOS or UEFI protection, an adversary can load their own operating system from an external drive or boot into a privileged mode and alter user profiles and passwords.

    Topic 4.1 Device Vulnerabilities and Attacks

  39. 39 A quiz on social media asks for your first pet's name and the street you grew up on. Why could answering be risky?
    Show answer

    Answer: C. Personal details like pet names and addresses are common challenge questions used to verify identity, so they help an adversary impersonate you.

    Topic 1.1 Understanding Social Engineering

  40. 40 An artificial intelligence (AI) detector scored real attack traffic at 72% likely malicious, but no alert fired because the threshold is 95%. Which of the following does this show about the threshold?
    Show answer

    Answer: D. If the threshold is set too high, real attacks may go undetected. Too low, and the team is overwhelmed with false alerts.

    Topic 3.5 Detecting Network Attacks

  41. 41 A security manager wants to put a motion sensor in the busy main hallway of an office. Which of the following best explains why this is a poor choice?
    Show answer

    Answer: A. Motion sensors in high-traffic areas create many false alarms, making alarms less likely to be taken seriously.

    Topic 2.4 Detecting Physical Attacks

  42. 42 An AI tool recommends tightening a firewall rule. Which of the following should happen before the rule is applied?
    Show answer

    Answer: B. AI recommendations for security configurations should always be checked by a knowledgeable security technician before implementation.

    Topic 1.5 Leveraging AI in Cyber Defense

  43. 43 An adversary carrying two large boxes waits by a secure door until an employee holds it open for them. Which attack is this?
    Show answer

    Answer: C. Piggybacking uses social engineering to get an authorized person to grant access, such as holding the door for someone carrying something large.

    Topic 2.2 Physical Vulnerabilities and Attacks

  44. 44 A school has one stationary guard to place. Which of the following locations makes the guard most effective?
    Show answer

    Answer: D. Stationary guards are highly effective at places that funnel traffic, such as entry gates, main lobbies and entrances to secure areas. Patrolling the parking lot or the fence line is a job for patrolling guards, which suit perimeters and exterior areas.

    Topic 2.4 Detecting Physical Attacks

  45. 45 An analyst is reviewing access logs for behavior-based indicators of compromise. Which of the following is one?
    Show answer

    Answer: A. Behavior-based IoCs found in logs include multiple failed logins, unusual login times or locations, unauthorized attempts to access sensitive data, and attempts to elevate privileges.

    Topic 4.4 Detecting Attacks on Devices

  46. 46 A network administrator is choosing between two types of firewall. Which of the following can a stateful firewall do that a stateless firewall cannot?
    Show answer

    Answer: B. Stateless firewalls filter on header information such as IP addresses, ports and protocols. Stateful firewalls also track connection state.

    Topic 3.4 Protecting Networks: Firewalls

  47. 47 War drivers detect a company's Wi-Fi signal from the street. Which configuration change addresses this most directly?
    Show answer

    Answer: C. Controlling broadcast direction and signal strength keeps the signal inside the physical space the access point should cover.

    Topic 3.2 Protecting Networks: Managerial Controls and Wireless Security

  48. 48 A school network answers scans from any connected device with a list of every device's name and operating system version. Nothing else is exposed. How should this risk be rated?
    Show answer

    Answer: D. Moderate risks let adversaries gain information about systems or devices on a network. A list of names and versions helps an adversary plan an attack, but by itself does not let them capture traffic or take control.

    Topic 3.1 Network Vulnerabilities and Attacks

  49. 49 A technician uses bash. Which command generates the SHA-256 hash of a file named report.pdf?
    Show answer

    Answer: A. In bash, sha256sum generates the SHA-256 hash. Get-FileHash is the Windows PowerShell command, and shasum -a 256 is used in zsh.

    Topic 5.6 Detecting Attacks on Data and Applications

  50. 50 Two vulnerabilities would cause the same damage. One has a well-documented public exploit; the other needs rare expert skill. Which is more likely to be exploited?
    Show answer

    Answer: D. Likelihood depends partly on the skill required. Well-documented exploits need less skill and can be carried out by more adversaries.

    Topic 2.1 Cyber Foundations

  51. 51 An adversary slips through a door right behind an employee who never notices. Which attack is this?
    Show answer

    Answer: B. Tailgating is following an authorized person into a restricted area without their awareness or knowledge.

    Topic 2.2 Physical Vulnerabilities and Attacks

  52. 52 A caller says, "I'm calling for the head of information technology (IT), who asked me to collect your login for the system migration." Which pair of tactics is used?
    Show answer

    Answer: C. The system migration is a believable reason to make contact (pretexting), and relaying instructions from someone with power over the target is authority.

    Topic 2.1 Cyber Foundations

  53. 53 A student wants a free chatbot to help fill in a form that includes their medical history. Which of the following is the best reason to avoid pasting the form into the chatbot?
    Show answer

    Answer: A. Some AI-powered tools feed user input back into training, and adversaries can craft prompts that extract sensitive information from LLMs.

    Topic 1.4 AI-Based Cybersecurity Attacks

  54. 54 A developer is choosing a hash function for a new password system. Which of the following is deprecated and should not be used in secure settings?
    Show answer

    Answer: A. If an efficient way to force collisions exists, a hash function is deprecated. MD5 and SHA-1 are examples.

    Topic 4.2 Authentication

  55. 55 An adversary searches a precomputed list of common passwords and their hashes, sorted by hash, for a stolen hash. Which of the following attacks is this?
    Show answer

    Answer: B. A rainbow table contains potential passwords and their hashes, sorted by hash, which is searched for the captured hash.

    Topic 4.2 Authentication

  56. 56 A doctor has a patient's chart open on screen and is editing it. Which state are the data in, and which control protects them in that state?
    Show answer

    Answer: C. Data in use are being processed by software or a person. They must be unencrypted to be used, so access controls limit who can view or edit them.

    Topic 5.2 Protecting Applications and Data: Managerial Controls and Access Controls

  57. 57 A school is deciding which servers to place in its screened subnet. Which of the following servers most belongs there?
    Show answer

    Answer: D. Screened subnets typically hold an organization's publicly facing resources, separating them from the internal network.

    Topic 3.3 Protecting Networks: Segmentation

  58. An adversary steals a receptionist's password through a phishing email, logs in to her laptop, disables the anti-malware software and installs new programs. Every employee at the office is in the Administrators group.
    58 Which of the following best explains why the adversary could change system settings on the laptop?
    Show answer

    Answer: B. If regular users are given administrative privileges and an adversary compromises one of those accounts, the adversary has elevated privileges on the system.

    Topic 5.1 Application and Data Vulnerabilities and Attacks

  59. 59 An adversary reads a target's public profile and finds their dog's name and birth year. How are these most likely used?
    Show answer

    Answer: C. Adversaries build dictionaries of possible passwords from personal information and submit them with an automated tool.

    Topic 1.2 Suspicious Website Logins

  60. 60 Ransomware encrypts a city's permit database so no staff can open it. Which of the following security goals does this most directly compromise?
    Show answer

    Answer: D. Availability risks occur when data can be destroyed or encrypted to prevent others from accessing them.

    Topic 5.1 Application and Data Vulnerabilities and Attacks

Was this page helpful?

No names are ever shown, and every public comment is checked by us first. Please do not include personal details. To get a reply, email [email protected].

Course map
↑ Top

Enlarged view of the selected figure