LockInCS

AP® Cybersecurity · Unit 1 review

Unit 1 review: Introduction to Security

Recall the lists, answer 14 exam-style questions (aim for 19 minutes, about 80 seconds each), then try a free-response question and mark it with the scoring guide.

Abbreviations on this page. AI: artificial intelligence. MFA: multifactor authentication. OTP: one-time password. LLM: large language model. HTTPS and HTTP: Hypertext Transfer Protocol Secure and its unencrypted version. IP: internet protocol. SSID: service set identifier (a Wi-Fi network name). WPA2: Wi-Fi Protected Access 2.

Unit 1 by the numbers

Say each list out loud, then tap to check.

3 actions Say them, then tap
  • reveal sensitive information (elicitation)
  • download a malicious file
  • click a malicious link
Review 1.1 →
2 tactics Say them, then tap
Review 1.1 →
3 impacts Say them, then tap
personal details
  • impersonation
one-time password or login code
  • log in as the victim
click or download
  • malware
  • browser data theft
  • captured credentials
Review 1.1 →
3 guesses, 3 signs Say them, then tap
  • common passwords
  • common patterns
  • stolen passwords
  • many failed attempts in a short time
  • unusual times
  • unknown devices
Review 1.2 →
3 weak patterns Say them, then tap
  • words + two-digit number + special character
  • family or pet names
  • significant dates
Review 1.2 →
3 stronger habits Say them, then tap
  • long
  • random
  • unique (password manager or passphrase)
  • no personal names
  • dates or numbers
Review 1.2 →
2 skill levels, 6 motivations Say them, then tap
  • low-skilled
  • high-skilled
  • greed
  • recognition
  • a cause
  • revenge
  • politics
  • beliefs
Review 1.3 →
3 wireless attacks Say them, then tap
Review 1.3 →
3 Wi-Fi protections Say them, then tap
  • match the network name exactly
  • weigh data sensitivity on unencrypted Wi-Fi
  • consider a VPN
Review 1.3 →
6 AI attacks Say them, then tap
  • voice and video cloning
  • AI-written phishing
  • extracting data from LLMs
  • poisoning training data
  • AI reconnaissance
  • AI-assisted coding
Review 1.4 →
4 AI protections Say them, then tap
  • shared secret
  • MFA
  • no sensitive data in AI tools
  • verify AI output with non-AI sources
Review 1.4 →
3 AI defenses, 3 reviewers Say them, then tap
  • security technician
  • programmer
  • detection engineer
Review 1.5 →

Do these first: official sample questions 8 and 10

Open the AP® Cybersecurity Course and Exam Description (College Board, effective Fall 2026), go to the Exam Information section, and answer Questions 8 and 10 (pages 153 to 154 in the Fall 2026 edition). Both refer to the same phishing email. Question 9 tests Unit 2, so skip it for now. Check your answers with the answer key at the end of the Exam Information section.

AP® Cybersecurity course page on AP Central (the Course and Exam Description PDF is linked there). The questions are © College Board and are not reproduced here.

Checkpoint · 14 questions

Unit 1 practice: 14 exam-style questions

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. 1 Which line in a message is the clearest indicator of a social engineering attempt? 1.1.A
    Show answer

    Answer: B. It pushes the reader to click a link and sign in under a deadline; the others ask for no action.

  2. 2 A text message says: "Your exam results will be withheld unless you confirm your student login today." Which statement best explains how the phrase "will be withheld" pressures the student? 1.1.B
    Show answer

    Answer: B. A threat of losing something is intimidation; fear makes people act.

  3. 3 A student receives a text from "Account Security" and replies with the 6-digit code that was just sent to their phone. What is the most likely impact? 1.1.C
    Show answer

    Answer: A. A one-time login code lets the adversary log in as the victim.

  4. A teacher normally logs in from Laptop-ED during the school day. Her account log shows the following.
    Account log
    RowDay and timeDeviceResult
    1Mon 07:58Laptop-EDSuccess
    2Tue 03:14:02Unknown deviceFailed
    3Tue 03:14:03Unknown deviceFailed
    4Tue 03:14:05Unknown deviceFailed
    5Tue 08:05Laptop-EDSuccess
    4 Which best describes the evidence of an online password attack? 1.2.A
    Show answer

    Answer: A. Many failed attempts in seconds, at an unusual time, from an unknown device.

  5. 5 Which password most closely follows the pattern adversaries add to a custom password dictionary? 1.2.B
    Show answer

    Answer: C. Name + year + symbol at the end is the common pattern.

  6. 6 A teacher uses one long, complex password for every account. One website is breached and the password is leaked. Which change would best protect the teacher's other accounts in the future? 1.2.C
    Show answer

    Answer: D. Long, random, unique passwords plus MFA. Reuse lets one leak unlock everything.

  7. A sign in a cafe says "Free Wi-Fi: Lale-Cafe-Guest". A student's phone lists two networks: Lale-Cafe-Guest and Lale_Cafe_Guest. The student joins Lale_Cafe_Guest, checks their school email (which uses HTTPS), and logs in to a hobby forum that uses HTTP. That evening the forum account is taken over, but the email account is not.
    7 Which attack most likely occurred? 1.3.B
    Show answer

    Answer: C. A look-alike network name used to capture traffic is an evil twin.

  8. A sign in a cafe says "Free Wi-Fi: Lale-Cafe-Guest". A student's phone lists two networks: Lale-Cafe-Guest and Lale_Cafe_Guest. The student joins Lale_Cafe_Guest, checks their school email (which uses HTTPS), and logs in to a hobby forum that uses HTTP. That evening the forum account is taken over, but the email account is not.
    8 Which of the following best explains why the forum account was compromised but the email account was not? 1.3.B
    Show answer

    Answer: A. An evil twin cannot read HTTPS traffic; HTTP is exposed.

  9. A sign in a cafe says "Free Wi-Fi: Lale-Cafe-Guest". A student's phone lists two networks: Lale-Cafe-Guest and Lale_Cafe_Guest. The student joins Lale_Cafe_Guest, checks their school email (which uses HTTPS), and logs in to a hobby forum that uses HTTP. That evening the forum account is taken over, but the email account is not.
    9 Which action would most likely have prevented this attack? 1.3.C
    Show answer

    Answer: B. Verify the network name exactly matches the one you intend to join.

  10. 10 An adversary discovers an undocumented flaw in a popular router and writes a new tool to exploit it. Which best describes this adversary? 1.3.A
    Show answer

    Answer: D. Building new tools for undocumented flaws is high-skilled zero-day work.

  11. 11 An adversary publishes hundreds of web pages with false claims about a company, hoping AI chatbots will repeat them. Which AI-augmented attack is this? 1.4.A
    Show answer

    Answer: B. Publishing false information so LLMs repeat it is training data poisoning.

  12. 12 Elif's grandmother gets a phone call in what sounds exactly like Elif's voice, urgently asking for money. Which action would best protect the grandmother against this AI-augmented attack? 1.4.B
    Show answer

    Answer: C. A shared secret verifies identity; a cloned voice, public details and grammar cannot.

  13. 13 A school's network team uses an AI tool that reviews its firewall rules and recommends more secure ones. Which practice best follows recommended use of the tool? 1.5.A
    Show answer

    Answer: D. AI recommendations are always reviewed by a knowledgeable person first; C leaks sensitive data.

  14. 14 A school's security team starts using an AI tool to review network events. Which best explains how this improves threat detection? 1.5.B
    Show answer

    Answer: C. AI handles the scale humans can't and speeds up alerts and response.

Free-response practice

Not on the AP® exam for this unit: College Board tests Unit 1 in multiple choice only. This question copies the AP® free-response style so you practice citing evidence from sources, a skill you need for the free-response question later in the course. Suggested time: 15 minutes. 7 points.

All sources concern one student, Mert.

Source 1: Text message Mert received

SchoolPortal Alert: Unusual sign-in detected. Your account will be LOCKED in 30 minutes. Reply with your password and the 6-digit code we just sent to keep access. 120 students have already verified.

Source 2: School portal login log for user mert.k (Mert logs in from his laptop at home, IP 88.230.14.7)

RowDay and timeIP addressDeviceResult
1Mon 16:4088.230.14.7Laptop-MertSuccess
2Tue 02:11:0445.137.20.9UnknownFailed
3Tue 02:11:0645.137.20.9UnknownFailed
4Tue 02:11:0945.137.20.9UnknownFailed
5Tue 02:11:1345.137.20.9UnknownSuccess
6Tue 17:0588.230.14.7Laptop-MertSuccess

Source 3: Wi-Fi networks Mert’s phone shows at a cafe (the cafe’s sign says KahveDuragi-Guest)

Network name (SSID)Security
KahveDuragi-GuestPassword protected (WPA2)
KahveDuragi_GuestOpen, no password
FreeCityWiFiOpen, no password

Questions

  1. A1. Identify one social engineering tactic used in Source 1. Quote the words that show it.
  2. A2. Describe the most likely impact if Mert replies with the information requested.
  3. B1. Describe the evidence in Source 2 that indicates an online password attack. Include specific rows.
  4. B2. Identify the IP address of the adversary.
  5. B3. Explain one way Mert’s school could strengthen authentication so that the login in row 5 would not succeed.
  6. C1. Determine which network in Source 3 is most likely an evil twin. Explain your reasoning using evidence from the source.
Check with the scoring guide (7 points)
PartEarns the pointDoes not earn the point
A1 (1)Names a tactic and quotes it: urgency, "LOCKED in 30 minutes"; or intimidation, "Your account will be LOCKED".Names a tactic with no quote.
A2 (1)The adversary could use the password and one-time code to log in as Mert and take over his account."Something bad will happen"; malware (nothing is downloaded).
B1 (1)Cites rows 2 to 4 (or 2 to 5) and at least two signs: three failed logins within 5 seconds (02:11:04 to 02:11:09), an unusual time, an unknown device and IP, then a success in row 5."The log looks suspicious" with no rows or times.
B2 (1)45.137.20.988.230.14.7 (Mert’s own IP).
B3 (1)Either: enable MFA, so even with the correct password the adversary would also need a code from Mert’s device and row 5 would fail; or use a long, random, unique password (for example from a password manager), so the guesses in rows 2 to 5 would not succeed."Use a better password" with no explanation.
C1 (2)1 point: KahveDuragi_Guest. 1 point: evidence from the source; either is enough: its name is almost identical to the sign but uses an underscore, or it is open while the real network uses a password.Choosing FreeCityWiFi; no evidence from the source.
↑ Top

Enlarged view of the selected figure