LockInCS

AP® Cybersecurity · Unit 2 review

Unit 2 review: Securing Spaces

Recall the lists, answer 18 exam-style questions (aim for 24 minutes, about 80 seconds each), then try a free-response question and mark it with the scoring guide.

Abbreviations on this page. IT: information technology. OSINT: open source intelligence. RAT: remote access trojan. MFA: multifactor authentication. USB: Universal Serial Bus.

Unit 2 by the numbers

Say each list out loud, then tap to check.

7 tactics Say them, then tap
Review 2.1 →
5 adversaries Say them, then tap
Review 2.1 →
6 phases Say them, then tap
Review 2.1 →
6 assets Say them, then tap
  • financial resources
  • intellectual property
  • data
  • digital infrastructure
  • physical property
  • reputation
Review 2.1 →
2 + 3 risk factors Say them, then tap
  • likelihood depends on target value
  • skill needed
  • adversary motivation and capability
Review 2.1 →
2 results, 5 document parts Say them, then tap
Review 2.1 →
4 strategies Say them, then tap
  • avoid
  • transfer
  • mitigate
  • accept
Review 2.1 →
3 + 3 + 3 controls Say them, then tap
  • physical
  • technical
  • managerial
  • preventative
  • detective
  • corrective
Review 2.1 →
6 layers Say them, then tap
  • human
  • physical
  • network
  • device
  • application
  • data
Review 2.1 →
5 physical attacks Say them, then tap
Review 2.2 →
4 compromises, 3 risk levels Say them, then tap
  • unauthorized access
  • disruption
  • theft or destruction
  • unauthorized modification
  • high
  • moderate
  • low
Review 2.2 →
2 managerial controls Say them, then tap
Review 2.3 →
6 controls for physical risks Say them, then tap
  • fences
  • gates and bollards
  • locks
  • card readers
  • vestibules and turnstiles
  • disabled USB ports
  • UPS and generators
Review 2.3 →
4 detection controls Say them, then tap
  • cameras
  • security guards (stationary or patrolling)
  • motion sensors
  • employees
Review 2.4 →

Do these first: official sample questions 9, 16 and 17

Open the AP® Cybersecurity Course and Exam Description (College Board, effective Fall 2026) and go to the Exam Information section. Question 9 (page 154) uses the phishing email printed before Question 8. Questions 16 and 17 are on page 156; Question 17 uses the bank article. Questions 18 to 20 test later units, so skip them for now. Check your answers with the answer key at the end of the Exam Information section.

AP® Cybersecurity course page on AP Central (the Course and Exam Description PDF is linked there). The questions are © College Board and are not reproduced here.

Checkpoint · 18 questions

Unit 2 practice: 18 exam-style questions

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. A school office receives a phone call: "Hi, this is Deniz from the district IT office. Your principal asked us to update every office computer before Friday's inspection. I need your login to finish yours in the next ten minutes."
    1 How does the phrase "Your principal asked us" pressure the staff member? 2.1.A
    Show answer

    Answer: B. Relaying the instructions of someone with power over the target is authority.

  2. A school office receives a phone call: "Hi, this is Deniz from the district IT office. Your principal asked us to update every office computer before Friday's inspection. I need your login to finish yours in the next ten minutes."
    2 Which phrase in the call is an example of urgency? 2.1.A
    Show answer

    Answer: D. A short deadline that forces quick action is urgency.

  3. 3 An employee who was refused a promotion uses his valid account to copy a client list and sell it to a competitor. Which type of adversary is this? 2.1.B
    Show answer

    Answer: C. He uses his own legitimate credentials and access, for revenge or greed.

  4. 4 An adversary studies a company's website and staff social media profiles to collect names and email addresses before an attack. Which phase of a cyberattack is this? 2.1.C
    Show answer

    Answer: A. Collecting freely available information (OSINT) is reconnaissance.

  5. 5 After a phishing email gives an adversary access to one laptop, the adversary installs a remote access trojan so they can return even if the password is changed. Which phase is this? 2.1.C
    Show answer

    Answer: B. A RAT keeps access without breaking in again: persistence.

  6. 6 A risk assessment rates the risk of a lost school laptop as "likely, high impact." How is this result best classified? 2.1.D
    Show answer

    Answer: C. Labels such as "likely, high impact" are qualitative; numbers are quantitative.

  7. 7 Which change would most likely increase the likelihood that adversaries exploit a vulnerability in a school's web server? 2.1.D
    Show answer

    Answer: D. Well-documented exploits need less skill, so more adversaries can use them. C lowers the target's value.

  8. 8 A company installs badge readers and cameras. Leadership reviews the risk that remains and formally agrees to live with it. Which risk management strategy describes leadership's final decision? 2.1.E
    Show answer

    Answer: D. Agreeing to live with the residual risk is acceptance. The cameras were mitigation.

  9. 9 How is a security camera in a hallway best classified? 2.1.F
    Show answer

    Answer: A. A camera is a physical control whose function is to detect.

  10. 10 Which statement best explains why an organization uses a defense-in-depth strategy? 2.1.G
    Show answer

    Answer: B. Layers mean one bypassed control does not expose everything.

  11. 11 A school is documenting physical risks. Which finding is best classified as a high risk? 2.2.C
    Show answer

    Answer: C. Sensitive data with no controlled access is high. B is moderate; A and D are low.

  12. 12 During a visit, an adversary plugs a small device between the keyboard and an unattended computer in the lobby. What is the adversary most likely trying to do? 2.2.B
    Show answer

    Answer: A. A keylogger on a port collects what users type.

  13. 13 A man carrying two large boxes asks an employee to hold the server room door for him. She does, without checking his badge. Which attack is this? 2.2.A
    Show answer

    Answer: B. The employee knowingly let him in: piggybacking.

  14. 14 Which control would best prevent the attack in the previous question at the server room door? 2.3.B
    Show answer

    Answer: D. A vestibule stops one person admitting another. A camera only records it.

  15. 15 Which rule would most likely appear in a workstation security policy? 2.3.A
    Show answer

    Answer: B. Locking unattended devices is a workstation policy rule. A is a physical control, C is technical, and D is a guard duty, not a workstation rule.

  16. 16 Why should the feed from a security camera be both recorded and monitored? 2.4.A
    Show answer

    Answer: D. Monitoring allows a response in progress; recordings support the investigation.

  17. 17 A company can install one motion sensor. Where will it be most effective? 2.4.B
    Show answer

    Answer: C. Motion sensors belong where no traffic is expected; busy areas cause false alarms.

  18. 18 At 02:10 a motion sensor in the server room raises an alert. No one is scheduled to work. Which action best uses detection controls to verify a breach? 2.4.C
    Show answer

    Answer: A. Motion sensors work best paired with cameras, which verify the breach.

Free-response practice

Not on the AP® exam for this unit: College Board tests Unit 2 in multiple choice only. This question copies the AP® free-response style so you practice citing evidence from sources, a skill you need for the free-response question later in the course. Suggested time: 15 minutes. 7 points.

You are on the physical security team for Lumen Design Studio, a small company that keeps client project files on its own server.

Source 1: Findings from a walk-through of the building

FindingObservation
F1The server room has a keypad lock, but on hot days staff prop the door open with a chair. The hallway outside has no camera.
F2The reception computer is connected to the office network. Its USB ports are exposed, and the receptionist often leaves the desk.
F3A locked cupboard in the break room holds spare printer paper.
F4At the back door, staff often hold the door open for delivery workers carrying boxes.

Source 2: Card reader log for the server room door (normal: open 4 to 5 seconds, 08:00 to 18:00)

RowTimeBadgeResultDoor open (s)
108:04B-12Granted4
210:31B-07Granted5
313:18B-12Granted26
415:52B-30Denied0
516:40B-07Granted4

Questions

  1. A1. Identify which finding in Source 1 is a high risk. Explain why, using evidence from the source.
  2. A2. Explain why finding F2 is a moderate risk rather than a high risk.
  3. B1. Identify the physical attack that finding F4 makes possible.
  4. B2. Recommend one control that would prevent this attack, and identify its type and function.
  5. C1. Identify the row in Source 2 that indicates possible piggybacking or tailgating. Explain your reasoning.
  6. C2. Explain why pairing a camera with the server room door would help the investigation of the event you identified.
Check with the scoring guide (7 points)
PartEarns the pointDoes not earn the point
A1 (1)F1: the server holds sensitive client files and the propped door means access is not restricted or controlled; no camera in the hallway.Choosing F1 with no evidence.
A2 (1)The reception computer is noncritical and holds no sensitive data, but it is connected to the network, so a malware drive or keylogger in a USB port could be a foothold to other resources."It could be stolen" with no link to other resources.
B1 (1)Piggybacking: staff knowingly let in people carrying boxes.Tailgating (the staff member knows).
B2 (2)1 point: a control that prevents it, for example an access control vestibule or turnstile at the back door, or security awareness training not to admit others. 1 point: correct type and function for that control, for example vestibule: physical, preventative; training: managerial, preventative.A camera (detects, does not prevent); type or function wrong.
C1 (1)Row 3: the door stayed open 26 seconds, far longer than the normal 4 to 5 seconds.Row 4 (a denied badge is the system working).
C2 (1)Footage would show who entered with badge B-12 at 13:18, so investigators can verify the breach and track the adversary’s path."Cameras are good security" with no link to the event.
↑ Top

Enlarged view of the selected figure