LockInCS

AP® Cybersecurity · Unit 3 review

Unit 3 review: Securing Networks

Recall the lists, answer 12 exam-style questions (aim for 16 minutes, about 80 seconds each), then try a free-response question and mark it with the scoring guide.

Abbreviations on this page. ARP: address resolution protocol. MAC: media access control. IP: internet protocol. ICMP: internet control message protocol. DNS: domain name system. WEP, WPA2 and WPA3: wireless encryption protocols. AI: artificial intelligence. HTTPS: Hypertext Transfer Protocol Secure. SSH: secure shell. SSID: service set identifier. SMB: server message block (file sharing). VLAN: virtual local area network.

Unit 3 by the numbers

Say each list out loud, then tap to check.

4 attacks Say them, then tap
Review 3.1 →
3 principles at risk Say them, then tap
Review 3.1 →
3 risk levels Say them, then tap
high
  • easy and serious
moderate
  • reveals information about systems
low
  • hard to exploit
  • little impact
Review 3.1 →
4 policies Say them, then tap
Review 3.2 →
3 router rules Say them, then tap
  • no local accounts
  • disable unnecessary services such as Telnet
  • require a firewall
Review 3.2 →
3 switch rules Say them, then tap
Review 3.2 →
3 VPN rules Say them, then tap
  • allowed roles
  • authentication requirements
  • no split tunneling
Review 3.2 →
3 wireless rules Say them, then tap
  • EAP to an approved server
  • AES with a minimum key length
  • beacon frames disabled
Review 3.2 →
4 wireless settings Say them, then tap
  • disable beacons
  • limit direction and strength
  • WPA3
  • MAC filtering plus authentication
Review 3.2 →
3 techniques Say them, then tap
Review 3.3 →
2 benefits Say them, then tap
  • contain attacks to one segment
  • different security levels per segment
Review 3.3 →
3 firewall types Say them, then tap
  • stateless (headers)
  • stateful (connection state)
  • next-generation (plus intrusion prevention, deep packet inspection, application filtering)
Review 3.4 →
3 parts of an ACL rule Say them, then tap
  • direction
  • criterion
  • action
Review 3.4 →
2 placement rules Say them, then tap
  • a firewall on every segment
  • a firewall at every internet ingress and egress point
Review 3.4 →
3 tools Say them, then tap
Review 3.5 →
3 methods Say them, then tap
  • signature-based
  • anomaly-based
  • hybrid
Review 3.5 →
4 criteria for choosing Say them, then tap
  • traffic volume
  • traffic consistency
  • sensitivity or criticality
  • likelihood of novel attacks
Review 3.5 →
4 factors for evaluating Say them, then tap
  • speed
  • cost
  • false positive rate
  • false negative rate
Review 3.5 →
6 attacks to detect Say them, then tap
Review 3.5 →
2 impacts of false positives Say them, then tap
Review 3.5 →
4 network IoCs Say them, then tap
  • known malicious IP addresses
  • unauthorized scans
  • unusual spikes or slowdowns
  • mismatched port and application
Review 3.5 →

Do these first: official sample questions 1, 4, 13, 14 and 22

Open the AP® Cybersecurity Course and Exam Description (College Board, effective Fall 2026) and go to the Exam Information section. Question 1 is on page 149, Question 4 on page 151, Questions 13 and 14 on page 155, and Question 22 on page 158. Check your answers with the answer key at the end of the Exam Information section.

AP® Cybersecurity course page on AP Central (the Course and Exam Description PDF is linked there). The questions are © College Board and are not reproduced here.

Checkpoint · 12 questions

Unit 3 practice: 12 exam-style questions

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. A school network administrator reviews this monitoring summary. The default gateway is 10.8.0.1 with MAC address aa:bb:cc:00:00:01; a teacher laptop is 10.8.0.25.
    Network monitoring · 14:00 to 14:05
    TimeSourceDestinationProtocolDetail
    14:00:1210.8.0.4410.8.0.1ARP10.8.0.25 is at aa:bb:cc:00:00:44
    14:00:1310.8.0.4410.8.0.25ARP10.8.0.1 is at aa:bb:cc:00:00:44
    14:02:3010.8.0.7710.8.0.255ICMPecho request x 3,900 per second
    14:04:10switch port Fa0/9(many)Ethernet6,500 new MAC addresses in 20 s
    1 Which attack do the first two entries most likely show? 3.1.A
    Show answer

    Answer: A. Falsified ARP replies link the gateway's and the laptop's IP addresses to one other MAC address (the adversary's), putting the adversary on the path between them.

  2. A school network administrator reviews this monitoring summary. The default gateway is 10.8.0.1 with MAC address aa:bb:cc:00:00:01; a teacher laptop is 10.8.0.25.
    Network monitoring · 14:00 to 14:05
    TimeSourceDestinationProtocolDetail
    14:00:1210.8.0.4410.8.0.1ARP10.8.0.25 is at aa:bb:cc:00:00:44
    14:00:1310.8.0.4410.8.0.25ARP10.8.0.1 is at aa:bb:cc:00:00:44
    14:02:3010.8.0.7710.8.0.255ICMPecho request x 3,900 per second
    14:04:10switch port Fa0/9(many)Ethernet6,500 new MAC addresses in 20 s
    2 Which attack does the entry at 14:02:30 most likely show? 3.5.E
    Show answer

    Answer: D. A sudden flood of ICMP requests sent to the broadcast address indicates a smurf attack.

  3. A school network administrator reviews this monitoring summary. The default gateway is 10.8.0.1 with MAC address aa:bb:cc:00:00:01; a teacher laptop is 10.8.0.25.
    Network monitoring · 14:00 to 14:05
    TimeSourceDestinationProtocolDetail
    14:00:1210.8.0.4410.8.0.1ARP10.8.0.25 is at aa:bb:cc:00:00:44
    14:00:1310.8.0.4410.8.0.25ARP10.8.0.1 is at aa:bb:cc:00:00:44
    14:02:3010.8.0.7710.8.0.255ICMPecho request x 3,900 per second
    14:04:10switch port Fa0/9(many)Ethernet6,500 new MAC addresses in 20 s
    3 Which control would most directly prevent the activity at 14:04:10? 3.3.B
    Show answer

    Answer: B. Port security limits the number of MAC addresses on a switch port, which prevents MAC flooding.

  4. An analyst reviews a design firm's network and lists four findings.
    Findings
    FindingObservation
    F1Printers display their firmware versions to internal users
    F2A public notice board screen uses the guest Wi-Fi
    F3A meeting-room data port connects to the internal network with no port security
    F4The guest network reveals the model of its access points
    4 Which finding should the analyst most likely document as a high risk? 3.1.C
    Show answer

    Answer: C. High risks let an adversary easily cause significant harm, such as connecting a device to the internal network to spoof devices or capture traffic. Revealing device details is moderate; nonsensitive displays are low.

  5. 5 Which policy would most likely include a rule against split tunneling? 3.2.A
    Show answer

    Answer: B. A VPN policy details security requirements for employees using a VPN, including a prohibition against split tunneling.

  6. At 11:20, every laptop and phone in a school's science wing loses its Wi-Fi connection at once. Devices in other wings are fine, and the access point in the science wing still reports that it is working.
    6 Which of the following checks would best confirm the cause? 3.5.E.2
    Show answer

    Answer: D. No wireless device in one area being able to connect, plus electromagnetic (EM) noise found by a scan of the wireless range, indicates a jamming attack.

  7. A company's website must be reachable from the internet, but its file server must not.
    7 Which of the following best explains why the company places its public web server in a screened subnet? 3.3.A
    Show answer

    Answer: A. A screened subnet sits between the internet and the internal network and holds public-facing resources, separating them from the internal network.

  8. A firewall protects a web server at 10.9.0.10.
    Firewall rules (inbound)
    Rule numberActionSourceDestinationPort numberProtocol
    1Deny198.51.100.0/2410.9.0.10ALLALL
    2AllowALL10.9.0.10443HTTPS
    3DenyALLALLALLALL
    8 A packet from 198.51.100.12 arrives for 10.9.0.10 on port 443. What happens? 3.4.B
    Show answer

    Answer: D. Rules are checked in order and the first match is executed. Rule 1 denies that source range before the allow rule is reached.

  9. An analyst reviews a packet capture summary from an office network.
    Packet capture summary
    LineSourceDestinationPortProtocol seen
    P110.2.0.1510.2.0.553DNS
    P210.2.0.21198.51.100.80443HTTPS
    P310.2.0.33203.0.113.6653HTTP web pages
    P410.2.0.1510.2.0.9445File sharing
    9 Which line is the strongest network-based indicator of compromise? 3.5.E.7
    Show answer

    Answer: C. Mismatched port and application traffic is an indicator of compromise: web (HTTP) traffic on port 53, which is meant for DNS, suggests malware hiding its traffic.

  10. A school installs a tool that watches network traffic and, when it detects an attack, automatically blocks the source IP address.
    10 Which tool did the security team install? 3.5.A
    Show answer

    Answer: C. Like an IDS, a NIPS analyzes data for malicious activity, but it can also halt an attack by closing ports, blocking addresses or rejecting protocols.

  11. A school's weekly wireless scan lists these networks near the main building.
    Wireless scan
    SSIDSecuritySignal location
    NorthHS-StaffWPA3Inside, office wing
    NorthHS-GuestWPA3Inside, library
    NorthHS_StaffOpenParking lot, east side
    CornerCafeWPA2Across the street
    11 Which of the following is the best next step? 3.5.E.1
    Show answer

    Answer: A. An SSID similar to a legitimate local one, with different security, is the sign of an evil twin. Defenders use signal triangulation to locate the access point and disable it.

  12. Visits to a city library's online catalog fall by 80% overnight. There was no outage, no holiday and no change to the site, and users who do arrive report nothing unusual.
    12 Which of the following should the library examine first? 3.5.E.5
    Show answer

    Answer: B. DNS poisoning is hard to detect; an abrupt, otherwise unexplained drop in website traffic is a reason to examine the DNS records.

Free-response practice

Network security analysis practice in the style of the AP® free-response question: several sources, one system. Suggested time: 20 minutes. 8 points.

The following sources come from the network of a small architecture firm. Its file server is 10.1.0.20. Staff are on 10.1.5.0/24; guests use a separate wireless network.

Source 1: Firewall rules in front of the file server (checked in order)

Rule numberActionSourceDestinationDirectionPort numberProtocol
1AllowALL10.1.0.20Inbound22SSH
2Allow10.1.5.0/2410.1.0.20Inbound445SMB
3Deny10.1.9.0/2410.1.0.20Inbound22SSH
4DenyALLALLInboundALLALL

Source 2: Wireless access point settings

NetworkSSIDEncryptionBeacon broadcastSubnet
StaffStudio-StaffWPA2On10.1.5.0/24
GuestStudio-GuestNone (open)On10.1.9.0/24

Source 3: Traffic log

TimeSourceDestinationPortResult
19:02:1110.1.9.1410.1.0.2022ALLOW rule 1
19:02:1210.1.9.1410.1.0.2022ALLOW rule 1
19:02:1310.1.9.1410.1.0.2022ALLOW rule 1
19:05:4010.1.9.1410.1.0.0/24 (all)1 to 1024980 ports probed

Questions

  1. A1. Using Sources 1 and 3, explain why the deny rule for the guest network (rule 3) did not stop the connections from 10.1.9.14.
  2. A2. Recommend one change to Source 1 that would stop guest devices reaching the file server over SSH, and explain why it works.
  3. B1. Identify the network-based indicator of compromise at 19:05:40 in Source 3.
  4. B2. Identify which network in Source 2 the device 10.1.9.14 is on, and explain one risk that network's settings create.
  5. C1. Recommend one segmentation or wireless control from Unit 3 that would reduce the risk you identified in B2, and explain how.
Check with the scoring guide (8 points)
PartEarns the pointDoes not earn the point
A1 (2)1 point: rule 1 allows SSH on port 22 from ALL sources. 1 point: rules are checked in order and the first match is executed, so the guest traffic matches rule 1 and rule 3 is never reached (Source 3 shows "ALLOW rule 1").Saying rule 3 is wrong without referring to rule order.
A2 (1)Move rule 3 above rule 1, or change rule 1's source to the staff network 10.1.5.0/24, so guest SSH no longer matches an allow rule first.Deleting rule 4 or "add more rules" with no explanation.
B1 (1)An unauthorized network scan: one device probing 980 ports across the server subnet.Calling it normal traffic or a denial of service.
B2 (2)1 point: the guest network (10.1.9.0/24, Studio-Guest). 1 point: it is open with no encryption, so anyone nearby can join or eavesdrop, and its name looks like the staff network so an evil twin or confusion is easy.Choosing the staff network.
C1 (2)1 point: a valid control, for example a firewall rule denying all guest subnet traffic to internal servers, a separate VLAN for guests, or WPA3 with authentication on the guest network. 1 point: how it reduces the risk.A control from another unit with no link to the network.

Was this page helpful?

Please do not include personal details. To get a reply, email [email protected].

Contents
↑ Top

Enlarged view of the selected figure