LockInCS

AP® Cybersecurity · Unit 4 review

Unit 4 review: Securing Devices

Recall the lists, answer 12 exam-style questions (aim for 16 minutes, about 80 seconds each), then try a free-response question and mark it with the scoring guide.

Abbreviations on this page. AI: artificial intelligence. MFA: multifactor authentication. PIN: personal identification number. SHA: Secure Hash Algorithm. IP: internet protocol. IoT: Internet of Things. BIOS and UEFI: basic input output system and unified extensible firmware interface. RDP: remote desktop protocol. SMB: server message block (file sharing). HTTPS: Hypertext Transfer Protocol Secure.

Unit 4 by the numbers

Say each list out loud, then tap to check.

4 device types Say them, then tap
Review 4.1 →
8 malware types + 1 Say them, then tap
  • plus fileless malware
Review 4.1 →
7 device weaknesses Say them, then tap
  • unpatched software
  • weak authentication
  • no BIOS or UEFI password
  • autorun
  • open ports
  • no or misconfigured firewall
  • no anti-malware
Review 4.1 →
3 risk levels Say them, then tap
high
  • sensitive data or critical operations
moderate
  • weak authentication or less likely exploits
low
  • little impact if exploited
Review 4.1 →
4 hash properties Say them, then tap
  • collision resistant
  • pre-image resistant
  • repeatable
  • fixed length
Review 4.2 →
2 kinds of password attack Say them, then tap
online
offline
Review 4.2 →
4 authentication factors Say them, then tap
  • knowledge
  • possession
  • biometric
  • location
Review 4.2 →
5 login settings Say them, then tap
Review 4.2 →
3 device policies Say them, then tap
Review 4.3 →
4 things anti-malware does (as listed here) Say them, then tap
  • keep a signature database
  • scan files
  • match a signature
  • quarantine and remove
Review 4.3 →
4 host firewall facts Say them, then tap
  • controls one device
  • rules in order (first match)
  • can block outbound traffic
  • block ports or services not needed
Review 4.3 →
3 IoC families Say them, then tap
  • host-based (logs and settings)
  • file-based (files)
  • behavior-based (logs)
Review 4.4 →
3 criteria to choose Say them, then tap
  • performance
  • cost
  • sensitivity or criticality
Review 4.4 →
3 factors to evaluate Say them, then tap
  • speed and performance
  • phase of the attack
  • false positives versus ease of bypass
Review 4.4 →
4 password attack signs Say them, then tap
  • one user
  • many wrong passwords
  • unusual time
  • place or IP
  • many users within seconds from one IP (spraying)
  • default user:password pairs in quick succession (stuffing)
Review 4.4 →

Do these first: official sample questions 5, 6, 7, 12, 15 and 21

Open the AP® Cybersecurity Course and Exam Description (College Board, effective Fall 2026) and go to the Exam Information section. Question 5 is on page 151, Questions 6 and 7 on page 152, Questions 12 and 15 on page 155, and Question 21 on page 157. The sample free-response question that follows (Device Security Analysis) also draws on Unit 4. Check your answers with the answer key at the end of the Exam Information section.

AP® Cybersecurity course page on AP Central (the Course and Exam Description PDF is linked there). The questions are © College Board and are not reproduced here.

Checkpoint · 12 questions

Unit 4 practice: 12 exam-style questions

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. A delivery driver uses a battery-powered tablet to scan parcels and capture signatures.
    1 Which of the following best classifies the device? 4.1.A
    Show answer

    Answer: A. Handheld computers are smaller than personal computers and run on battery power, such as tablets, smartphones and smart watches.

  2. After installing a free screen-recording app, a student notices that the websites they visit are being sent to an unknown server every few minutes.
    2 Which type of malware is most likely responsible? 4.1.B
    Show answer

    Answer: B. Spyware tracks a user's actions and sends the information back to an adversary.

  3. A network scan shows that a lab computer accepts connections from any address on several ports it does not use. An adversary later connects directly to it from another network.
    3 Which of the following vulnerabilities did the adversary most likely exploit? 4.1.C
    Show answer

    Answer: C. Adversaries can leverage open ports to connect to a device. The scan shows exactly that: connections accepted from any address on unused ports.

  4. An analyst is documenting device risks at a clinic.
    4 Which finding would the analyst most likely document as a moderate risk? (A PIN is a personal identification number.) 4.1.D
    Show answer

    Answer: D. Moderate risks come from weak authentication requirements or vulnerabilities less likely to be exploited. The database and billing server expose sensitive data (high); the lobby display has little impact (low).

  5. A student hashes the same file on Monday and again on Friday. Both times, the SHA-256 output is identical.
    5 Which property of cryptographic hash functions does this show? 4.2.A
    Show answer

    Answer: D. Hashes are repeatable: the same input always produces the same hash.

  6. A shopping site's user database is stolen and posted online. A student used the same email and password there as on their school account.
    6 Which of the following best explains why reusing one password everywhere is risky in this situation? 4.2.B
    Show answer

    Answer: A. When a user database is stolen, credentials are sold or posted, and adversaries begin by trying stolen or leaked credentials on a target's other accounts.

  7. A bank app asks for a 6-digit PIN and then a fingerprint scan before it opens.
    7 Which authentication factors does the bank use? 4.2.C
    Show answer

    Answer: B. A PIN is something the user knows (knowledge); a fingerprint is something the user is (biometric).

  8. 8 Which setting would best prevent users from switching back to a password they used recently? 4.2.D
    Show answer

    Answer: C. Storing a number of previous password hashes prevents users from reusing a password.

  9. A science lab's workstation LAB-WS-03 is used only during school hours, from the lab network 10.40.0.0/16. The analyst exports its authentication log.
    auth.log · LAB-WS-03
    TimeUserSource IPResult
    01:12:40admin203.0.113.77failed (admin/admin)
    01:12:41admin203.0.113.77failed (admin/1234)
    01:12:42admin203.0.113.77failed (admin/changeme)
    01:12:43root203.0.113.77failed (root/root)
    01:12:44admin203.0.113.77failed (admin/default)
    01:12:45admin203.0.113.77failed (admin/password)
    01:12:46admin203.0.113.77failed (admin/letmein)
    02:44:03l.meyer198.51.100.21failed
    02:44:04r.okafor198.51.100.21failed
    02:44:05k.larsen198.51.100.21failed
    08:05:11t.nguyen10.40.2.30success
    9 Which attack is shown in the entries from 01:12:40 to 01:12:46? 4.4.D
    Show answer

    Answer: C. Default user:password pairs attempted in quick succession from one IP address indicate credential stuffing.

  10. A science lab's workstation LAB-WS-03 is used only during school hours, from the lab network 10.40.0.0/16. The analyst exports its authentication log.
    auth.log · LAB-WS-03
    TimeUserSource IPResult
    01:12:40admin203.0.113.77failed (admin/admin)
    01:12:41admin203.0.113.77failed (admin/1234)
    01:12:42admin203.0.113.77failed (admin/changeme)
    01:12:43root203.0.113.77failed (root/root)
    01:12:44admin203.0.113.77failed (admin/default)
    01:12:45admin203.0.113.77failed (admin/password)
    01:12:46admin203.0.113.77failed (admin/letmein)
    02:44:03l.meyer198.51.100.21failed
    02:44:04r.okafor198.51.100.21failed
    02:44:05k.larsen198.51.100.21failed
    08:05:11t.nguyen10.40.2.30success
    10 Which attack is shown in the entries from 02:44:03 to 02:44:05? 4.4.D
    Show answer

    Answer: D. Many different users trying to log in within seconds of each other from one unusual IP address indicates password spraying.

  11. A science lab's workstation LAB-WS-03 is used only during school hours, from the lab network 10.40.0.0/16. The analyst exports its authentication log.
    auth.log · LAB-WS-03
    TimeUserSource IPResult
    01:12:40admin203.0.113.77failed (admin/admin)
    01:12:41admin203.0.113.77failed (admin/1234)
    01:12:42admin203.0.113.77failed (admin/changeme)
    01:12:43root203.0.113.77failed (root/root)
    01:12:44admin203.0.113.77failed (admin/default)
    01:12:45admin203.0.113.77failed (admin/password)
    01:12:46admin203.0.113.77failed (admin/letmein)
    02:44:03l.meyer198.51.100.21failed
    02:44:04r.okafor198.51.100.21failed
    02:44:05k.larsen198.51.100.21failed
    08:05:11t.nguyen10.40.2.30success
    11 Which login setting would most directly limit the 01:12 attempts on the admin account? 4.2.D
    Show answer

    Answer: A. The admin account fails six times in seven seconds. Locking an account after a few invalid attempts stops an adversary from continuously trying passwords against it.

  12. A hospital wants detection on the server that controls its medicine-dispensing cabinets. The server has plenty of processing power, and staff warn that adversaries may try attacks never seen before.
    12 Which detection approach is most appropriate for this server? 4.4.B
    Show answer

    Answer: B. Critical devices with enough processing power justify hybrid detection, which combines signature-based and anomaly-based methods despite the higher cost and extra alerts.

Free-response practice

Device Security Analysis practice. On the AP® exam, the single free-response question gives several sources about one device. This original question uses Unit 4 skills. Suggested time: 20 minutes. 8 points.

The following sources all come from one workstation, ENG-WS-07, at an engineering firm. Its IP address is 10.30.2.14. Staff use it 07:00 to 18:00 from the office network 10.30.0.0/16.

Source 1: Host-based firewall settings (checked in order, first match wins)

Rule numberActionSourceDestinationDirectionPort numberProtocol
1Allow10.30.0.0/1610.30.2.14Inbound445SMB
2AllowALL10.30.2.14Inbound3389RDP
3Allow10.30.2.14ALLOutbound443HTTPS
4DenyALL10.30.2.14InboundALLALL

Source 2: Authentication log

TimeUserSource IPLogin typeResult
01:12:40admin203.0.113.9RDPfailed (admin/admin)
01:12:41admin203.0.113.9RDPfailed (admin/password)
01:12:42service203.0.113.9RDPfailed (service/service)
01:12:43service203.0.113.9RDPfailed (service/123456)
01:12:44service203.0.113.9RDPfailed (service/password)
01:12:45service203.0.113.9RDPfailed (service/changeme)
01:12:46service203.0.113.9RDPfailed (service/Service)
01:12:47service203.0.113.9RDPfailed (service/service1)
01:13:05service203.0.113.9RDPsuccess (service/Service1)
01:20:30service203.0.113.9RDPadded user "svc2" to Administrators
08:05:11t.nguyen10.30.2.14localsuccess

Source 3: Local security policy

SettingValue
Password complexityDisabled
Minimum password length8 characters
Password history0 remembered
Account lockout threshold0 (never lock)

Questions

  1. A1. Identify the firewall rule in Source 1 that allowed the connections in Source 2 from 203.0.113.9. Explain using evidence.
  2. A2. Describe one change to Source 1 that would block those connections while still letting office staff work as normal.
  3. B1. Identify the type of password attack in Source 2 from 01:12:40 to 01:13:05. Cite the evidence.
  4. B2. Identify the indicator of compromise at 01:20:30 and explain why it matters.
  5. C1. Identify two settings in Source 3 that made the attack in Source 2 more likely to succeed, and explain how changing each would help.
Check with the scoring guide (8 points)
PartEarns the pointDoes not earn the point
A1 (1)Rule 2: it allows inbound RDP on port 3389 from ALL sources, so 203.0.113.9 (outside the office network) is allowed; rule 4 is never reached for that traffic.Rule 4, or a rule named with no evidence.
A2 (1)Change rule 2's source from ALL to the office network 10.30.0.0/16 (or delete rule 2 so the default deny applies, if remote desktop is not needed).Moving rule 4 to the top (blocks staff too), or "add a firewall".
B1 (2)1 point: credential stuffing. 1 point: evidence: default user:password pairs (admin/admin, admin/password, service/service) tried within seconds from one IP address.Password spraying (the passwords are default pairs, not one common password across many users).
B2 (2)1 point: the service account adding a new user to Administrators (an attempt to elevate privileges or an unauthorized configuration change). 1 point: it shows the adversary is establishing persistence or more access, so the account is compromised.Calling it normal administration with no reference to the time or source IP.
C1 (2)1 point each, any two, each linked to Source 2: lockout threshold 0 let the service account fail six times in a row and keep guessing, so lock after 3 to 5 invalid attempts; complexity disabled and an 8-character minimum allowed the weak password Service1, so enable complexity and require a longer minimum length.A setting with no link to the attack in Source 2 (for example password history).

Was this page helpful?

Please do not include personal details. To get a reply, email [email protected].

Contents
↑ Top

Enlarged view of the selected figure