# LockInCS > Free, original study notes, simulations and self-marking checkpoints for AP® Cybersecurity, with AP® Computer Science A, AP® CSP and IB Computer Science coming next. Written by computer science educators with CCNA and CEH certifications. Every lesson lists the College Board CED codes it covers, explains each idea answer-first, and ends with a self-marking checkpoint whose answers are explained. Free, no accounts, no ads. ## AP® Cybersecurity - [AP® Cybersecurity course map](https://lockincs.com/ap-cybersecurity/): All five units and their topics, as listed in the College Board CED. - [Before Unit 3: Networking Basics](https://lockincs.com/ap-cybersecurity/before-unit-3/): Three short sessions covering the networking that Unit 3 relies on. ## Units - [AP® Cybersecurity Unit 1: Introduction to Security](https://lockincs.com/ap-cybersecurity/unit-1/): Topics 1.1 to 1.5, with notes, simulations and checkpoints as they go live. - [AP® Cybersecurity Unit 2: Securing Spaces](https://lockincs.com/ap-cybersecurity/unit-2/): Topics 2.1 to 2.4, with notes, simulations and checkpoints as they go live. - [AP® Cybersecurity Unit 3: Securing Networks](https://lockincs.com/ap-cybersecurity/unit-3/): Topics 3.1 to 3.5, with notes, simulations and checkpoints as they go live. - [AP® Cybersecurity Unit 4: Securing Devices](https://lockincs.com/ap-cybersecurity/unit-4/): Topics 4.1 to 4.4, with notes, simulations and checkpoints as they go live. - [AP® Cybersecurity Unit 5: Securing Applications and Data](https://lockincs.com/ap-cybersecurity/unit-5/): Topics 5.1 to 5.6, with notes, simulations and checkpoints as they go live. ## Topic pages - [3.1 Network Vulnerabilities and Attacks](https://lockincs.com/ap-cybersecurity/unit-3/3-1-network-vulnerabilities-and-attacks/): Topic 3.1 covers four common network attacks: address resolution protocol (ARP) poisoning, media access control (MAC) flooding, domain name system (DNS) poisoning and smurf attacks. It explains the network weaknesses adversaries exploit, from open data ports to weak wireless encryption, and how to rate each risk as high, moderate or low by its likelihood and impact. ## Before Unit 3: Networking Basics (lessons) - [Networks: hosts, packets and the devices that move them](https://lockincs.com/ap-cybersecurity/before-unit-3/networks/): A network is a set of devices, called hosts, connected so they can exchange data. Data crosses a network in small packets, each wrapped in a frame for one link. Switches join hosts inside a local area network (LAN), routers join networks, and firewalls control the traffic that crosses the boundary. - [Addresses: MAC, IP, ARP, DNS and ICMP](https://lockincs.com/ap-cybersecurity/before-unit-3/addresses/): Every connected device has two addresses: a media access control (MAC) address, which names its network card on one local link, and an internet protocol (IP) address, which locates it across networks. The address resolution protocol (ARP) pairs the two inside a local area network (LAN), and the domain name system (DNS) turns names into IP addresses. Neither one checks its answers, which is exactly what ARP poisoning and DNS poisoning exploit. - [Wireless basics: access points, SSIDs and beacon frames](https://lockincs.com/ap-cybersecurity/before-unit-3/wireless-basics/): A wireless access point connects devices to the wired local area network (LAN) by radio and announces the network's name, its service set identifier (SSID), in beacon frames several times a second. Radio does not stop at the walls, so anyone within range of the signal can see those beacon frames, listen to the traffic and try to connect. ## Glossary - [AP® Cybersecurity glossary](https://lockincs.com/ap-cybersecurity/glossary/): Key terms with CED codes and examples. - [Address resolution protocol (ARP)](https://lockincs.com/ap-cybersecurity/glossary/arp/): The protocol that finds the media access control (MAC) address belonging to an internet protocol (IP) address on the same local area network (LAN), and stores the pair in an ARP table. - [ARP poisoning](https://lockincs.com/ap-cybersecurity/glossary/arp-poisoning/): Sending falsified address resolution protocol (ARP) packets so a device's ARP table pairs the target's internet protocol (IP) address with the adversary's media access control (MAC) address. - [Beacon frame](https://lockincs.com/ap-cybersecurity/glossary/beacon-frame/): A frame a wireless access point broadcasts several times a second to announce its service set identifier (SSID) and wireless encryption protocols. - [Broadcast address](https://lockincs.com/ap-cybersecurity/glossary/broadcast-address/): The highest address of a network, such as 192.168.1.255; a packet sent to it is delivered to every device on that network. - [Credential harvesting](https://lockincs.com/ap-cybersecurity/glossary/credential-harvesting/): Collecting real usernames and passwords through a fake login site. - [Data in transit](https://lockincs.com/ap-cybersecurity/glossary/data-in-transit/): Data moving across a network, as opposed to data at rest, which is stored on a drive. - [Default gateway](https://lockincs.com/ap-cybersecurity/glossary/default-gateway/): The address of the router on a host's own network, to which the host sends every packet addressed to another network. - [Denial of service (DoS)](https://lockincs.com/ap-cybersecurity/glossary/denial-of-service/): An attack that makes a system or resource unavailable to authorized users. - [Distributed denial of service (DDoS)](https://lockincs.com/ap-cybersecurity/glossary/distributed-denial-of-service/): A denial of service attack in which many devices attack the same target at the same time. - [DNS poisoning](https://lockincs.com/ap-cybersecurity/glossary/dns-poisoning/): Planting a fake domain name system (DNS) record on a DNS server so users are redirected, typically to a malicious website. - [Domain name system (DNS)](https://lockincs.com/ap-cybersecurity/glossary/dns/): The system that translates domain names into internet protocol (IP) addresses, using DNS servers, authoritative name servers and DNS records. - [Eavesdropping](https://lockincs.com/ap-cybersecurity/glossary/eavesdropping/): Capturing data in transit in order to read, record or copy it. - [Evil twin](https://lockincs.com/ap-cybersecurity/glossary/evil-twin/): An adversary's access point that copies or imitates a legitimate network's service set identifier (SSID) so users join it by mistake. - [Firewall](https://lockincs.com/ap-cybersecurity/glossary/firewall/): Software that allows or denies network traffic in or out of a network using a set of rules called an access control list (ACL); it runs on its own device or inside another one, such as a router. - [Frame](https://lockincs.com/ap-cybersecurity/glossary/frame/): A unit that wraps a packet for one link, with the media access control (MAC) addresses of the two devices on that link. - [Host](https://lockincs.com/ap-cybersecurity/glossary/host/): A device that sends or receives data on a network, such as a laptop, phone, printer or server. - [Internet control message protocol (ICMP)](https://lockincs.com/ap-cybersecurity/glossary/icmp/): A protocol for short test and error messages between devices, used by ping; it has no port numbers. - [IP address](https://lockincs.com/ap-cybersecurity/glossary/ip-address/): A numerical identifier assigned to a device's connection by the network it joins, made of a network portion and a host portion. - [Jamming](https://lockincs.com/ap-cybersecurity/glossary/jamming/): Broadcasting radio noise so wireless devices cannot communicate: an attack on availability. - [Lateral movement](https://lockincs.com/ap-cybersecurity/glossary/lateral-movement/): Using access to one compromised device to compromise other devices on the same local area network (LAN). - [Local area network (LAN)](https://lockincs.com/ap-cybersecurity/glossary/local-area-network/): A network that covers one building or site and is controlled by one organization or household. - [MAC address](https://lockincs.com/ap-cybersecurity/glossary/mac-address/): A 48-bit identifier of a network interface card, written in hexadecimal and used to deliver frames on one local link. - [MAC flooding](https://lockincs.com/ap-cybersecurity/glossary/mac-flooding/): Sending a switch many frames with different fake media access control (MAC) addresses so its table fills and it broadcasts frames out of every port. - [MAC spoofing](https://lockincs.com/ap-cybersecurity/glossary/mac-spoofing/): Making a device send a media access control (MAC) address other than its own. - [Network data port](https://lockincs.com/ap-cybersecurity/glossary/network-data-port/): A socket in a wall that is cabled to a switch port; plugging a device into it connects that device to the local area network (LAN). - [On-path attack](https://lockincs.com/ap-cybersecurity/glossary/on-path-attack/): An attack in which the adversary secretly sits between two parties, capturing and possibly altering the data they exchange. - [Packet](https://lockincs.com/ap-cybersecurity/glossary/packet/): A small unit of data sent across a network, made of headers (addresses and control information) and a payload (the data). - [Rogue access point](https://lockincs.com/ap-cybersecurity/glossary/rogue-access-point/): An unauthorized wireless access point connected to an organization's network, often through an open data port. - [Router](https://lockincs.com/ap-cybersecurity/glossary/router/): A device that joins networks and forwards packets between them by reading internet protocol (IP) addresses. - [Service set identifier (SSID)](https://lockincs.com/ap-cybersecurity/glossary/ssid/): The name of a wireless network, announced in beacon frames. - [Smurf attack](https://lockincs.com/ap-cybersecurity/glossary/smurf-attack/): A denial-of-service attack: internet control message protocol (ICMP) requests sent to a broadcast address with the victim's address forged as the source, so all replies flood the victim. - [Switch](https://lockincs.com/ap-cybersecurity/glossary/switch/): A device that joins hosts within a local area network (LAN) and forwards each frame only to the port where the destination media access control (MAC) address was seen. - [Triangulation](https://lockincs.com/ap-cybersecurity/glossary/triangulation/): Locating a signal's source by measuring its strength from several positions. - [Vulnerability scanner](https://lockincs.com/ap-cybersecurity/glossary/vulnerability-scanner/): An automated tool that checks networks, devices and applications for known vulnerabilities and reports what it finds. - [Wireless access point (WAP)](https://lockincs.com/ap-cybersecurity/glossary/wireless-access-point/): A device that connects wireless devices to a wired local area network (LAN) by radio and announces the network in beacon frames. ## Optional - [About and privacy](https://lockincs.com/about/): how content is checked against the CED; license CC BY-NC-ND 4.0. AP® is a trademark registered by the College Board, which is not affiliated with, and does not endorse, this website.