Free · No account needed

AP^® Cybersecurity Practice Test

Test yourself with 25 original multiple-choice questions written by Prep Den, five from each unit of AP Cybersecurity: Introduction to Security, Securing Spaces, Securing Networks, Securing Devices, and Securing Applications and Data. The questions range from core definitions to scenarios where you analyze a risk, choose a mitigation, or read a log for signs of an attack.

Answer every question, then submit to get your score out of 25, a breakdown by unit, and an explanation for each answer. The real exam allows about 80 seconds per multiple-choice question; to practice that pace, start the optional 33-minute timer.

An independent Prep Den resource. Original practice material written for the current course framework; not official College Board material.

0 of 25 answered · suggested time 33 min

25 unanswered: they'll count as incorrect.

Answer key

1. B A denial-of-service attack prevents authorized users from reaching the service, which directly attacks availability. Authentication is part of AAA, not the CIA triad.
2. B Tailgating is entering a restricted area by following close behind an authorized person WITHOUT their awareness. Piggybacking would require the authorized person to knowingly grant access (e.g., holding the door).
3. B ARP poisoning falsifies the gateway's ARP table so traffic meant for the target is redirected to the adversary. Because the adversary now sits between the parties capturing data, it is an on-path (man-in-the-middle) attack. A smurf attack is an ICMP flood, MAC flooding targets a switch with many different MAC addresses, and DNS poisoning plants a fake DNS record; none of them alters the gateway's ARP table.
4. C A worm spreads from one computer to another with no human interaction. A virus, by contrast, must be activated by a user executing or opening a file.
5. C Placing SQL commands into an unvalidated input field is SQL injection, which can breach integrity by modifying or deleting data. Validating and sanitizing user input to reject control characters helps prevent it.
6. B Risk requires a threat (something that can cause harm) able to exploit a vulnerability (a weakness) against a valuable asset. The direction matters: threats exploit vulnerabilities, not the reverse. With no threat there is no risk, and likelihood is one factor used to assess risk, not the definition of a threat.
7. B Detective controls identify attacks when they occur. Cameras, motion sensors, IDS, and SIEM are detective. Managerial is a control TYPE, not a function, so it does not fit the question.
8. D MAC flooding sends many frames with different MAC addresses to force a switch into broadcast mode. Port security limits the number of MAC addresses assignable to a single switch port, blocking the flood. MAC filtering on wireless access points keeps unauthorized devices off the wireless network but does not protect the switch; a NIDS can detect the surge of frames but only raises an alert; a stateless firewall filters traffic crossing a boundary, not frames inside the LAN.
9. A Signature-based detection uses fewer resources than anomaly-based detection and is the better choice for devices with limited processing power. Anomaly-based and hybrid models need more memory and CPU than these devices can spare (hybrid suits sensitive devices that have the resources), and encryption protects data rather than detecting attacks. Many embedded devices cannot run any detection tools at all.
10. D Role-based access control (RBAC) assigns each subject to a role and defines which roles can access which objects. DAC lets owners set access; MAC uses external level assignments; RuBAC applies a set of rules.
11. C Threatening a lockout is intimidation; the five-minute deadline is urgency. (Posing as IT also adds authority, but "authority only" misses the two pressure tactics.) Scarcity and consensus are not present. A one-time password (OTP) is secure information, and sharing it lets the adversary log in as you right away, before it expires. Never share it; verify the request through a separate, trusted channel.
12. C Risk avoidance stops the activity generating the risk. It is only possible when the activity is not critical to the mission. Mitigation adds controls; transference shifts the burden; acceptance lives with residual risk.
13. A ACL rules are checked in order and the first matching rule executes. Inbound TCP port 22 (SSH) matches Rule 1 (ALLOW) first, so it is permitted. Reversing the rules would deny all inbound TCP, including SSH.
14. B Cracking a stolen hash database on the adversary's own computer is an offline password attack. Because it never uses the organization's live authentication portal, account-lockout protections do not apply. Salting still slows it by defeating precomputed rainbow tables.
15. B Cryptographic hashes are repeatable and reveal when a file is altered. But reading or copying data does not change the file, so the hash stays the same and the theft is a false negative for this control.
16. D Many failed attempts in a short time, an unknown device, and an unusual hour are the three signs of an online password attack. Long, random, unique passwords and MFA are the strongest defenses.
17. B Persistence means maintaining access without needing to regain it, often with malware like a RAT or rootkit that uses a command and control (C2) channel. The phishing itself was initial access; lateral movement escalates privileges across other accounts; evading detection removes logs and planted files.
18. B A screened subnet, or DMZ, sits between the public internet and the internal private network. It is a lower-security zone (not a high-security one) that holds publicly facing resources like web servers, separating them from the internal LAN, often between two firewalls. A VLAN is a different segmentation technique built with switches, and an encrypted tunnel for remote employees is a VPN.
19. D Storing previous password hashes to prevent reuse is the password-history setting; locking the account after a number of failed attempts is the lockout-period setting. Both are configurable login settings (Topic 4.2.D).
20. C Read is 4, write is 2, execute is 1. Owner 7 = 4+2+1 (read/write/execute), group 5 = 4+1 (read/execute), other 0 = no access, so chmod 750 file is correct. chmod 777 grants everyone full access; chmod 705 gives the group nothing and others read/execute.
21. B Relying on purchased tools that exploit known vulnerabilities marks a low-skilled adversary; high-skilled adversaries build or modify tools and can find zero days. Wanting to impress others is a desire for recognition, not greed or dedication to a cause.
22. A Moderate risk arises when a nonsensitive part of an organization is left unprotected in a way that could give an adversary a foothold for initial access to other resources. The PC's own data is not sensitive, but its network connection and open ports make it a stepping stone, so "low" understates the risk.
23. D One source probing many different ports in a few seconds is the signature of an unauthorized network scan, a network-based IoC read from source IP, destination ports, and protocol. Mismatched port-application traffic would be one service running on another service's port; a smurf attack uses ICMP to the broadcast address, not TCP SYN packets; ARP poisoning appears as duplicate-MAC ARP packets, not TCP connection attempts.
24. A A rapid series of default usernames (admin, root, test, guest) tried one second apart from a single IP address is the indicator of credential stuffing. Spraying targets many real user accounts, and offline attacks (brute force on a stolen database, rainbow tables) leave no entries in the device's auth log at all.
25. C An $n$ -bit key has a keyspace of $2^n$ , and a random guesser needs $2^n/2 = 2^{n-1}$ guesses on average. For a 40-bit key that is $2^{40}/2 = 2^{39}$ . $2^{40}$ is the whole keyspace (the worst case), not the average.

What to study next

Start with your weakest unit. The unit breakdown shows where points slipped. One unit at a time beats rereading everything.
Learn from each miss. Read the explanation, then restate the idea in your own words: why the right answer works and why the option you picked does not.
Practice with new questions. Retaking the same 25 questions measures memory more than understanding, so move on to fresh questions once you have reviewed.
Practice applying ideas. Many exam questions describe a situation and ask you to apply a concept to it, so practice explaining your reasoning, not just recalling terms.

Want structured review for every unit? The Prep Den AP^® Cybersecurity study guide has study notes, flashcards, and more practice questions for each one.

Continue with the AP^® Cybersecurity Course Companion

The full Prep Den AP^® Cybersecurity study guide picks up where this free page leaves off. It includes:

6 topics with full study notes
All 141 flashcards
107 practice questions with explanations
23 free-response practice problems with worked solutions
Term-matching games
A 129-term key-terms bank
Exam tips throughout

See the AP^® Cybersecurity guide

$24.99 one-time payment, 12 months of access.

Taking more than one AP or IB course? The Student Pass and Platinum Unlimited plans are also available.

What to study next

Continue with the AP® Cybersecurity Course Companion

Continue with the AP^® Cybersecurity Course Companion