AP Cybersecurity

The multiple-choice section includes individual questions as well as sets of 2, 3, or 4 questions. 

You’ll be asked to analyze scenarios and digital evidence to: 

• Apply foundational cybersecurity concepts to real-world situations.
• Identify, classify, and assess vulnerabilities.
• Recommend appropriate security controls or mitigations.
• Detect potential attacks or indicators of compromise (IoCs).
• Evaluate suspicious activity and determine whether it poses a security risk.
• Interpret logs, network data, or system behaviors to draw conclusions about what may be happening in a system.

In this free-response question, you’ll be presented with several sources about a single device, such as: 

• security policies
• firewall configurations
• file-system permissions
• network and application logs 

You’ll analyze these sources together to: 

• Identify security issues.
• Detect evidence of attacks.
• Describe how configuration or permission changes would affect the device.
• Evaluate how security controls such as firewalls or automated systems influence network traffic and device behavior. 

You’ll be expected to cite evidence from the provided sources and explain your reasoning when describing attacks, permission settings, or the impact of policy or configuration modifications.