The AP Cybersecurity Exam tests your ability to analyze real device scenarios using policies, logs, firewall configs, and permissions, not just recall definitions. Use the guides here to understand exactly what each section asks and how to respond efficiently.
Fiveable's AP Cybersecurity AP Cybersecurity Exam review covers 5 topics, with guided practice questions for the unit.
This page covers exam format, section strategy, task verb expectations, and a review sequence to help you prepare for both the MCQ and FRQ sections.
AP Cybersecurity launched nationally for the 2026-27 school year, with the first exam in 2027. Because no official exam context exists yet, the best preparation evidence comes from the official exam format and the published course framework. Both sections reward applying cybersecurity concepts to scenarios over memorizing isolated definitions.
The exam is 2 hours and 10 minutes. Section I has 60 MCQ in 80 minutes worth 70% of your score. Section II has 1 Device Security Analysis FRQ with a suggested 50 minutes worth 30%. Every question, in both sections, is scenario-driven and asks you to reason with evidence rather than recall a term.
60 questions, 80 minutes, 70% of your score. That is roughly 80 seconds per question. All five course units appear here. Questions are scenario-based, so you need to read quickly and identify what security concept or skill the scenario is testing before you evaluate the answer choices.
1 question, suggested 50 minutes, 30% of your score. You receive multiple simulated sources about one digital device, such as a firewall configuration, permission list, or system log, and respond to several parts using task verbs like identify, explain, describe, determine, and write.
Both sections prioritize analysis over memorization. On the MCQ, you apply concepts to novel scenarios. On the FRQ, you cite specific evidence from the provided sources and explain your reasoning. Vague answers that name a concept without connecting it to the source material will not earn full credit.
Whether you are eliminating a wrong MCQ answer or writing an FRQ response, the exam expects you to ground your reasoning in specific details: a log entry, a firewall rule, a permission setting, or a policy statement. Practicing how to read and cite simulated sources is the highest-leverage preparation move for this exam.
60 questions in 80 minutes across all five course units. The MCQ guide covers official skill weighting, unit scope, and a reading approach for scenario-driven questions so you can identify the tested concept quickly and eliminate wrong answers efficiently.
One question, 50 minutes suggested, 30% of your score. You analyze simulated sources such as firewall configs, permission lists, and system logs to identify issues, cite evidence, and evaluate security controls. The FRQ guide and Device Security Analysis guide both walk through this task in detail.
The five task verbs on the AP Cybersecurity FRQ are identify, explain, describe, determine, and write. Each verb signals a different response type. The task verbs guide gives evidence-based response models for each so you know exactly what a full-credit answer looks like.
AP Cybersecurity is new, with no official exam context yet. The difficulty guide explains what is known about the exam so far, what skills the format rewards, and a two-week study path based on the official exam structure.
Prepare for the AP Cybersecurity Device Security Analysis FRQ. Learn how to use policies, permissions, logs, configs, and evidence in a 50-minute response.
Section I is 60 questions in 80 minutes, worth 70% of your score. Questions are scenario-driven across all five course units. At about 80 seconds per question, you need a reading method that is fast but accurate: read the scenario, identify the security concept being tested, then evaluate choices. Skip and return to questions that require long re-reads.
Can you identify which course unit a scenario-based MCQ is testing within the first two sentences of the prompt? That recognition speed is what keeps your pacing on track.
| Section | Questions | Time | Score Weight |
|---|---|---|---|
| Section I (MCQ) | 60 | 80 minutes | 70% |
| Section II (FRQ) | 1 | 50 minutes suggested | 30% |
Section II is one Device Security Analysis question with a suggested time of 50 minutes. You receive several simulated sources about a single digital device and answer multiple parts. Each part uses a specific task verb that tells you exactly what kind of response is expected. Reading all sources before writing is strongly recommended because evidence from one source often supports a part that seems to be about a different source.
Before you write your first sentence on the FRQ, underline or annotate the specific evidence in the sources you plan to cite for each part. Responses that name a concept without quoting or referencing source details rarely earn full credit.
| Task Verb | What It Asks For | Common Error |
|---|---|---|
| Identify | Name the specific issue or evidence | Describing instead of pointing directly |
| Explain | State what and why with source evidence | Stating what without the why |
| Describe | Detail a process or setting clearly | Being too vague to show understanding |
| Determine | Reach a conclusion with reasoning | Giving a conclusion without showing the logic |
| Write | Produce a rule, config, or policy entry | Using natural language instead of correct syntax |
Because no official exam context exists yet, prioritize the areas the exam format signals most clearly. The FRQ is one question worth 30% of your score, so understanding the Device Security Analysis task and the five task verbs is high-priority work. For the MCQ, review all five units and practice reading scenarios quickly to identify the concept being tested. Use the topic guides available on this page to work through FRQ strategy and MCQ scope.
Have you read at least one simulated Device Security Analysis source set and practiced annotating it before writing? That workflow is the core FRQ skill this exam tests.
| Priority | Task | Resource |
|---|---|---|
| First | Understand the FRQ format and source types | Device Security Analysis FRQ Guide |
| Second | Learn the five task verbs and response models | AP Cybersecurity Task Verbs Guide |
| Third | Review all five units for MCQ scope | AP Cybersecurity MCQ Guide |
| Fourth | Practice reading and annotating simulated sources | AP Cybersecurity FRQ Guide |
On the FRQ, a response that explains what a firewall does in general will not earn the same credit as one that references the specific rule or entry in the provided firewall configuration. Always tie your answer to the actual source material.
Explain and describe are not the same thing, and neither is the same as identify. If a part says identify and you write three sentences of explanation, you may be doing extra work without earning extra credit. Read the verb first, then write exactly what it asks for.
At 80 seconds per question, lingering on one difficult scenario can cost you time on several easier ones. Mark uncertain questions, move on, and return if time allows.
All five course units appear in Section I. Focusing only on the units you find most interesting or most familiar leaves gaps that scenario questions will expose. The MCQ guide covers the full unit scope so you can review proportionally.
When an FRQ part uses the write task verb, it expects a correctly formatted rule, configuration entry, or policy line, not a sentence describing what the rule should do. Practice producing the actual format, not a description of it.
Every concept that appears in the Device Security Analysis FRQ, such as firewall rules, file permissions, access controls, and log analysis, is also fair game in Section I MCQ scenarios. Studying the FRQ source types is not separate from MCQ prep; it reinforces the same unit content from a different angle.
The five task verbs used in the Device Security Analysis FRQ each correspond to a different level of response. Identify requires less elaboration than explain, and write requires a formatted artifact rather than prose. Matching your response depth to the verb is how you avoid losing credit on parts you actually understand.
On the MCQ, eliminating wrong answers depends on recognizing what the scenario evidence supports. On the FRQ, earning credit depends on citing specific source details. The core skill is the same: read the scenario or source carefully, identify the relevant evidence, and use it to support a precise conclusion.
Section I is 60 MCQ in 80 minutes at 70% of your score. Section II is 1 Device Security Analysis FRQ with a suggested 50 minutes at 30%. Knowing the structure before exam day removes decision-making pressure during the test.
Every unit is assessed in Section I. Use the MCQ guide to check which skill categories are weighted most heavily and make sure you can recognize the tested concept from the first two sentences of a scenario prompt.
Before writing any FRQ response, read all provided sources and annotate the specific evidence you plan to cite for each part. This workflow prevents the most common FRQ error: writing about a concept without grounding it in the actual source material.
Each FRQ part uses a specific task verb. Identify asks you to point, explain asks you to state what and why, describe asks for detail, determine asks for a reasoned conclusion, and write asks for a correctly formatted artifact. Misreading the verb is one of the most common ways to lose credit on a part you actually understand.
The FRQ gives you multiple simulated sources about one device. The Device Security Analysis guide walks through the source types you will see, including policies, firewall configurations, permission lists, and logs, so none of them feel unfamiliar during the exam.
For each of the five task verbs, confirm you can write a response that matches what the verb asks. The task verbs guide includes evidence-based models for each one. If any verb still feels unclear, review that section before the exam.
Read the AP Cybersecurity FRQ Guide and the Device Security Analysis FRQ Guide. Understand what sources the FRQ provides, what each part asks, and how the 50-minute suggested time maps to the number of parts. Then read the Task Verbs Guide and write one example response for each of the five verbs.
Use the AP Cybersecurity MCQ Guide to work through the official skill weighting and unit coverage for Section I. For each unit, identify the core concepts and practice recognizing them in scenario descriptions. Focus on units where you feel least confident first.
Take any simulated source set, such as a sample firewall config, permission list, or log, and practice annotating it before writing. For each annotation, note which FRQ part the evidence supports. Then write a response for each part and check that every sentence references a specific source detail.
Work through MCQ scenarios under timed conditions. Aim for the 80-second-per-question pace. After each set, review which questions took too long and identify whether the delay was from reading the scenario, recognizing the concept, or evaluating the answer choices. Adjust your reading approach accordingly.
Reread the exam format details: 2 hours 10 minutes total, Section I is 60 questions in 80 minutes at 70%, Section II is 1 FRQ in 50 minutes at 30%. Review your task verb response models one more time. Confirm you know what to do in the first five minutes of each section before you start writing.
Open the individual guides for AP Cybersecurity Exam when you want a closer review of one topic.
Use AP-style practice after you review the notes so you can check what you understand.
Practice free-response reasoning and compare your answer with scoring guidance.
Estimate your broader AP score goal after you review the course and exam format.
Print the cheatsheet bundle ($14) or full-length exam ($12) for this subject. Yours to keep, no subscription needed.
get printablesThe AP Cybersecurity Exam is 2 hours and 10 minutes long. Section I has 60 multiple-choice questions in 80 minutes, worth 70% of your score. Section II has one free-response question, the Device Security Analysis, with a suggested 50 minutes and worth 30% of your score.
The Device Security Analysis is the single free-response question on the AP Cybersecurity Exam. It gives you several simulated sources about one digital device, such as firewall configs, file-system permissions, security policies, and log files, and asks you to identify security issues, find evidence of attacks, and evaluate security controls.
The 60 MCQs cover all five course units and are organized around three assessed skill categories, each appearing at roughly 25 to 35 percent of the section. Questions test your ability to identify threats, mitigate risk, and detect attacks across scenarios involving networks, devices, and applications.
The AP Cybersecurity Device Security Analysis FRQ uses five task verbs: identify, explain, describe, determine, and write. Each verb signals a different type of response. Matching your answer to the correct verb is one of the most reliable ways to earn full credit, even on parts you find straightforward.
Focus on the five course units, then practice reading artifacts like logs, firewall configs, and permission tables quickly and accurately. Use the MCQ guide to learn skill weighting and trap patterns, and use the FRQ guide to build a repeatable workflow for the Device Security Analysis question before exam day.
The FRQ provides multiple simulated sources tied to a single digital device. These typically include firewall settings, file-system permissions, security policies, and log files such as auth logs, web server access logs, and application network logs. Your job is to cite specific evidence from these sources in your responses.