The AP Cybersecurity Exam tests your ability to analyze real device scenarios using policies, logs, firewall configs, and permissions, not just recall definitions. Use the guides here to understand exactly what each section asks and how to respond efficiently.
This page covers exam format, section strategy, task verb expectations, and a review sequence to help you prepare for both the MCQ and FRQ sections.
AP Cybersecurity launched nationally for the 2026-27 school year, with the first exam in 2027. Because no official exam context exists yet, the best preparation evidence comes from the official exam format and the published course framework. Both sections reward applying cybersecurity concepts to scenarios over memorizing isolated definitions.
60 questions, 80 minutes, 70% of your score. That is roughly 80 seconds per question. All five course units appear here. Questions are scenario-based, so you need to read quickly and identify what security concept or skill the scenario is testing before you evaluate the answer choices.
1 question, suggested 50 minutes, 30% of your score. You receive multiple simulated sources about one digital device, such as a firewall configuration, permission list, or system log, and respond to several parts using task verbs like identify, explain, describe, determine, and write.
Both sections prioritize analysis over memorization. On the MCQ, you apply concepts to novel scenarios. On the FRQ, you cite specific evidence from the provided sources and explain your reasoning. Vague answers that name a concept without connecting it to the source material will not earn full credit.
Whether you are eliminating a wrong MCQ answer or writing an FRQ response, the exam expects you to ground your reasoning in specific details: a log entry, a firewall rule, a permission setting, or a policy statement. Practicing how to read and cite simulated sources is the highest-leverage preparation move for this exam.
60 questions in 80 minutes across all five course units. The MCQ guide covers official skill weighting, unit scope, and a reading approach for scenario-driven questions so you can identify the tested concept quickly and eliminate wrong answers efficiently.
One question, 50 minutes suggested, 30% of your score. You analyze simulated sources such as firewall configs, permission lists, and system logs to identify issues, cite evidence, and evaluate security controls. The FRQ guide and Device Security Analysis guide both walk through this task in detail.
The five task verbs on the AP Cybersecurity FRQ are identify, explain, describe, determine, and write. Each verb signals a different response type. The task verbs guide gives evidence-based response models for each so you know exactly what a full-credit answer looks like.
AP Cybersecurity is new, with no official exam context yet. The difficulty guide explains what is known about the exam so far, what skills the format rewards, and a two-week study path based on the official exam structure.
Prepare for the AP Cybersecurity Device Security Analysis FRQ. Learn how to use policies, permissions, logs, configs, and evidence in a 50-minute response.
Section I is 60 questions in 80 minutes, worth 70% of your score. Questions are scenario-driven across all five course units. At about 80 seconds per question, you need a reading method that is fast but accurate: read the scenario, identify the security concept being tested, then evaluate choices. Skip and return to questions that require long re-reads.
| Section | Questions | Time | Score Weight |
|---|---|---|---|
| Section I (MCQ) | 60 | 80 minutes | 70% |
| Section II (FRQ) | 1 | 50 minutes suggested | 30% |
Section II is one Device Security Analysis question with a suggested time of 50 minutes. You receive several simulated sources about a single digital device and answer multiple parts. Each part uses a specific task verb that tells you exactly what kind of response is expected. Reading all sources before writing is strongly recommended because evidence from one source often supports a part that seems to be about a different source.
| Task Verb | What It Asks For | Common Error |
|---|---|---|
| Identify | Name the specific issue or evidence | Describing instead of pointing directly |
| Explain | State what and why with source evidence | Stating what without the why |
| Describe | Detail a process or setting clearly | Being too vague to show understanding |
| Determine | Reach a conclusion with reasoning | Giving a conclusion without showing the logic |
| Write | Produce a rule, config, or policy entry | Using natural language instead of correct syntax |
Because no official exam context exists yet, prioritize the areas the exam format signals most clearly. The FRQ is one question worth 30% of your score, so understanding the Device Security Analysis task and the five task verbs is high-priority work. For the MCQ, review all five units and practice reading scenarios quickly to identify the concept being tested. Use the topic guides available on this page to work through FRQ strategy and MCQ scope.
| Priority | Task | Resource |
|---|---|---|
| First | Understand the FRQ format and source types | Device Security Analysis FRQ Guide |
| Second | Learn the five task verbs and response models | AP Cybersecurity Task Verbs Guide |
| Third | Review all five units for MCQ scope | AP Cybersecurity MCQ Guide |
| Fourth | Practice reading and annotating simulated sources | AP Cybersecurity FRQ Guide |
On the FRQ, a response that explains what a firewall does in general will not earn the same credit as one that references the specific rule or entry in the provided firewall configuration. Always tie your answer to the actual source material.
Explain and describe are not the same thing, and neither is the same as identify. If a part says identify and you write three sentences of explanation, you may be doing extra work without earning extra credit. Read the verb first, then write exactly what it asks for.
At 80 seconds per question, lingering on one difficult scenario can cost you time on several easier ones. Mark uncertain questions, move on, and return if time allows.
All five course units appear in Section I. Focusing only on the units you find most interesting or most familiar leaves gaps that scenario questions will expose. The MCQ guide covers the full unit scope so you can review proportionally.
When an FRQ part uses the write task verb, it expects a correctly formatted rule, configuration entry, or policy line, not a sentence describing what the rule should do. Practice producing the actual format, not a description of it.
Every concept that appears in the Device Security Analysis FRQ, such as firewall rules, file permissions, access controls, and log analysis, is also fair game in Section I MCQ scenarios. Studying the FRQ source types is not separate from MCQ prep; it reinforces the same unit content from a different angle.
The five task verbs used in the Device Security Analysis FRQ each correspond to a different level of response. Identify requires less elaboration than explain, and write requires a formatted artifact rather than prose. Matching your response depth to the verb is how you avoid losing credit on parts you actually understand.
On the MCQ, eliminating wrong answers depends on recognizing what the scenario evidence supports. On the FRQ, earning credit depends on citing specific source details. The core skill is the same: read the scenario or source carefully, identify the relevant evidence, and use it to support a precise conclusion.
Open the individual guides for AP Cybersecurity Exam when you want a closer review of one topic.
browse guidesThe AP Cybersecurity Exam is 2 hours and 10 minutes long. Section I has 60 multiple-choice questions in 80 minutes, worth 70% of your score. Section II has one free-response question, the Device Security Analysis, with a suggested 50 minutes and worth 30% of your score.
The Device Security Analysis is the single free-response question on the AP Cybersecurity Exam. It gives you several simulated sources about one digital device, such as firewall configs, file-system permissions, security policies, and log files, and asks you to identify security issues, find evidence of attacks, and evaluate security controls.
The 60 MCQs cover all five course units and are organized around three assessed skill categories, each appearing at roughly 25 to 35 percent of the section. Questions test your ability to identify threats, mitigate risk, and detect attacks across scenarios involving networks, devices, and applications.
The AP Cybersecurity Device Security Analysis FRQ uses five task verbs: identify, explain, describe, determine, and write. Each verb signals a different type of response. Matching your answer to the correct verb is one of the most reliable ways to earn full credit, even on parts you find straightforward.
Focus on the five course units, then practice reading artifacts like logs, firewall configs, and permission tables quickly and accurately. Use the MCQ guide to learn skill weighting and trap patterns, and use the FRQ guide to build a repeatable workflow for the Device Security Analysis question before exam day.
The FRQ provides multiple simulated sources tied to a single digital device. These typically include firewall settings, file-system permissions, security policies, and log files such as auth logs, web server access logs, and application network logs. Your job is to cite specific evidence from these sources in your responses.